5

I have a setup specifying two DNS namservers. One in local, the other is external. The local one is a pihole, which itself forwards requests externally after url filtering. The external one is set in case the pihole device software or hardware fails.

The pihole response time is about 20 ms, the external response time is about 2 ms. Although the pihole is listed as a nameserver before the external, dnsmasq will by default test timing responses and use whichever is faster.

dnsmasq does however offer a parameter strict-order which should use the nameservers in the strict order they are listed, and so in this case should only use the external nameserver if the pihole "fails".

In practice using the parameter strict-order doesn't work as hoped, and the external nameserver still wins. The dnsmasq manual page doesn't go into detail about the definition of "failed".

I am looking for other parameter setting which might solve this problem.

As a last resort I would use an external program to detect pihole working order, and manipulate the dnsmasq nameserver settings accordingly. But that is not a preferred solution.

9
  • Alternate DNS servers with different views of the world where never a kosher solution, and if I am not wrong, the situation is the same with dnsmask. You should use the pihole for solving all the DNS requests. Feb 15, 2019 at 16:28
  • The secondary is for backup if the pihole really fails. For example, a software bug crashes the software (entirely possible), or if the hardware fails (less likely). Feb 15, 2019 at 20:31
  • The secondary is for backup if the pihole really fails. For example, a software bug crashes the software (entirely possible), or if the hardware fails (less likely). *** A backup is necessary for others who need immediate continued internet access in case of pihole software or hardware failure *** If you consider the problem closely, it is actually asking to divide the duty of the two servers cleanly, exactly so that "dueling servers" does not happen. Feb 15, 2019 at 20:37
  • And that is what I am saying all along. You are having problems because that is a bad idea from the implementation point of view. What you are asking from the implementation point of view is not advisable to do. Feb 15, 2019 at 21:00
  • @RuiFRibeiro - The Pihole needs to be used, but if the Pihole fails the system must continue to work seamlessly. There are other people needing to use that system who can't immediately fix it if it is broken if I am not there. Start from the requirements and figure out the implementation to achieve that. Don't you agree? Feb 16, 2019 at 7:06

2 Answers 2

6

I too wanted to accomplish this. I have a router running dnsmasq and a PiHole. Raspberry Pi SD cards are prone to failure, so when DNS goes down, the internet is effectively down for everyone in my house who is not a sysadmin. I'm afraid the comments worried about a mission-critical situation are missing the forest for the trees.

I found that the strict-order setting does work, but the docs are vague on the fact that they need to be specified in reverse order in your configuration. Counter-intuitive, and I wish the docs would spell this out.

no-resolv
strict-order # NOTE: List servers in reverse order below (bottom is highest priority)
server=45.90.30.131 # NextDNS 2
server=45.90.28.131 # NextDNS 1
server=192.168.1.2 # PiHole

I tested this at home, and 192.168.1.2 is receiving all my DNS requests. I stopped the PiHole server to verify that requests would be forwarded to the other servers I specify. While it does work, they are very slow to resolve because the router is trying the servers in order with every request. I tried to figure out how to reduce dnsmasq's timeout, but apparently that doesn't exist as a setting. dnsmasq's creator Simon Kelley says:

The upstream timeout for dnsmasq is always identical to the client's timeout, so the only way to do this is to reduce the timeouts at the client end.

However, if you can arrange that packets sent to 10.2.1.2 return a "No route to host" error when it's not up, things will fail much quicker. That may be possible by arp table or routing table manipulation, I've not looked at the details.

I tried shutting down the PiHole instead of just stopping the DNS server to see if the requests will fail more quickly, but didn't see any change. I assume there's no automated way to handle this, but it would be great if someone could chime in on some router config that would speed this up.

1
  • Very helpful information! It does seem like a difficult problem. If dnsmasq would allow a plugin for that problem it would be helpful. Mar 29, 2022 at 22:19
1

From the code, dnsmasq will try all request with one server until query timeout, and use second server as fallback. There's an upper bound of how long one server could be used. defined in config.h.

#define FORWARD_TEST 1000 /* try all servers every 1000 queries */
#define FORWARD_TIME 600 /* or 10 minutes */

taken from Pihole-FTL Github repo (a fork of dnsmasq with AD blocking).

search for OPT_ORDER in the repo for implementation detail.

1
  • I'm not actually talking about the dnsmasq in Pihole, but rather the one on my box, which points first to Pihole, then to a secondary DNS server. If the Pihole fails, then I won't be using the Pihole dnsmasq. But thanks for trying. Jan 25, 2021 at 6:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .