I've done a bunch of research, and have reviewed my settings repeatedly, but am over my head on how to debug further. Any help much appreciated. I have setup an unRAID binhex-official-pihole docker on its own subnet(10.55.5.0/24), and have added that subnet to my pfsense router. I can ping from my pfsense LAN (10.55.83.0/24) to the IP address that I have assigned for the pihole gui (10.55.5.4), but when I attempt to access it from a web browser on my LAN using http://10.55.5.4:8155 , I get a timeout. My pfsense LAN has a any-to-any rule for the LAN, and the ping is working, so I don't think it is a firewall issue. Attached are pictures of my settings. I haven't yet set up the rules in my pfSense router to forward DNS requests to the pihole, because I'm thinking if I can't get the GUI working, there is no point in working this further, but I may be assuming incorrectly here. The two issues I am wondering about are: The Docker gateway setting is 10.55.5.1, I'm not clear what, if anything, has to be working on the pfSense router side for this in order for the pihole gui to respond? I don't yet have the rules set up on the pfSense router side to forward DNS requests to pihole yet, could anything there be preventing the pihole gui from responding?

docker vlan settings:

binhex-official-pihole Docker Template settings:

pfsense vlan settings:

What should those VLANs be good for?

They do their job, they isolate the traffic. So how do you expect you could connect across the VLAN borders?

I guess you are lacking the essential basics of VLANs and routing...

I have stepped back to try and simply verify that I have pfSense properly configured to support the vlan (pihole_vlan) that I am using for the docker pihole container. In a console for the pihole docker container, the output of 'ip route show' looks correct:

default via 10.55.5.1 dev eth0

10.55.5.0/24 dev eth0 proto kernel scope link src 10.55.5.4

In the console, a ping of the gateway (10.55.5.1) fails.

In an attempt to debug, in pfSense, I have a pihole_vlan interface rule that I simplified to pass any protocol, any source, any destination:

Here is the route table from pfSense, with the entries of interest circled. I am not understanding why the ping 10.55.5.1 in the docker console is not working?

Problem may be because you use ipvlan and due to one physical ethernet for all vlan, then host network access ( if access to br0.0 ) may need to enable.

I also use one ethernet for all vlan, but I use macvlan and not enable bridge.

You also need confirm Pihole GUI default accept other subnet to access, I use Pihole to serve different VLAN too, but I only route dns query between VLAN, I didn't family Pfsense as I use hardware router doing all routing.

3 minutes ago, Vr2Io said:

Problem may be because you use ipvlan and due to one physical ethernet for all vlan, then host network access ( if access to br0.0 ) may need to enable.

Thank you. I'm not sure where you think the host access needs to be added? On the router, the firewall rule I showed on my previous post should allow the 10.55.5.1/24 vlan to access the WAN.

3 minutes ago, Vr2Io said:

I also use one ethernet for all vlan, but I use macvlan and not enable bridge.

You also need confirm Pihole GUI default accept other subnet to access, I use Pihole to serve different VLAN too, but I only route dns query between VLAN, I didn't family Pfsense as I use hardware router doing all routing.

I'm following directions from here, that specify using a different vlan for the pihole: https://www.vikash.nl/pi-hole-in-docker-container-on-separate-vlan/

I haven't got the pihole GUI working yet, right now I'm just trying to get the vlan to be able to access the WAN.

12 minutes ago, wmcneil said:

Thank you. I'm not sure where you think the host access needs to be added? On the router, the firewall rule I showed on my previous post should allow the 10.55.5.1/24 vlan to access the WAN.

Yes, br0 access br0.5 (pihole) shouldn't need enable host access. Then you should focus why console ( assume you said Pihole console ) why can't ping 10.55.5.1 gateway, they are in same subnet.

18 minutes ago, wmcneil said:

I haven't got the pihole GUI working yet, right now I'm just trying to get the vlan to be able to access the WAN.

So you have different issue actually, I use vlan router, so it rather simple to enable different VLAN to access WAN, i only control what local traffic cross VLAN for maximise security.

I also setup Wireshark to shoot network problem, if no probe in different node, it is quite hard to troubleshooting, almost a dead loop if guess only.

Edited December 30, 2025Dec 30 by Vr2Io

38 minutes ago, Vr2Io said:

Yes, br0 access br0.5 (pihole) shouldn't need enable host access. Then you should focus why console ( assume you said Pihole console ) why can't ping 10.55.5.1 gateway, they are in same subnet.

Yes, I'm kind of stuck. Here is the output from a 'route' command run in the pihole_vlan docker container console (this shows a little more info than the 'ip route' command):

Destination Gateway Genmask Flags Metric Ref Use Iface

default 10.55.5.1 0.0.0.0 UG 0 0 0 eth0

10.55.5.0 * 255.255.255.0 U 0 0 0 eth0

The pihole_vlan is defined for docker as br0.5 . Is it ok that the interface in the table above shows as eth0, instead of br0.5 ? (The docker container is using br0.5 as its network interface, as shown in the picture further above. The only physical ethernet interface is eth0)

For my understanding, Pihole`s eth0, actually is br0.5. Pihole wouldn't know what's setting outside docker.

Pihole eth0 not means Unraid eth0.

Edited December 30, 2025Dec 30 by Vr2Io

2 hours ago, Vr2Io said:

For my understanding, Pihole`s eth0, actually is br0.5. Pihole wouldn't know what's setting outside docker.

Pihole eth0 not means Unraid eth0.

Seems correct

Here is a picture of what I am trying to accomplish:

So the current problem I am trying to debug is that in the pihole docker container console (10.55.5.4), a ping to 10.55.5.1 fails.

It is my understanding that unRAID does no blocking between VLANs (please correct me if I am wrong), so we should need only a firewall rule in the router, which is in place and for testing is set to pass any to any:

The routing tables in the router and in the pihole docker container console look ok (see prior postings). I must be missing something?

Edited December 30, 2025Dec 30 by wmcneil
fix typos

1 hour ago, wmcneil said:

So the current problem I am trying to debug is that in the pihole docker container console (10.55.5.4), a ping to 10.55.5.1 fails.

Yes.

1 hour ago, wmcneil said:

It is my understanding that unRAID does no blocking between VLANs (please correct me if I am wrong), so we should need only a firewall rule in the router, which is in place and for testing is set to pass any to any:

Yes, too.

I notice 10.55.83.10/24 use tag 4091, but you use br0, it should be br0.4091 ? But seem tag over 4000 are special !!

Pls note, in Unraid eth0 / br0 means untag, and eth0.5 / br0.5 means tag. Does br0 will pass through to tag 4091 interface ?

( You should ignore above question as you said all valn can access WAN )

Below are my Unraid docker look like, so eth0 are untag and eth0.666 are tag 666 to router's LAN trunk port.

Edited December 31, 2025Dec 31 by Vr2Io

1 hour ago, Vr2Io said:

I notice 10.55.83.10/24 use tag 4091, but you use br0, it should be br0.4091 ? But seem tag over 4000 are special !!

Pls note, in Unraid eth0 / br0 means untag, and eth0.5 / br0.5 means tag. Does br0 will pass through to tag 4091 interface ?

4091 is a reserved vlan id that pfSense uses for untagged traffic. I did not explicitly assign it.

Docker containers using br0 can ping 10.55.83.1/24 without issue

My pihole_vlan console (which uses br0.5) can not access 10.55.5.1, that is of course the problem I am trying to debug. (The console also can not access any numeric IPs on the WAN either.)

You need to enable this:

On 12/31/2025 at 7:31 PM, MowMdown said:

You need to enable this:

Thanks. I have changed that setting to Enabled, and unfortunately no change in behavior. I can not ping from the pihole_vlan console window to the gateway 10.55.5.1 . The output of ip route in the pihole_vlan console remains the same as previously posted:

default via 10.55.5.1 dev eth0

10.55.5.0/24 dev eth0 proto kernel scope link src 10.55.5.4