I'm hoping I'm able to do what I set out to do, but I need help if anyone feels up to giving me some pointers...

 

1. UnRAID is running on eth0 on 192.168.176.21
2. I set up Dynamix Wireguard
3. I set up Pi-Hole in a Docker container on its own IP on the br0 (eth0 bridge) interface (in this case it's 192.168.176.53)
4. I do have two NICs both connected to the same network, but I did disable eth1 for now due to running into issues with all of this.
5. I want to be able to set DNS on the Wireguard Peer to 192.168.176.53 so the connected VPN client device can access my locally defined DNS.

 

The main issue is that the host doesn't like talking directly to containers via the bridge interface (br0), and my understanding is that this is by design.  I attempted to enable the docker setting "Host access to custom networks", but when connected to the Wireguard VPN with DNS configured to use Pi-Hole (at 192.168.176.53), my VPN client device still does not resolve the locally defined DNS in Pi-Hole.  I can, however, connect just fine to the internal network via IPs.

 

I have Unraid web on port 9999 (not port 80).  I have Nginx-Proxy-Manager serving via "Bridge" interface on port 80 and 443.  So I can't have Pi-Hole serve on that same interface (thus why it's on br0 with its own .176 subnet IP address).

 

I attempted numerous things to get Pi-Hole to work via my VPN such as: segregating into its own vlan (like br0.180 and set the Pi-Hole IP to 192.168.180.53), and tried its own custom interface (like: br1 with eth1 bridged on it via 192.168.176.22).

 

None of this worked, mainly because I lack the proper networking knowledge to do what I'm hoping to do.  Most suggestions out there is to run Pi-Hole on a separate device and not within UnRAID/Docker.

 

Is what I'm wanting possible -- to be able to run Pi-Hole and Nginx-Proxy-Manager in Docker and serve Wireguard VPN peers with access to local DNS via the Pi-Hole Docker Container?  And if so, any pointers on how I could achieve this?

 

Thanks in advance for any help, and no worries if this is too much of a pain to try to get into.

Nevermind, I got it working, but not in the way I was hoping.

 

I'm now running Pi-Hole within an Ubuntu Server VM on the same IP I had set for the docker container.

 

I had to disable the docker setting for "Host access to custom networks" in order to allow the wg0 route to access the VM IP (or any docker IP) while on the VPN.  This was considerably unclear on what that setting really is doing (though I do understand it's supposed to allow Unraid host to be able to directly connect to docker containers on the same subnet).  In any case, having that setting enabled breaks VPN subnet routing to the local LAN CIDR (except for the host IP in order for WG to work) to anything forwarded to docker, and also breaks access to VM IPs on the same subnet as the host.

 

So in short, I have Wireguard on the host (via the Dynamix plugin), Nginx-Proxy-Manager in a docker container hosting ports 80/443 and Pi-Hole in a VM, thus allowing my WG peer to access my full LAN and have local DNS capabilities.