Pi-Hole + AdGuard + Wireguard + macvlan/ipvlan - help! reddit / selfhosted ---------------------------------------------------------------------- SEND_NUKES_PLS · 2023-10-11 05:41 So I've been scratching my head over this for a couple of hours now... Basically I have a pivpn wireguard server installed on my VPS, it's not containerized, just a direct install. I have AdGuardHome running in docker and wireguard clients are able to talk to it. I now want to also run PiHole on the same VPS and have it as a secondary DNS server. Obviously this wouldn't work using the the regular bridge driver due to port conflict and the fact that internet devices expect port 53 to be used for DNS stuff...so I need either macvlan or ipvlan to assign separate IPs to ADH and Pi-Hole. ​ Here's the issue I'm facing: I created a macvlan, but I'm unable to talk to any containers inside of it from the host itself and any wireguard clients. Now as far as I understand this is due to some kind of a kernel security measure that doesn't allow the host to communicate with the said macvlan network and what not. ​ So my question is - what would be the best way to go around this? should I be using macvlan? or should I use ipvlan? should I shove my wireguard server into a container and add it to the macvlan/ipvlan network? do I create a bridge interface between macvlan and host (or something like that?) ​ Here are the subnets I'm working with: VPS - [10.0.0.0/24](https://10.0.0.0/24) Wireguard Server - [5.0.0.0/24](https://5.0.0.0/24) macvlan - [10.0.15.0/24](https://10.0.15.0/24) ​ I'm a complete noob! help! ​ ​ ---------------------------------------------------------------------- VsevolodLNM · 2023-10-11 06:00 Had the same problem with cfa tunnels, and had a problem with cloudflared in docker, so basically what i did is installed Proxmox, and installed all my dockers in an lxc, and cloudflared in the Proxmox itself, so the raw debian(not in a vm) ---------------------------------------------------------------------- VsevolodLNM · 2023-10-11 06:02 After that i ditched tunnels all together, and embraced nginx proxy manager, and port forwarded that, and faced no issues after that(that is if you’re not behind a cgnet ---------------------------------------------------------------------- VsevolodLNM · 2023-10-11 06:05 If you are complete noob i would not recommend that, i had a temporary solution by linking the two nets together. But macvlan restricts it on purpose for security. ---------------------------------------------------------------------- VsevolodLNM · 2023-10-11 06:11 Here is how to link them, [https://www.reddit.com/r/selfhosted/comment s/rzbz6h/docker_macvlan_the_correct_way/?rdt=48351](https://www.reddit .com/r/selfhosted/comments/rzbz6h/docker_macvlan_the_correct_way/?rdt= 48351), [https://cdn.discordapp.com/attachments/1122886725484679168/11 22926532663459860/2023-06- 26_19.29.02.png?ex=65369f54&is=65242a54&hm=53cf59847276b7d3543fb6993c0 6bd0de010d0d30e47d763ad8e85df1d2c5c8f&](https://cdn.discordapp.com/att achments/1122886725484679168/1122926532663459860/2023-06- 26_19.29.02.png?ex=65369f54&is=65242a54&hm=53cf59847276b7d3543fb6993c0 6bd0de010d0d30e47d763ad8e85df1d2c5c8f&), [https://gist.github.com/iron icbadger/230f66ee7092d9259f695580351ce5d3](https://gist.github.com/iro nicbadger/230f66ee7092d9259f695580351ce5d3), ---------------------------------------------------------------------- VsevolodLNM · 2023-10-11 06:13 The second one will need it to be run every time you reboot, but you can put parts of it in your .bashrc or .zshrc ---------------------------------------------------------------------- thekrautboy · 2023-10-11 06:28 Whats the point of running Pihole **and** Adguard? ---------------------------------------------------------------------- SEND_NUKES_PLS · 2023-10-11 06:33 AdGuard is my goto, but I want to try out the new PiHole v6 without having to shutdown AdGuard. ---------------------------------------------------------------------- SEND_NUKES_PLS · 2023-10-11 06:34 I'll try this out, thanks! ---------------------------------------------------------------------- SEND_NUKES_PLS · 2023-10-11 06:35 I've been thinking about ditching CF and going the Traefik or NPM way... it's definitely on my to-do list. ---------------------------------------------------------------------- VsevolodLNM · 2023-10-11 06:41 It functions the same way as cfa tunnels(once u set it up), but no restrictions and tcp/udp ---------------------------------------------------------------------- ElevenNotes · 2023-10-11 07:40 5.0.0.0/24 is not a private subnet. Use 10.5.0.0/24 instead. ---------------------------------------------------------------------- SEND_NUKES_PLS · 2023-10-11 08:13 Noted and changed! Never had any issues with [5.0.0.0/24](https://5.0.0.0/24) but I assume it's bad practice? ​ Anyways, thanks for the info! ---------------------------------------------------------------------- ElevenNotes · 2023-10-11 08:35 Yes, you basically “lost” the entire 5.0.0.0/24 subnet (which is used by Syrian Telecom). Only use [RF1918](https://datatracker.ietf.org/doc/html/rfc1918) subnets for home use. ---------------------------------------------------------------------- SEND_NUKES_PLS · 2023-10-11 08:50 Got it! Thanks! ---------------------------------------------------------------------- j0hnp0s · 2023-10-11 10:42 I use macvlan for my pihole, and 1.1.1.1 as its upstream. My dhcp sets every machine to use it for dns. I also set my router to use pihole as its dns. The host machine as you said cannot connect to the container, so I manually configured my router as its dns. So for all my network the dns goes Pc-pihole-cloudflare And for my host it goes Pc-router-pihole-cloudflare ---------------------------------------------------------------------- RuaidhriM · 2023-10-11 13:33 Might I recommend https://github.com/IAmStoxe/wirehole - dockerized PiHole, Unbound and WireGuard. If you are not wanting to run PiHole and AdGuard in series, then it’s pretty easy to swap PiHole and AdGuard containers.