I have been trying to setup my own DIY router with Ubuntu server 18.04.3 LTS. I have managed to get working: networking, DHCP, IP forwarding and masquerading, but I am stuck on the DNS server.

I installed pi-hole on the router and it seems to be working:

dig google.com
dig googletagmanager.com

only the first resolves

dig @ google.com
dig @ googletagmanager.com

both resolve, so it appears as if pi-hole is working properly.

The client gets assigned an ip address (e.g. through dhcp. If I configure isc-dhcp-server to assign the DNS server (google) then the client can browse the internet without problem. However, if I assign the DNS, then I can open websites using their IP address, but not using their domain name.

From the client

dig @ example.com


dig @ example.com

does not work:

; <<>> DiG 9.9.5-3ubuntu0.11-Ubuntu <<>> @ example.com
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

This suggests that the client cannot access the router directly, but when the client opens the IP in a web browser, the pi-hole admin panel shows up.

The firewall is configured in firehol:

version 6

interface enp7s0 wan
    client all accept

for i in 3 4 5 6
    # accept all traffic on lan
    interface enp"$i"s0 "lan$i"
        policy accept
        # server "dns http" accept

    # route packets between lan and wan
    router "lan2wan$i" inface enp"$i"s0 outface enp7s0
        route all accept

Does anyone know what is causing the DNS resolution to fail, or even better, what needs to be done to fix the problem?

put on hold as off-topic by joeqwerty, Ward Sep 12 at 2:10

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions should demonstrate reasonable business information technology management practices. Questions that relate to unsupported hardware or software platforms or unmaintained environments may not be suitable for Server Fault - see the help center." – Ward
If this question can be reworded to fit the rules in the help center, please edit the question.

  • When you "installed pi-hole on the router" exactly what did you to? Put the pi-hole IP as your DNS server (which I've done and works), or have DCHP hand out pi-hole IP as DNS server (I couldn't do this with my router)? I'm finding your whole question somewhat confusing and imprecise. pi-hole has fairly decent documentation. – Tim Sep 11 at 23:17
  • dig @ google.com - That doesn't test your local DNS functionality, Dig will directly make a request to to request that record. If you want to test name resolution on the router try dig @ example.org – Zoredache Sep 11 at 23:22
  • When I said I "installed pi-hole on the router", I meant that I ran the pi-hole installation script on the computer that has 5 network ports and routes the network. I indeed had DHCP send the pi-hole ip (which is its own ip, because it is the same computer) as DNS server, but regardless of whether that is the correct way to do it or not, the client can't perform DNS lookups using that IP either way. Hopefully that clarifies things. – Erik Lievaart Sep 12 at 0:06
  • @Zoredache obviously @ goes straight to google, but that was the second example I gave. In the first example I showed, I did not specify a server in which case dig checks /etc/resolv.conf, which only contains and does exactly what you asked. This resulted in the googletagmanager.com being rejected, while google.com did work. The reason I gave both examples, is to illustrate the difference between a domain that pi-hole is supposed to accept and a domain that pi-hole is supposed to reject in comparison to a public DNS server which accepts both. – Erik Lievaart Sep 12 at 0:15