Redundant PiHole DHCP setup !

Because I want more control over my DHCP then my providers modem can give I have for a longer time allready used PiHole as my DHCP server. The systems works great and gives me the options I need.

I have been running two PiHoles for a longer period of time, this makes sure I have two DNS servers running.

I keep them up to date using ORBITALSYNC, that works great.

But there has always been one caveat, If the primary PiHole servers breaks down, or the unraid box the VM runs on, then My DHCP is gone and my devices loose their network connection at the end of the lease period. 

There is no way to activate DHCP in PiHole via script (possibly it would be possible to change config files and then restart Pihole processes but that has always been a bit to intrusive for me, if something goes wrong my misery will be bigger).

I have now found a way to very easily do this and just want to share for others benefit.

What I do is basically just have both PiHole servers active at the same time, but BLOCK one of them on network level so functionally there is always only one PiHole actually delivering addresses. Its basically a very small script that I run at a 5 minute interval in CRON:

#!/bin/bash

PRIMARY_PIHOLE="192.168.2.206"
INTERFACE="ens2"

# Check status of primary PiHole
check_primary() {
    sudo nmap --script broadcast-dhcp-discover -e $INTERFACE | grep "Server Identifier: $PRIMARY_PIHOLE" > /dev/null 2>&1
    return $?
}

# Block DHCP traffic on secondary system
block_dhcp() {
    sudo iptables -C INPUT -p udp --dport 67:68 -j DROP 2> /dev/null || sudo iptables -A INPUT -p udp --dport 67:68 -j DROP
    sudo iptables -C OUTPUT -p udp --sport 67:68 -j DROP 2> /dev/null || sudo iptables -A OUTPUT -p udp --sport 67:68 -j DROP
    echo "DHCP geblokkeerd op secundaire Pi-hole."
}

# Unblock DHCP traffic on secondary system
allow_dhcp() {
    sudo iptables -D INPUT -p udp --dport 67:68 -j DROP 2> /dev/null
    sudo iptables -D OUTPUT -p udp --sport 67:68 -j DROP 2> /dev/null
    echo "DHCP toegestaan op secundaire Pi-hole."
}

# Main process - check status and take appropriate action.
if check_primary; then
    block_dhcp
else
    allow_dhcp
fi

The script needs to SUDO to be able to do iptables and nmap, sudo normally asks for a password which is something you do not want in a script, so we need to setup the server the script runs on so it does not need that:

Give the following command:

sudo visudo

And then add the following lines to the bottom of the file replace 'username' with the user you run the script with:

username ALL=(ALL) NOPASSWD: /usr/bin/nmap
username ALL=(ALL) NOPASSWD: /sbin/iptables

To have it run every 5 minutes add it to cron, enter the following command:

crontab -l

And add the followig lines (adjust the paths to fit your situation):

*/5 * * * * /path/to/dhcp_block.sh >> /path/to/logfile.log 2>&1

Script was created with help of chatgtp and has been working fine for me.