How to get Pi-Hole to work with IPv6?

Question

At home I have installed Pi-Hole on a Fedora 28 machine, and it is now working properly serving IPv4 addresses via DHCP, acting as the DNS server, and blocking IPv4 addresses as appropriate. However, it seems to be failing to block IPv6 addresses. In the log I see (for example):

2018-06-12 00:11:15 IPv4    v10.events.data.microsoft.com   192.168.1.79    Pi-holed    -    Whitelist
2018-06-12 00:11:15 IPv6    v10.events.data.microsoft.com   192.168.1.79    OK (forwarded)  -    Blacklist

...There are a good many other such combinations: IPv4 Pi-holed, IPv6 forwarded at the same timestamp to the same FQDN.

I know very little about IPv6 at this moment. These are a few of the gaps in my knowledge that I think are contributing to my issue:

• How do I handle distributing IPv6 addresses in my home LAN? On Pi-Hole's DHCP page, there's a setting to "Enable IPv6 Support", which I've done. Does this mean my Pi-Hole will now serve up IPv6 addresses?
• On my router, I have various IPv6 settings: IPv6 (I turned it on), DHCPv6 (also on, but makes no difference if it's off it seems), DHCPv6 Prefix Delegation (on, and unmodifyable when DHCPv6 is off). This may be colliding with PiHole, but,
• I don't know if I can shut off IPv6 or even DHCPv6 on my router, because from what I've read, the concept of having NAT'ed IPv6 addresses inside the LAN is passe'. All devices get a routable IPv6 address these days because of the large address space.
• I cannot modify the Upstream DNS servers on my PiHole settings page to include, for example, Google's IPv6 servers. I don't know why.

IPv6 testing sites show that I can reach them via IPv6.

Ultimately, I'm concerned about two things: I can't change the IPv6 DNS settings, and the logs show that IPv6 entries are forwarded.

Answer 1

I got it working. Here's what I did:

• When I initially set up my Pi-Hole, I only had IPv4 on my system. Thus Pi-Hole only downloaded IPv4-capable blacklists.
• So I turned IPv6 on on my home router, and enabled DHCPv6.
• I turned IPv6 on on my Pi-Hole computer, and rebooted. ip -o addr then showed that I had an IPv6 address. Actually, it has a couple of addresses which I don't understand yet.
• It still didn't block IPv6 domain names.
• I went into my computer (command line), and edited /etc/pihole/setupVars.conf. There I inserted my IPv6 address at IPV6_ADDRESS=2600:1700:(etc)
• I also edited /etc/pihole/pihole-FTL.conf, and added AAAA_QUERY_ANALYSIS=yes.
• I restarted pihole-FTL with: systemctl restart pihole-FTL
• I went to the Pi-Hole web gui, and turned on DHCPv6 (SLAAC + RA). I turned on the Google IPv6 DNS checkboxes.
• I rebooted my system.
• I downloaded the blacklists again. This time it included IPv6 entries.
• I enjoyed the Internet again. I'm not against ads. I buy stuff that I've seen in ads. I do, however, object to being chased all over the Internet. I do not concur. And I do object to having my precious bandwidth consumed. It's too much, you advertisers. You've gone over the line and I'll be happy to do what I can in my power to ensure I take back a bit of my online experience.

Answer 2

What most people seem to miss is your IPv6 address is very likely to change if the prefix is issued by your ISP. But it turns out that doesn't matter in the least. So long as Pihole is not configured to issue IPv6 addresses, the only thing the IPv6 address is used for is to verify you have IPv6 enabled. You can actually use ANY public facing IPv6 address in the pihole configuration. Then in your router you configure the local IPv6 address. e.g. This is mine

fe80::b0fd:1813:5843:b9a23

You can configure your network settings so this won't change, ever.