So I’ve been a pihole user for a long long time…but seeing the advancements in AdGuard Home and some of the nicer UI facets, I was interested in giving it a try. I also have an active directory domain that I need to manage as well.
So, prior to recently, I had routed all DNS requests thought the AD DCs, and their upstream resolver was PiHole, and then Pihole routed to its internal install of cloudflared with DNS over HTTPS to the cloudflare DNS services.
More recently, I changed my DNS services in DNS to point directly to pihole, managed my local dns records in pihole and then used conditional forwarding to my AD DCs for local DNS resolution. The biggest benefit I saw in this adjustment is that I can identify what hosts are making what requests.
More recently than that, I brought Adguard Home into the environment and am using it as a secondary DNS server. I ended up taking it out of the mix for the moment. My thought process was having one DNS server on each of my active VM hosts just in case…but managing internal DNS records in adguard home is a bit of a pain in the ass, and there is no way to import in bulk.
So, the questions, 1) do you just use one or the other… pihole, vs adguard home… 2) do you use multiple dns servers or just a single one upstream…3) whats your preferred method of internal dns management in conjunction w/ pihole/adguard home?
You must log in or register to comment.
for my home network, i use adguard in combination with my opnsense for dns.upstreams, if it needs to leave my network, are the usual suspects: google, cloudflare, and quad9 - selected based on performance
for my servers/domains i used to just be a regular BIND user, editing the zonefiles manually when needed… but i have since switched my dns over to cloudflare because “easy and no maintenance”
(i might be one of the weird ducks in this sub: i still do my mailserver myself, but outsourced my dns to cloudflare…)
though, to be honest, there are quite a few additional reasons i did the cloudflare move:
- the use of their cdn
- hiding the actual server IPs
- using their zero trust
Clients --> Windows Server 2022 DNS --> Pihole --> Internet
If you have active directory why not just use it’s DNS server?
Clients -> dnsmasq -> PiHole -> Unbound
I run 2 pihole containers on my k8s cluster. They serve up DNS to the rest of my network. This is extremely easy as I can just use helm to launch the pihole containers into two different namespaces using 2 different site specific files. Then I use teleport to keep them in sync when I change something, which is seldom. I run 2 because DNS is important and I like automated patching / reboots. This requires I have redundant services.
Adguardhome + Opnsense
Clients (LAN or VPN) -> PiHole -> DNScrypt-proxy. All hosted on a RPi3 B+. So all my DNS requests are passing through my ISP encrypted.
Dual unbound servers running unbound-adblock in recursive mode with DNSSEC on, with a stubzone for my internal domain (*.lan) pointed at the dnsmasq server that handles dhcp and local DNS.
I wanted dns redundancy so at least “the Internet” would work if I was rebooting something, which the sub zone handles very well.
Dnsmasq is set to no upstreams, and authoritative for the domain. This gives me ddns for clients as well.
I did look into kea for DHCP and nsd for local DNS, but kea wasn’t really ready to handle dual stack clients with the ddns updates. It was neat that you can run kea in a proper redundant config. Not sure I’d have been able to get the ddns updates to dual nsd servers working without a hidden primary, leaving me with a single point failure.
I have two piholes setup as full recursive dns servers (unbound) DHCP is handled by TP link Omada and the piholes are the two dns servers. The top of the DNS chain is cloudflare 1.1.1.1
I use nextdns as I can use that when mobile but if you want a local solution adguard home has DOH/DOT built in and a nicer interface than pihole IMHO
I’ve been using PiHole for years but just switched to NextDNS. Mainly because I use DNS to filter adult sites for my kids. NextDNS works regardless of the network they are on. I used to block YouTube etc at night but if we’re are on holiday they get no filter.
I switched to AD Guard (at home) now as I can configure DNS over TLS for devices that only support regular DNS. So for example my kids TV talks to AD Guard and then AD Guard looks at the MAC address and sends it down a specific DNS over TLS address. So that TV gets the filters of my kids NextDNS profile.
I use technitium as the primary server, with a pair of backup servers running bind9.
The backup servers do zone-transfers from the primary.
I stopped using pihole years ago because it didn’t support wildcards. Technitium DNS server is fantastic. The dev is super responsive and keeps things updated.
Another vote for Technitium DNS. I used PiHole then Adguard Home and Technitium is much better for me. I actually run two of them so I never have more than one down outside of power outages. One on my Pi and one on my server that runs my Docker containers for my other services.
My biggest issue with pihole is that you can’t really sync between multiple servers natively. Does technetium support this?
Technitium
I do the same, just waiting for that cluster feature to come out!
Check this out. I’ve been using it with 3 nodes for years and it works perfectly.
https://github.com/TechnitiumSoftware/DnsServer/issues/231#issuecomment-783114395
Yep, that’s how I’m doing mine too, just the full sync would be nice. If I need to temporarily disable ad blocking for example, currently I have to login to both. It’s the best dns tool I’ve used though, after PiHole for years and then Adguard for a short period until I found this.
This guy DNSes.
I use Adguard. I dumped pi-hole a long time ago and never looked back.
I dumped Pi-hole for Adguard and two technitium dns servers. Personally, I found /r/pihole community toxic. Adguard is also way easier to back up and replicate since the config file is a single yaml file.
What made you move away from Pi-Hole?
Also dumped Pi-hole & moved to AGH over a year now. It’s easier to set up. Encrypted DNS (DoT, DoH, DoQ, etc.) supported with no added install. On Pi-hole I have to install Cloudflared for DoH. AGH also has a large number of blocklists to choose from on DNS blocklists setting. You don’t have to Google search for it like that of Pi-hole. Adding a blocklist is as simple as clicking on the check box & checking for updates. On Pi-hole you have to go through a couple of steps (gui >tools>update gravity). AGH software update also is very simple. An update notice will show up on top if there’s a new update & you just need to click it to update. On Pi-hole you have to login via SSH & issue a pihole -up command to update.
I moved away from pihole because every time I had a fiddle, I bought down the DNS of my whole house, resulting in lots of stressed children :) the solution I switched to is against the ethos of this sub, but it’s good and worth the cost.
2 instances of Adguard Home (VM and Raspberry PI with adguard sync) using DOH upstream servers (currently Cloudflare, Quad 9, and Mullvad). Works like a champ, have not touched it in over a year.
Came here to recommend AdGuard Sync. 👌