Lesson 5.1: Beyond the Hosts File

Beyond the Hosts File

The Hosts File Limitation

In previous modules, we used the hosts file to resolve local domains:

127.0.0.1 metube.mct.lan
127.0.0.1 stash.mct.lan
127.0.0.1 auth.mct.lan

Problems with Hosts Files

• Per-Device Configuration: Must be updated on every device
• Manual Management: No automation or central control
• Limited Functionality: Only A records, no advanced DNS features
• No Wildcards: Cannot handle dynamic subdomains
• Mobile Devices: Difficult to modify on phones/tablets
• Guest Access: Visitors cannot access your services

Network-Wide DNS Solution

A local DNS server provides:

Centralized Management

• Single point of configuration
• Automatic updates across all devices
• Consistent resolution network-wide
• Easy addition/removal of services

Advanced Features

• Wildcard domain support
• Multiple record types (A, AAAA, CNAME, MX)
• Conditional forwarding
• DNS filtering and blocking

Device Compatibility

• Works with all network devices
• No per-device configuration needed
• Supports mobile devices automatically
• Guest network compatibility

Why Pi-hole?

Pi-hole is more than just a DNS server:

DNS Server Capabilities

• Local DNS resolution
• Custom domain management
• Upstream DNS forwarding
• DNS over HTTPS (DoH) support

Ad Blocking

• Network-wide ad blocking
• Malware domain filtering
• Tracking protection
• Custom blocklists

Monitoring and Analytics

• Query logging and statistics
• Top domains and clients
• Blocked query tracking
• Network usage insights

DNS Resolution Flow

Understanding how DNS works in your network:

Without Pi-hole

Device → Router → ISP DNS → Internet
       ↓
   No local resolution
   No ad blocking
   No custom domains

With Pi-hole

Device → Router → Pi-hole → Upstream DNS → Internet
                     ↓
                Local domains resolved
                Ads blocked
                Custom rules applied

MCT Services Pi-hole Implementation

Network Architecture

Our Pi-hole setup uses MacVLAN for direct network access:

Physical Network: 10.44.10.0/24
├── Router: 10.44.10.1
├── Pi-hole: 10.44.10.53
├── Docker Host: 10.44.10.100
└── Other Devices: 10.44.10.x

MacVLAN Benefits

• Pi-hole gets its own IP address
• Direct network access without port mapping
• Can bind to standard DNS port 53
• Appears as separate device on network

Docker Configuration

pihole:
  image: pihole/pihole:2024.01.0
  container_name: pihole
  networks:
    mct_macvlan:
      ipv4_address: 10.44.10.53
    mct_public: {}  # For Traefik routing
  environment:
    PIHOLE_DNS_: "1.1.1.1;8.8.8.8"
    DNSMASQ_LISTENING: local
    WEB_PORT: 80

Local Domain Strategy

Domain Structure

Our MCT services use the .mct.lan domain:

• hub.mct.lan - Main dashboard
• auth.mct.lan - Keycloak authentication
• metube.mct.lan - Video downloader
• stash.mct.lan - Media organizer
• dns.mct.lan - Pi-hole admin interface

Wildcard Support

Pi-hole can handle wildcard domains:

# All subdomains point to Docker host
*.mct.lan → 10.44.10.100

Service Discovery

Automatic service discovery possibilities:

• Docker container labels
• Consul integration
• API-driven updates
• Configuration management

DNS Record Types

A Records

Map domain names to IPv4 addresses:

metube.mct.lan → 10.44.10.100

AAAA Records

Map domain names to IPv6 addresses:

metube.mct.lan → 2001:db8::100

CNAME Records

Create aliases for existing domains:

www.mct.lan → hub.mct.lan

MX Records

Mail server configuration:

mct.lan → mail.mct.lan (priority 10)

Network Integration Considerations

DHCP Configuration

Router DHCP must point to Pi-hole:

• Primary DNS: 10.44.10.53 (Pi-hole)
• Secondary DNS: 1.1.1.1 (fallback)
• Domain suffix: mct.lan

Fallback Strategy

Ensure network resilience:

• Secondary DNS servers configured
• Pi-hole high availability options
• Monitoring and alerting
• Backup and restore procedures

Security Considerations

• DNS over HTTPS (DoH) support
• DNS over TLS (DoT) configuration
• Query logging privacy
• Access control and authentication

Benefits for Development

Simplified Development

• No hosts file management
• Consistent URLs across devices
• Easy service testing
• Mobile development support

Team Collaboration

• Shared development environment
• Consistent service access
• Easy demo and testing
• Guest access for stakeholders

Production Simulation

• Real DNS resolution
• SSL certificate validation
• Load balancing testing
• Network behavior simulation

Common Use Cases

Home Lab

• Self-hosted services
• Media servers
• Home automation
• Network storage

Small Office

• Internal applications
• Development environments
• Shared resources
• Guest network services

Development Team

• Microservices testing
• API development
• Integration testing
• Staging environments

Next Steps

In the next lesson, we will dive into Pi-hole configuration and see how to set up custom DNS records for your local services.