New Home/New Network/New Proxmox?

Hardware Hub Build Logs
, ,
61

Wellllllll… not yet lol. I’ve been messing with the switch and I locked myself out a few times… once till I figured out I had to set the management network to my trusted network. I’ve been trying to read the manual but it’s a little above my head. I know I have registered and created VLAN 10, 20, 30… My difficulty lies in setting up the ports.

I’ve been using opnsenes ports directly to the networks that would use each VLAN that’s on separate subnets. I imaging I have to set up the VLANs on OPNsense, then set up diffrent ports in “trunk” and “access” and decide which ports in access mode should transfer what VLAN I want for that port.

I known its not difficult, I am missing some small piece I’m sure to make it work right. I’ll get there. I am also using the gli, I may switch to cli because I have read alot on that front that seems straight forward.

I imagine I’ll also need to convert my firewall rules as well once I implement VLANs.

I was also thinking. I know I set OPNsense to use pihole… I wonder if the issue of the rule with IN to !this firewall for port 53 didn’t work because OPNsense wasn’t using unbound or any other forwarder like…ug I forget the name. I’ll have to look.

Once I have the power situation handled for the office (which I finally got the green light for to get estimates) I can dig more into things. I’ll finally be able to run a second server…and I’ll actually need to set up VLANs to get everything where I want.

I have managed to finally get my rules down so they make sense. I started with giving access to just IPs to see if the rules worked, then I found out what ports were needed and implemented those in my rules. IE such as passing plex to IoT net for tvs and firesticks etc. I couldn’t have been able to do that without your help. I did fine a few more rules I’d like to run by you to see if they are useful. I have them working, but there was a few that are supposed to help block some devices from phoning home on a hard-coded dns.

I had no idea how much my Samsung tvs tried to phone home. It was actually rate limited by OPNsense and caused a warning. There was over 1000 queries in a few seconds. Yikes. It actually broke my tvs connectivity and one point and I had to white list a site to get my streaming service to work again.

Now that I have working images of both opnsense and pihole I have made backups so if I really mess up I can just revert to the backups. (I may have missed this step before my troubles yesterday) I knew better but one command led to another and boom…breakage happened lol

2 Likes
62

Yes, that’s how I usually set it up too, so that each vlan / subnet has 1 Gbps interface and not aggregate all of them on a single 1 Gbps interface.

What you need to change is the Proxmox part, you don’t even need to mess with the switch. Ah, I’m too scared to mess with my last host, as it’s not near me to debug it locally. I’m so mad right now that I can’t test and break stuff when I need to. I probably should build that TR build soon…

2 Likes
63

Hey no worries, I’m enjoying learning myself. I have a few Cisco specific books I am referencing. I just haven’t had time to dive deep without wife or regular interruptions lol.

I’ll figure it out I’m sure. Like I always so there’s no rush. Things are working and I’m learning.

I’m sure you’ll love it once ya do. I haven’t been able to power up the dell T420 I have in over 8 months :(. Know you’ve had more pressing trubles anyways. Hope thats all sorted out for the most part.

2 Likes
64

Well after reassessing my network, and OPNsense rules (which I had a lot of individual ones to pass my pihole directly to each network) I realized I may have been doing too much work.

In theory I should be able to use dnsmasq via my OPNsense firewall to have it pass dns requests to my pi hole via the main access port (ie 192.168.10.1) or what ever one on each of my 3 vlans or subnets.

I attempted to do this and modified my firewall rules accordingly adding a block !firewall(except this firewall) port 53 but it hasent been working.

I’ll toy with it more tomorrow, maybe hop on discord to see what I may be doing wrong.

I reset the wired connection on the client and the dns was changed. I just couldn’t connect to any websites and got a dns error.

2 Likes
65

Well I attempted to troubleshoot this for about 6 hours today. I must have something switched around or turned on or off.

The error I got had to do with a dnsmasq log that said it was not answering 127.0.0.1 for DNS request or something the like. I tried everything I could and was sure to reset my local machines connection to update DNS IP it used.

One weird thing I noticed was it took a minute or 5 after I turned off dnsmasq with my working rules before I had a connection I could do a fresh search (needed so I didnt get a cached page).

I think my next attempt because I messed around so much with OPNsense (flipping this and that setting/ and diddnt document HUGE SHAME ON ME) trying to get it to work correctly with pihole/unbound (Thanks again @ThatGuyB and @PhaseLockedLoop) will be a reset or clean install of OPNsense and or Pihole.

2 Likes
66

Just make sure you have a working backup before you start fresh, just in case you need to check some of the old settings for reference. It’s ok if you virtualize the OS image.

As for dnsmasq, if it makes it easier for you, then you may enable dnsmasq and allow connections from each vlan on the router on port 53. Then make sure that your DNS settings for your firewall are set to point to Pi-Hole’s IP first, not 127.0.0.1. And remember to allow Pi-Hole to go anywhere on the internet first, before you block all traffic anywhere to not firewall on port 53.

1 Like
67

I’m going to try this first… I do NOT think I had this rule in place…OOOOOPPPPSSS…lol I’ll update it and see what I can figure out because that makes complete sense.

I guess the reason I want to simplify the rules is if I get this working with dnsmasq all I have to do is change the DNS on OPNsense to restore internet resolution of pages if pihole dies (probably wont, but planning for the worst). I had set DNS manually in SO many places on different machines when I broke pi hole it took a LONG time to tune firewall, clients, and networks to use a working DNS to fix pihole (IE . Mostly because I didnt have good documentation again.

@ThatGuyB you were right hangs head that was one of the first things to do and I missed it… working flawlessly now and If I ever need to change my DNS I only need to do it in one place…arghhhh
Thanks again so much. Working great!!!

I did however have to add a few rules after doing some reading about Alexa/Amazon Video, Plex, and Samsung not working.

I had to make a few NAT rules…
For Outbound Rules I had to use
Pass Interface Source-Source Port-Destination-Destination Port-NAT Address-NAT Port-Static Port---

VLAN10HSTnet VLAN10HSTnet net * This Firewall 53 Interface address * NO
Had to add that for each interface…
Then the one I had to add to get alexa/amazon to work was a “floating rule”
Its a Pass IN

**Protocol** **Source** **Port** **Destination** **Port** **Gateway** **Schedule**
IPv4 TCP/UDP	*	*	Internal_DNS_PiHole 	53 (DNS)	*	*

I don’t know why but these seem to work properly. I also had to edit manually the dnsmasq settings to add in the MAC addresses so I can at leat somewhat see whats where in Pihole and apply certain client filters (IE wifes PC, Phone, laptop etc) to bypass the filter.

For some reason Samsung wont play nice, but I think that may be a Pihole filter. I know one of the TV’s has tried to reach a address more than 1000 times in a second… it really want to phone home. I’ll review the logs and see if I can tune it. I may have to turn it off just for it to set up the wifi connection then I can turn the filter back on. Worked before so dont know why it wouldnt now. ACTUALLY… the services (IE Netflix, prime video, plex) all work fine it just says its not connected to the internet…lol

The problem I guess is that some of these devices have hardcoded DNS’s they use…and when they dont get what they want they act up… Thats the theory I read anyways.

2 Likes
68

Of note is that you can set Pi-Hole as your main DNS in your DHCP, and OPNsense as your secondary and keep both allow rules in place. In case Pi-Hole dies, the secondary DNS (dnsmasq) can redirect traffic on the internet. But do keep in mind that it takes about 2-5 seconds for the DNS query towards DNS number 1 to time-out and query the second DNS, so the internet will feel slow, even if speed tests will say everything is alright.

But that would be the case if dnsmasq uses pi-hole as first DNS and another one as second (as in, pi = dns1, dnsmasq = dns2 1.1.1.1, or worse, pi=dns1, dnsmasq = dns2 also pi, then 1.1.1.1 - lastly, you can have dnsmasq = dns1 pi, 1.1.1.1). Hope I explained it well enough.

2 Likes
69

You did, It was my fault I had such an issue to begin with… I overlooked a VITAL step in making it work lol.

1 Like
70

I did what? lol
I explained well. Took me a sec to realize.

1 Like
71

Yeah sorry was in the middle of rewriting above about some diffrent rules I needed to get my IOT devices to work properly…

SO MANY EDITS…lol

1 Like
72

OK so now I’m wondering how I can amend this to pass on my “Client Names” in my DNSmasq config file as described below. I need that format to put client names as “add-mac” as seen below…

"Configuring OPNsense dnsmasq
The first step in the process is to set up dnsmasq on the OPNsense host to send the extra information for Pi-hole to utilize. This involves access to the hosts command line. I use SSH with key based authentication. Setting up SSH access is beyond the scope of this guide but there are a number of guides that can help you with this process.

Once you have access you will need to add an advanced settings file. Dnsmasq DNS — OPNsense documentation I have chosen to use edns0.conf as the filename in the /usr/local/etc/dnsmasq.conf.d directory. We will tell dnsmasq to send the MAC address along with the full IP address of the client:

add-mac
add-subnet=32,128

/usr/local/etc/dnsmasq.conf.d/edns0.conf"

Or do I need to add hostnames manually via the /etc/hosts file

73

What are you trying to achieve? You shouldn’t need to access the opnsense cli, all settings you actually need are present in the GUI.

1 Like
74

I dont have a option to pass on MAC’s and host names on the DNSmasq settings page…Unless Im missing something…I probably am… If I can use that config (stated above) to add MAC’s and send them to Pihole for identification of clients, shouldn’t I be able to pass on hostnames with that same edit to the DNSmasq config I added via CLI?

Screenshot (32)
Screenshot (32)1454×1164 55.5 KB

75

What are you even doing with MAC addresses? You want Pi-Hole to be your DHCP server or something?

1 Like
76

No just so they populate on the pihole gui…lol

Screenshot (33)
Screenshot (33)1530×1203 224 KB

77

Why you want that for? You got all the MAC addresses in your OPNsense dhcp server already, with the same IP addresses and hostnames… Do you want to add the IP addresses in your local Pi-Hole’s DNS resolution table, so you can query pi-hole about who a host is?

At this point, all I get is what you want to do, but I don’t understand the goal / why you want to do this.

1 Like
78

It just makes it so I don’t need to open both tabs to reference who is what IP (LAZY lol)…lol Its really not needed. I don’t even need MAC addresses because they have static IP’s via OPNsense DHCP… I need to remove Pihole filters from wifes devices because she freaks out when she cant just click on anything and go there. It’s just really superfluous.

I’m out of likes…lol

79

Why are you even using DNS if you aren’t mapping your IP addresses to local resolvable names…

1 Like
80

I do in OPNsense with static mappings, which then passes DNS requests vis dnsmasq to Pi-hole…am I really messing something up? lol