Installed WireGuard by PiVPN now PiHole DNS not responding. How to troubleshoot?

Question

Recent fresh Raspbian installation August 2021. RP4, wired ethernet connection.

pi@raspberrypi:~ $ cat /etc/debian_version 10.10

Summary of Steps:

Installed PiHole: curl -sSL https://install.pi-hole.net | bash #successful >1 week
Installed netatalk for AFP sharing #successful > 1 week
Installed Docker: curl -fsSL https://get.docker.com -o get-docker.sh && sudo sh get-docker.sh
Started Docker containers for InfluxDB and Telegraph. #successful 3 days
Installed WireGuard: curl -L https://install.pivpn.io | bash
- already had static IP address 10.0.1.143 set for Pi with router and pihole
- PiVPN installer script detected running PiHole and said it would set vpn dns appropriately.
- VPN clients seem to be able to connect OK and access home local network items
After rebooting Pi, PiHole DNS service on eth0 (10.0.1.143) port 53 no longer responds:
- pihole DNS on port 53 : no response <-- does respond on 127.0.0.1
- pihole web interface on port 80: still works
- Docker container HTTP on port 8086: still works

pi@raspberrypi:~ $ netstat -lnt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:53              0.0.0.0:*               LISTEN     
tcp        0      0 10.0.1.143:8086         0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:631             0.0.0.0:*               LISTEN     
tcp        0      0 127.0.0.1:5053          0.0.0.0:*               LISTEN     
tcp        0      0 127.0.0.1:43331         0.0.0.0:*               LISTEN     
tcp        0      0 127.0.0.1:4711          0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:5900            0.0.0.0:*               LISTEN     
tcp6       0      0 :::80                   :::*                    LISTEN     
tcp6       0      0 :::53                   :::*                    LISTEN     
tcp6       0      0 :::22                   :::*                    LISTEN     
tcp6       0      0 :::631                  :::*                    LISTEN     
tcp6       0      0 ::1:4700                :::*                    LISTEN     
tcp6       0      0 :::548                  :::*                    LISTEN     
tcp6       0      0 ::1:4711                :::*                    LISTEN     
tcp6       0      0 :::5900                 :::*                    LISTEN

pi@raspberrypi:~ $ sudo iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy DROP)
target     prot opt source               destination         
DOCKER-USER  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             10.6.0.0/24          ctstate RELATED,ESTABLISHED /* wireguard-forward-rule */
ACCEPT     all  --  10.6.0.0/24          anywhere             /* wireguard-forward-rule */

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain DOCKER (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             172.17.0.3           tcp dpt:8086

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination         
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
RETURN     all  --  anywhere             anywhere            

Chain DOCKER-USER (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain DOCKER-ISOLATION-STAGE-2 (1 references)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere            
RETURN     all  --  anywhere             anywhere

Example of DNS service not responding on eth0 anymore:

pi@raspberrypi:~ $ dig @127.0.0.1 google.com AAAA

; <<>> DiG 9.11.5-P4-5.1+deb10u5-Debian <<>> @127.0.0.1 google.com AAAA
; (1 server found)
;; global options: +cmd
;; Got answer:
... (truncated for brevity)
;; Query time: 30 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Sep 09 07:53:29 PDT 2021
;; MSG SIZE  rcvd: 77

pi@raspberrypi:~ $ dig @10.0.1.143 google.com AAAA
^C  (waited 10 seconds)

pi@raspberrypi:~ $ ifconfig
docker0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.17.0.1  netmask 255.255.0.0  broadcast 172.17.255.255
        inet6 ...
        ether 02:42:ec:cd:f4:5d  txqueuelen 0  (Ethernet)
        RX packets 109411  bytes 47700790 (45.4 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 106083  bytes 43307194 (41.3 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.0.1.143  netmask 255.255.255.0  broadcast 10.0.1.255
        inet6 ...
        inet6 ...
        ether XXXXX  txqueuelen 1000  (Ethernet)
        RX packets 234710  bytes 35726922 (34.0 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 24875  bytes 12928460 (12.3 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 12109  bytes 798069 (779.3 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 12109  bytes 798069 (779.3 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

veth47d8a67: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 169.254.153.183  netmask 255.255.0.0  broadcast 169.254.255.255
        inet6 
        inet6 
        ether 62:1d:69:82:0c:bf  txqueuelen 0  (Ethernet)
        RX packets 46786  bytes 34596785 (32.9 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 76637  bytes 41291238 (39.3 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

vethe9727d4: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 169.254.136.206  netmask 255.255.0.0  broadcast 169.254.255.255
        inet6 
        ether 42:f8:57:3a:47:62  txqueuelen 0  (Ethernet)
        RX packets 62625  bytes 14635759 (13.9 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 30937  bytes 2478546 (2.3 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wg0: flags=209<UP,POINTOPOINT,RUNNING,NOARP>  mtu 1420
        inet 10.6.0.1  netmask 255.255.255.0  destination 10.6.0.1
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 1000  (UNSPEC)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.0.1.144  netmask 255.255.255.0  broadcast 10.0.1.255
        inet6 ...
        inet6 ...
        ether XXXX  txqueuelen 1000  (Ethernet)
        RX packets 167539  bytes 24474499 (23.3 MiB)
        RX errors 0  dropped 1  overruns 0  frame 0
        TX packets 1872  bytes 266223 (259.9 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

I find that I can restore DNS response by pi@raspberrypi:~ $ pihole restartdns pi@raspberrypi:~ $ dig @10.0.1.143 google.com AAAA <CLIPPED> ;; SERVER: 10.0.1.143#53(10.0.1.143) — NoahR, Sep 9, 2021 at 15:09
But the output of sudo iptables --list and netstat -lnt is identical to before the pihole restartdns. — NoahR, Sep 9, 2021 at 15:12

Stack Exchange Network

Installed WireGuard by PiVPN now PiHole DNS not responding. How to troubleshoot?

0

Your Answer

Browse other questions tagged
vpn
iptables
or ask your own question.

Hot Network Questions

Installed WireGuard by PiVPN now PiHole DNS not responding. How to troubleshoot?

0

Know someone who can answer? Share a link to this question via email, Twitter, or Facebook.

Your Answer

Sign up or log in

Post as a guest

Browse other questions tagged vpniptables or ask your own question.

Related

Hot Network Questions

Browse other questions tagged
vpn
iptables
or ask your own question.