Hello and welcome to the support thread for the Pihole-V6-Unbound Community Application.

 

It is a straight pull of the docker Pi-hole container with some flavoring to add unbound as a recursive DNS resolver.

 

This is a template for the fantastic work of mpgirro, which is a fork of the original from chriscrowe.

 

What is Pi-hole?

Pi-hole is an open-source, self hosted DNS sinkhole, which can block advertisements based on curated URL ad lists and optionally serves as a DHCP server.  Basically, you setup Pi-hole on your network and direct all your DNS queries to it and it against the blocklist and, if allowed, forwards the request to the configured upstream name server and provides the resolution back.

 

Why use Pi-hole?

The internet is not as safe and care free as it once was.  The main use of pi-hole is blocking ads by ensuring that requests to URLs that host them go unanswered.  THIS IS NOT A FOOLPROOF AD SOLUTION.  Advertisements like the ones you see on youtube videos are provided by the same domain as the videos themselves.  Look into something like uBlock Origin for a browser based ad solution.

Additionally, Pi-hole can be used to route custom DNS traffic.

 

What is unbound?

Unbound is a recursive DNS resolver.  Instead of asking a public name server what ip address corresponds to pi-hole.net, unbound asks the DNS root servers "Who handles '.net'?", it will ask a '.net' TLD server "Who handles 'pi-hole.net'?", and finally it will ask the authoritative name server "What is the IP for 'pi-hole.net'?"

 

Why would you use unbound instead of Quad9, Google or Cloudflare or my ISP?

Public DNS name servers are basically just copies of what the authoritative name servers have told them.  They do have incentive to be secure and accurate but they are not the source.  Additionally, when you send DNS queries to these name servers, you are telling them that you are going to these sites.  Running unbound is more secure.

 

Running this app should be self explanatory.  If you have questions about the template, please leave a reply.  If you have a problem with the container itself, Pi-hole or unbound, please reach out to those developers for support.

I get the following error while trying to spin up this container on a bridged network (dhcp is elsewhere on the hosts vlan):

 

Quote

docker: Error response from daemon: driver failed programming external connectivity on endpoint pihole-v6-unbound (ddd3fb7c54c8825678c96e83d297e41c28c18f7adbe8b201dfe5950b634ee647): failed to bind port 0.0.0.0:53/tcp: Error starting userland proxy: listen tcp4 0.0.0.0:53: bind: address already in use.

 

It seems that it wants to listen on the hosts ip address, instead of it own dhcp assigned address (obviously not getting one, since the container doesn't start). Or maybe I'm misreading the situation(?)..

 

Is it possible for me to define the listen address manually?

You are correct, the default Bridge network does use the host IP address and you assign ports to different docker containers.

 

There are problems with assigning port 53 in Unraid.  I'm not sure of your particular setup but it seems to be related to VMs and Libvirt running dnsmasq on that port.

 

What I do (and what I have in the template) is run the container on network br0.  This will allow you to assign a "Fixed IP address (optional):" right below the network type.

As for getting a dhcp assigned address, I have worked LONG and HARD trying to get that working for Docker containers.  And I am positive there is a solution out there but I couldn't find it.  Docker doesn't work like that out of the box.  You would need to install a custom docker network driver and I broke my unraid setup trying to get this to work.

 

Lemme know if that doesn't work for you.

I tried the above approach (after creating a docker network "lan" on the same subnet as the host), but I get the exact same error.

 

Here's the privacy-scrubbed output:

 

Quote

 

docker run
  -d
  --name='pihole-v6-unbound'
  --net='lan'
  --ip='10.0.0.201'
  --pids-limit 2048
  -e TZ="**"
  -e HOST_OS="Unraid"
  -e HOST_HOSTNAME="********"
  -e HOST_CONTAINERNAME="pihole-v6-unbound"
  -e 'TZ'='**'
  -e 'FTLCONF_webserver_api_password'='************'
  -e 'FTLCONF_webserver_interface_theme'='default-auto'
  -e 'FTLCONF_dns_upstreams'='127.0.0.1#5335'
  -e 'FTLCONF_dns_dnssec'='true'
  -e 'FTLCONF_dns_listeningMode'='single'
  -e 'FTLCONF_misc_etc_dnsmasq_d'='false'
  -e 'FTLCONF_misc_dnsmasq_lines'=''
  -e 'FTLCONF_dns_revServers'='false'
  -l net.unraid.docker.managed=dockerman
  -l net.unraid.docker.webui='http://[IP]:[PORT:80]/admin'
  -l net.unraid.docker.icon='https://raw.githubusercontent.com/Eksistenze/unraidtemplates/main/pihole-unbound/pihole.png'
  -p '80:80/tcp'
  -p '443:443/tcp'
  -p '53:53/tcp'
  -p '53:53/udp'
  -p '5335:5335/tcp'
  -p ':67/udp'
  -p ':123/udp'
  -v '/mnt/user/appdata/pihole-v6-unbound':'/config':'rw'
  -v '/mnt/user/appdata/pihole-unbound/etc_pihole-unbound':'/etc/pihole':'rw'
  -v '/mnt/user/appdata/pihole-unbound/etc_pihole_dnsmasq-unbound':'/etc/dnsmasq.d':'rw'
  --cap-add=NET_ADMIN
  --restart=unless-stopped
  --hostname=piholev6unbound 'mpgirro/docker-pihole-unbound'

d07d380667a29bdfbfe914f4d5e5d9c0dde7851d5489b7ffcb47098d2fb87ee0
docker: Error response from daemon: driver failed programming external connectivity on endpoint pihole-v6-unbound (7164595e0dbbdc61c74f0199e3134663242e5b8265336337977731fc2b39f61d): failed to bind port 0.0.0.0:53/tcp: Error starting userland proxy: listen tcp4 0.0.0.0:53: bind: address already in use.

 

 

Okay,

Based on reading and my own experimentation, creating a custom docker network is just so that docker container(within the same docker network) can communicate with each other directly, as docker handles it internally, container to container.

 

My example:

bridge network subnet: 172.17.0.0/16

custom docker network subnet: 172.18.0.0/16

 

So all of my docker containers can talk to one another inside the unraid machine without hitting my router at all.  When they DO need to enter/exit the unraid machine, they still do so using my unraid IP address assigned by whatever DHCP server I'm using.  So if dnsmasq is using port 53 on your unraid machine, neither of these will work.

 

I'm not sure how you have your network settings in Unraid.  I will give a picture of mine.  But Unraid itself will generate a custom network that allows you to set your own IP addresses within your network subnet.  For me, this is br0.  Then I can manually assign an IP for my pihole container.  This is a separate IP address than my unraid machine and(hopefully) anything else on my network, which means all ports are available.  This also means that any containers needing to communicate with pihole will exit my unraid machine, go through my router, and then back into my unraid machine to the pihole container.

 

Additionally, you will probably need to do something in your router so that it does not assign your custom IP address.  Without knowing what your setup is, I have no idea what that might be.  I assigned the IP address to the MAC of the container as I am running a MACVLAN network.

 

***TLDR***

Use br0 or bond0 or eth0(depending on your unraid network settings and what it generates) and assign a Fixed IP address to your pihole container.

Ahh. I assume that you are running macvlan, correct?

 

Thing is, I'm using ipvlan, and not macvlan, so I have no br0 interface.

Other that that, the network setup is identical to yours (except for disabled ipv6).

 

As per https://docs.docker.com/engine/network/drivers/ipvlan/

bridging should work, and I've tried creating both a bridge (default) network and a ipvlan network in docker, but they both result in an error when trying to run the docker template.

 

I just want the docker container to have an interface exposed directly to the hosts subnet (and and ip address on there - manually or dhcp assigned), so that no dnsmasq is needed, and I was under the impression that this would be possible with the ipvlan driver.

br0 is not related to macvlan or ipvlan.

 

In the Network Settings:

You can have eth0 (Enable bonding: No AND Enable bridging: No)

You can have bond0 (Enable bonding: Yes)

You can have br0 (Enable bonding: No AND Enable bridging: Yes)

 

In the Docker settings:

You can have a Docker custom network type of ipvlan or macvlan.  This changes what type of network is created on eth0, br0 or bond0.

THIS DOES NOT CHANGE THE DEFAULT NETWORK TYPE WHEN USING

docker network create lan

You CAN create your own custom docker networks using ipvlan or macvlan and subnets and whatever.  But, under the hood, unraid does this for you.  Assuming you used the above command to create a network, it used the default bridge network driver.  Bridged docker networks do not give containers their own IPs that are exposed to your network, which you will need for the pihole container.

 

So, in your Docker settings, make sure you have "IPv4 custom network on interface eth0 (optional):" checked.

And in the pihole container, select "Custom : eth0"

Apologies for the confusion.

 

This is my network setup:

 

And this is my docker setup:

(I left the 'Host access to custom networks' disabled , since I am running ipvlan and not macvlan)

 

 

Quote

Assuming you used the above command to create a network, it used the default bridge network driver.

I did - both a default one, and a specific ipvlan network (using the -d option, as described in the DockerDocs article I linked earlier).

 

But I see no "IPv4 custom network on interface eth0 (optional):" option anywhere.

 

These are my only Network Type options in the container:

The four remaining (custom) ones are all manually created (with default settings) with docker network create subnet<CIDR subnet> <name>.

 

 

Ahhhhh!

 

Okay, I just replicated your settings and, if that option is not enabled, it doesn't show up with your docker service running.

 

Set "Enable docker: No" and hit apply.  The setting should then be available.

 

You can then check that box and br0(since you have bridging enabled in your Network Settings) will be available(once you have started Docker again).

 

If you are wondering what happens under the hood, since this is all just a GUI for the command line interface, these are just variables that the rc.docker script is looking for.

The first thing it looks for is that box for the custom network creation.  If that box isn't checked, it doesn't create a custom docker network at all, regardless of the type you have selected.

It probably could be organized or documented better.

Edited April 23, 20251 yr by Eksistenze
clarification

9 hours ago, Eksistenze said:

You can then check that box and br0(since you have bridging enabled in your Network Settings) will be available(once you have started Docker again).

 

Ahh.. I see.

 

When initially setting up my server I left this one out, since I thought it had to do with just ip address assignment (due to the last part/setting):

 

Thank you so much for clearing that up. It has - which is pretty obvious now - given me a few headaches in the past, too. 😅

 

By the way.. I assume that I can just tick the first 'Subnet' option, leave 'DHCP pool' un-ticked, and still get "proper bridging" (..while having to manually assign the IP addresses, in case my existing dhcp serer on that subnet does not assign one)?

EDIT: Yes, the above approach worked, and the container spun up without errors.

Edited April 23, 20251 yr by skumse

Yes, the check mark is to tell Unraid to create the custom docker network when Docker is started.

The Gateway is provided by your DHCP server, probably your router, and is normally the IP of the router itself.

The DHCP pool is if you want Docker to only use a certain range of IPs.  You can manually assign an IP to a container or you can allow Docker to do it and it will assign one in this range.  This is normally accompanied by some setup on your router so that it does not give out those IPs to anything else.

 

Your DHCP server will not assign an address to the Docker containers as Docker has its own DHCP.  IMHO this is a much needed feature for Docker but it's just not how they have built it and I have yet to find any way of accomplishing this.

45 minutes ago, Eksistenze said:

Yes, the check mark is to tell Unraid to create the custom docker network when Docker is started.

The Gateway is provided by your DHCP server, probably your router, and is normally the IP of the router itself.

The DHCP pool is if you want Docker to only use a certain range of IPs.  You can manually assign an IP to a container or you can allow Docker to do it and it will assign one in this range.  This is normally accompanied by some setup on your router so that it does not give out those IPs to anything else.

 

Your DHCP server will not assign an address to the Docker containers as Docker has its own DHCP.  IMHO this is a much needed feature for Docker but it's just not how they have built it and I have yet to find any way of accomplishing this.

 

Yeah, I get the networking side of things. It's the docker way of doing things that I still struggle with.

Also, I hate having more than one ip assignment automation (e.g. dhcp server), as it usually leads to confusion later down the line (at lest in my experience).

 

And since the container does not present itself to the network like a normal client, I think I might be better of with another physical pihole (I already have two, but ideally I wanted one of each (physical/virtual)).

At least I can have a functional containerized version if need be, and it was really nice to get the bridging issue fixed.

 

Hey so please go easy on me, I'm still very new to all this haha.

So basically was looking into Pi-hole and trying to set it up I've had nothing but issues and I have no idea if something is broken or if I'm doing something wrong.

I went to the "apps" tab and pressed install on the "pihole-v6-unbound" docker container, Changed the Network type to "Custom: br0" and assigned the Fixed IP to "192.168.1.5" and set the Web Password, Timezone and pressed apply. The container started and I couldn't open the WebUI so I waited 5 mins then restarted the container and I could access the WebUI fine. 

So I logged in and in the top right under the "Domains on Lists" it just said "Error (-2)" and I just huh strange and clicked on it to see what that was about and a little box said I need to update my gravity list so I do that and just got "[✗] DNS resolution is currently unavailable" and " Waiting until DNS resolution is available" which I thought was strange so I clicked on the Docker contain in Unraid and pressed the handy dandy little "Logs" button to see what was going on.. aND HOLY SHI- I was met with this:

 

And then that basically goes on forever and keeps spitting that out.

 

What can I do? I've tried fully deleting the container, wiping any remails from the appdata share and reinstalling twice and I've tried changing the network type with no luck too and honestly I'm lost.. 

4 hours ago, lordmilky said:

So I logged in and in the top right under the "Domains on Lists" it just said "Error (-2)" and I just huh strange and clicked on it to see what that was about and a little box said I need to update my gravity list so I do that and just got "[✗] DNS resolution is currently unavailable" and " Waiting until DNS resolution is available" which I thought was strange so I clicked on the Docker contain in Unraid and pressed the handy dandy little "Logs" button to see what was going on.. aND HOLY SHI- I was met with this:

 

And then that basically goes on forever and keeps spitting that out.

 

What can I do? I've tried fully deleting the container, wiping any remails from the appdata share and reinstalling twice and I've tried changing the network type with no luck too and honestly I'm lost.. 

 

I had the same issue initially, and found out that /etc/resolve.conf had the nameserver set to 127.0.0.11 (instead of 127.0.0.1), and I haven't yet been able to figure out why.

Changing this worked for me, but I didn't get it to work persistently until after a few reboots, and letting the pihole setup continue, to the point where I could reach the web interface, and import my old settings/lists.

After this, the Domains counter ("Error (-2)") went back to normal as well.

2 hours ago, skumse said:

 

I had the same issue initially, and found out that /etc/resolve.conf had the nameserver set to 127.0.0.11 (instead of 127.0.0.1), and I haven't yet been able to figure out why.

Changing this worked for me, but I didn't get it to work persistently until after a few reboots, and letting the pihole setup continue, to the point where I could reach the web interface, and import my old settings/lists.

After this, the Domains counter ("Error (-2)") went back to normal as well.

I feel like I'm being stupid but how do I get top /ect/resolve.conf? Sorry for asking a question that's probably really simple I'm still learning and trying my best! Thanks for the speedy reply too

1 hour ago, lordmilky said:

I feel like I'm being stupid but how do I get top /ect/resolve.conf? Sorry for asking a question that's probably really simple I'm still learning and trying my best! Thanks for the speedy reply too

First, no need to apologize.  We all started our journey somewhere.

 

It is supposed to be 127.0.0.11.  Again, just to be clear that extra 1 is correct.  That file is generated by Docker and that nameserver is used by docker itself to resolve container names.

 

@lordmilky I also had that error a few times when installing pihole on various setups.  I believe it might be a corruption of the database when it is first loaded.  I just deleted everything and reinstalled and it fixed itself.  All the red gravitydb stuff on the bottom indicates that the database that it's trying to use to store the blocklist is messed up.  All the other errors are normal.

 

@skumse Yeah, I actually stopped using this solution as well for the exact same reason.  I run a pihole on a nano and I have a container on my router itself as a backup.  I just wanted to make this for anyone else that is using it and wanted the latest version.

37 minutes ago, Eksistenze said:

First, no need to apologize.  We all started our journey somewhere.

 

It is supposed to be 127.0.0.11.  Again, just to be clear that extra 1 is correct.  That file is generated by Docker and that nameserver is used by docker itself to resolve container names.

 

@lordmilky I also had that error a few times when installing pihole on various setups.  I believe it might be a corruption of the database when it is first loaded.  I just deleted everything and reinstalled and it fixed itself.  All the red gravitydb stuff on the bottom indicates that the database that it's trying to use to store the blocklist is messed up.  All the other errors are normal.

 

@skumse Yeah, I actually stopped using this solution as well for the exact same reason.  I run a pihole on a nano and I have a container on my router itself as a backup.  I just wanted to make this for anyone else that is using it and wanted the latest version.

I actually fixed all the issues I was having and got it up and running now!

I went into the Tailscale plugin settings and set "Use Tailscale DNS settings" to No, then edited the Pi-hole container and changed "Rev Server" from false to true.
Loaded up the container, did the whole update gravity thing and everything stopped giving me errors! After that I edited the container again and set the "Rev Server" back to false and set the "Use Tailscale DNS settings back" to Yes and restarted the container and everything worked fine from there! No idea what part of them steps fixed it but I'm not complaining!  Thanks for the replies and hope this update helps someone else in the future! 

Hi, is the tailscale integration with unraid 7.x supposed to work out of the box? Currently I get the below error.

 

ERROR: Can't get Tailscale JSON

 

Apparently this is due to missing ca certificates in the container. Anyone else have this issue?

may be wrong place to answer as I've been workgin with another maintainer.. ZapyZap... devzwf pihole v6 apline tag...
 

 

using docker compose I have a unbound, cloudflare alpine pihole v6

 

services:
  pihole:
    container_name: pihole_v6
    hostname: 'pi.hole'
    image: devzwf/pihole-dot-doh:latest-v6
    networks:
       br0: #set to unraid default custom docker netwroking interface in use (br0, bond0, eth0, etc...)
           ipv4_address: 192.168.2.50 # Change this as needed for static IP
    ports:
      # DNS Ports
      - "53:53/tcp"
      - "53:53/udp"
      # Default HTTP Port
      - "80:80/tcp"
      # Default HTTPS Port. FTL will generate a self-signed certificate
      - "443:443/tcp"
      # Uncomment the below if using Pi-hole as your DHCP Server
      #- "67:67/udp"
    environment:
      # Set the appropriate timezone for your location (https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)
      TZ: "America/Chicago"
      # Set a password to access the web interface. Not setting one will result in a random password being assigned
      FTLCONF_webserver_api_password: "test"
      # DoT: unbound (127.0.0.1#5335), DoH: cloudflared (127.1.1.1#5153)
      FTLCONF_dns_upstreams: "127.1.1.1#5153;127.0.0.1#5335"
      FTLCONF_dns_listeningMode: "all"
      FTLCONF_misc_etc_dnsmasq_d: 'true'
    labels:
      # Unraid Compose Web UI Only
      net.unraid.docker.webui: "http://[IP]:[PORT:80]/admin"
      net.unraid.docker.icon: "https://raw.githubusercontent.com/devzwf/unraid-docker-templates/main/images/pihole-logo-bw.png"
      folder.view: "pihole-dot-doh"
      net.unraid.docker.managed: "composeman"
    volumes:
      # Bind mount entrypoint.sh using fixed script above for teting...
      - "/mnt/vm-zfs/Dockers/appdata/pihole-dot-doh/etc-pihole:/etc/pihole:rw"
      - "/mnt/vm-zfs/Dockers/appdata/pihole-dot-doh/etc-dnsmasq.d:/etc/dnsmasq.d:rw"
      - "/mnt/vm-zfs/Dockers/appdata/pihole-dot-doh/config:/config:rw"
    dns:
#      - 192.168.2.3
      - 192.168.2.1
      - 8.8.8.8
    cap_add:
      # See https://github.com/pi-hole/docker-pi-hole#note-on-capabilities
      # Required if you are using Pi-hole as your DHCP server, else not needed
       - NET_ADMIN
       - CAP_SYS_NICE
       - CAP_SYS_TIME
    restart: unless-stopped

networks:
    br0:
        external: true

Its not hard to make a unraid xml template, and most of the same settings I use in pihole v6 may still work and be the same for this docker image...

the unraid template just constructs a docker run line.

 

Edited April 25, 20251 yr by bmartino1
fix compose lattest v6 tag

looks like a pihole v6

mpgirro/docker-pihole-unbound

finnaly hit the CA looks good.

@Alyred

 

as there are some major tempalte config changes... Zapyzap has yet to make and update a xml template for unraid CA.
This one works well and has the v6 ftlconf options.

Hello, I'm having trouble trying to access the GUI from the local IP and port. Here's the setup:

 

 

Everything is working from my old container (official) and unbound is doing its job, too. Just can't seem to get to the GUI.

@AnHero Two things.  If you go to the top and toggle the advanced view switch, you'll see more options.  Then go to WebUI:

Here you'll be able to change the link for the WebUI, which you have set to 88.

 

Second thing, why did you do that?  The whole point of the way pihole is setup is that it gets its own IP address.  Which means every port is available.  Which means you don't need to change those from the default.

8 hours ago, Eksistenze said:

@AnHero Two things.  If you go to the top and toggle the advanced view switch, you'll see more options.  Then go to WebUI:

Here you'll be able to change the link for the WebUI, which you have set to 88.

 

Second thing, why did you do that?  The whole point of the way pihole is setup is that it gets its own IP address.  Which means every port is available.  Which means you don't need to change those from the default.

Thanks for the reply!

 

I was always told (and observed) that leaving default ports open on apps was a security risk. That being said, I changed the field you showed and reset http port to 80 I still can't connect. Is there something else I'm missing?

Is there a way to get an IPv6 address with this container as well as the v4 address?