Network Integration with Pi-hole

Network Architecture Planning

Understanding Your Network

Before integrating Pi-hole, map your network:

Internet
   ↓
[Router/Gateway] 10.44.10.1
   ↓
[Switch/WiFi] 10.44.10.0/24
   ├── Pi-hole: 10.44.10.53
   ├── Docker Host: 10.44.10.100
   ├── Workstation: 10.44.10.101
   ├── Mobile Devices: 10.44.10.102-110
   └── IoT Devices: 10.44.10.111-120

Integration Strategies

1. Router DHCP Integration (Recommended)
  • Configure router to advertise Pi-hole as DNS
  • Automatic configuration for all devices
  • Centralized management
  • Fallback DNS for redundancy
2. Manual Device Configuration
  • Configure DNS on each device individually
  • More control per device
  • Useful for testing
  • Labor-intensive for large networks
3. Hybrid Approach
  • Router DHCP for most devices
  • Manual configuration for servers
  • Different DNS for guest networks
  • Flexible per-device policies

Router Configuration

Common Router Types

Consumer Routers (Linksys, Netgear, ASUS)
  1. Access router admin interface (usually 192.168.1.1)
  2. Navigate to DHCP/LAN settings
  3. Find DNS server settings
  4. Set Primary DNS: 10.44.10.53
  5. Set Secondary DNS: 1.1.1.1
  6. Save and restart router
pfSense/OPNsense
# Services → DHCP Server → LAN
DNS servers: 10.44.10.53, 1.1.1.1
Domain name: mct.lan
Enable DNS forwarder: Yes
UniFi (Ubiquiti)
# Settings → Networks → LAN
DHCP Name Server: Manual
DNS Server 1: 10.44.10.53
DNS Server 2: 1.1.1.1
Domain Name: mct.lan

DHCP Options

Advanced DHCP configuration for Pi-hole:

# DHCP Option 6 (DNS servers)
option domain-name-servers 10.44.10.53, 1.1.1.1;

# DHCP Option 15 (Domain name)
option domain-name "mct.lan";

# DHCP Option 119 (Domain search list)
option domain-search "mct.lan", "local";

Network Segmentation

VLAN Integration

Pi-hole can serve multiple VLANs:

# VLAN 10: Management (10.44.10.0/24)
# VLAN 20: Workstations (10.44.20.0/24)  
# VLAN 30: IoT (10.44.30.0/24)
# VLAN 40: Guest (10.44.40.0/24)

Per-VLAN DNS Policies

Management VLAN
  • Full access to local services
  • Minimal blocking for admin tools
  • Custom internal domains
Workstation VLAN
  • Standard ad blocking
  • Access to productivity services
  • Social media filtering (optional)
IoT VLAN
  • Aggressive blocking of tracking
  • Limited external access
  • Device-specific whitelisting
Guest VLAN
  • Basic ad blocking only
  • No access to internal services
  • Public DNS fallback

High Availability Setup

Primary/Secondary Pi-hole

Primary Pi-hole: 10.44.10.53

Secondary Pi-hole: 10.44.10.54

# Router DHCP configuration
Primary DNS: 10.44.10.53
Secondary DNS: 10.44.10.54
Tertiary DNS: 1.1.1.1

Configuration Synchronization

Manual Sync
# Export settings from primary
docker exec pihole-primary pihole -a -t

# Import to secondary
docker exec pihole-secondary pihole -a -r backup.tar.gz
Automated Sync Script
#!/bin/bash
# Sync Pi-hole configurations

PRIMARY="10.44.10.53"
SECONDARY="10.44.10.54"

# Copy custom DNS records
scp root@$PRIMARY:/etc/pihole/custom.list root@$SECONDARY:/etc/pihole/
scp root@$PRIMARY:/etc/dnsmasq.d/02-custom.conf root@$SECONDARY:/etc/dnsmasq.d/

# Restart secondary DNS
ssh root@$SECONDARY "pihole restartdns"

Monitoring and Alerting

Health Monitoring

Pi-hole Health Check
#!/bin/bash
# Check Pi-hole health

PIHOLE_IP="10.44.10.53"

# Test DNS resolution
if nslookup google.com $PIHOLE_IP > /dev/null 2>&1; then
    echo "Pi-hole DNS: OK"
else
    echo "Pi-hole DNS: FAILED"
    # Send alert
fi

# Test web interface
if curl -s http://$PIHOLE_IP/admin > /dev/null; then
    echo "Pi-hole Web: OK"
else
    echo "Pi-hole Web: FAILED"
fi
Network Connectivity
# Test from different VLANs
ping -c 1 10.44.10.53  # Management
ping -c 1 10.44.20.53  # Workstation  
ping -c 1 10.44.30.53  # IoT

Performance Monitoring

Query Response Time
# Monitor DNS response times
dig @10.44.10.53 google.com | grep "Query time"

# Continuous monitoring
while true; do
    dig @10.44.10.53 google.com | grep "Query time"
    sleep 5
done
Resource Usage
# Monitor Pi-hole container resources
docker stats pihole --no-stream

# Memory usage
docker exec pihole free -h

# Disk usage
docker exec pihole df -h

Security Considerations

Access Control

Web Interface Security
  • Strong admin password
  • HTTPS access via Traefik
  • IP-based access restrictions
  • Regular security updates
DNS Security
  • Restrict DNS queries to local network
  • Monitor for DNS amplification attacks
  • Rate limiting for queries
  • Logging and alerting

DNS over HTTPS (DoH)

Upstream DoH Configuration
# Use Cloudflare DoH
PIHOLE_DNS_="127.0.0.1#5053"

# Configure cloudflared
docker run -d --name cloudflared 
  --restart=unless-stopped 
  --network=mct_private 
  cloudflare/cloudflared:latest 
  proxy-dns --address 0.0.0.0 --port 5053 
  --upstream https://1.1.1.1/dns-query
Client DoH Support
  • Modern browsers support DoH
  • Configure DoH endpoint: https://dns.mct.lan/dns-query
  • Requires additional Pi-hole configuration
  • Consider privacy implications

Troubleshooting Network Integration

Common Issues

Devices Not Using Pi-hole

Symptoms: Ads not blocked, local domains not resolving

Causes:

  • DHCP not configured correctly
  • Device using static DNS
  • DNS caching on device
  • VPN overriding DNS

Solutions:

# Check device DNS configuration
nslookup pi.hole

# Flush DNS cache (Windows)
ipconfig /flushdns

# Flush DNS cache (macOS)
sudo dscacheutil -flushcache

# Flush DNS cache (Linux)
sudo systemctl restart systemd-resolved
Slow DNS Resolution

Symptoms: Websites load slowly, timeouts

Causes:

  • Upstream DNS server issues
  • Network connectivity problems
  • Pi-hole overloaded
  • Large blocklists

Solutions:

# Test upstream DNS
dig @1.1.1.1 google.com

# Check Pi-hole performance
docker exec pihole pihole -c -e

# Monitor query logs
docker exec pihole tail -f /var/log/pihole.log

Diagnostic Tools

Network Connectivity
# Test Pi-hole reachability
ping 10.44.10.53

# Test DNS port
telnet 10.44.10.53 53

# Test web interface
curl -I http://10.44.10.53/admin
DNS Resolution Testing
# Test local domain
nslookup metube.mct.lan 10.44.10.53

# Test external domain
nslookup google.com 10.44.10.53

# Test blocked domain
nslookup doubleclick.net 10.44.10.53

# Trace DNS path
dig +trace google.com @10.44.10.53

Advanced Integration Scenarios

Multi-Site Setup

Site-to-Site VPN
# Site A: 10.44.10.0/24 (Pi-hole: 10.44.10.53)
# Site B: 10.44.20.0/24 (Pi-hole: 10.44.20.53)

# Cross-site DNS forwarding
server=/sitea.local/10.44.10.53
server=/siteb.local/10.44.20.53
Cloud Integration
  • AWS Route 53 private zones
  • Azure Private DNS
  • Google Cloud DNS
  • Hybrid cloud DNS resolution

Service Discovery Integration

Consul Integration
# Forward .consul domains to Consul
server=/.consul/127.0.0.1#8600
Docker Service Discovery
# Automatic DNS from Docker labels
# Requires additional tooling like docker-gen

Best Practices

Configuration Management

  • Version control DNS configurations
  • Automated deployment scripts
  • Regular configuration backups
  • Change documentation

Monitoring and Maintenance

  • Regular health checks
  • Performance monitoring
  • Security updates
  • Capacity planning

Documentation

  • Network topology diagrams
  • DNS record inventory
  • Troubleshooting procedures
  • Emergency contact information

Next Steps

Now that we have covered Pi-hole network integration, let us put it all together in a practical lab where you will configure Pi-hole for your local network and eliminate the need for hosts file management.

Last modified: Thursday, 6 November 2025, 9:03 AM