mirror of
https://github.com/pi-hole/docs.git
synced 2024-12-06 19:27:12 +01:00
Merge branch 'master' into tweak/wireguard-nftables
This commit is contained in:
DL6ER
@@ -133,7 +133,7 @@ Warnings commonly seen in `dnsmasq`'s log file (`/var/log/pihole/pihole.log`) an
|
||||
edns-packet-max=1232
|
||||
```
|
||||
|
||||
After running `pihole restartdns` your Pi-hole will not even try larger packet sizes (the default is 4096). Check out our [unbound guide](../guides/dns/unbound.md) for a comment about the particular value of `1232`.
|
||||
After running `pihole restartdns` your Pi-hole will not even try larger packet sizes (the default is 4096). Check out our [unbound guide](../guides/dns/unbound.md) for a comment about the particular value of `1232` or reference [this comment](https://discourse.pi-hole.net/t/dnsmasq-warn-reducing-dns-packet-size/51803/31) regarding the various allowed packet sizes for the various upstream DNS servers.
|
||||
|
||||
!!! warning "Ignoring query from non-local network"
|
||||
|
||||
|
||||
+16
-2
@@ -44,13 +44,27 @@ They'll automatically be re-added when using `sudo service pihole-FTL start` nex
|
||||
We suggest the following one-liner to run `pihole-FTL` in `memcheck`:
|
||||
|
||||
```
|
||||
sudo rm /dev/shm/FTL-*; sudo valgrind --trace-children=yes --leak-check=full --track-origins=yes -s /usr/bin/pihole-FTL &> valgrind.log
|
||||
sudo service pihole-FTL stop && sudo setcap -r /usr/bin/pihole-FTL
|
||||
sudo valgrind --trace-children=yes --leak-check=full --track-origins=yes --log-file=valgrind.log -s /usr/bin/pihole-FTL
|
||||
```
|
||||
|
||||
If you compile FTL from source, use
|
||||
|
||||
```
|
||||
sudo rm /dev/shm/FTL-*; ./build.sh && sudo valgrind --trace-children=yes --leak-check=full --track-origins=yes -s ./pihole-FTL &> valgrind.log
|
||||
sudo service pihole-FTL stop && sudo setcap -r /usr/bin/pihole-FTL
|
||||
./build.sh && sudo valgrind --trace-children=yes --leak-check=full --track-origins=yes --log-file=valgrind.log -s ./pihole-FTL
|
||||
```
|
||||
|
||||
The most useful information (about which memory is *possibly* and which is *definitely* lost) is written to `valgrind.log` at the end of the analysis. Terminate FTL by running:
|
||||
|
||||
```bash
|
||||
sudo kill -TERM $(cat /var/run/pihole-FTL.pid)
|
||||
```
|
||||
|
||||
and immediately restart it (and fix permissions) using
|
||||
|
||||
```bash
|
||||
sudo service pihole-FTL start
|
||||
```
|
||||
|
||||
The used options are:
|
||||
|
||||
@@ -183,13 +183,21 @@ Finally, configure Pi-hole to use your recursive DNS server by specifying `127.0
|
||||
|
||||
(don't forget to hit Return or click on `Save`)
|
||||
|
||||
### Disable `resolvconf` for `unbound` (optional)
|
||||
### Disable `resolvconf.conf` entry for `unbound` (Required for Debian Bullsye+ releases)
|
||||
|
||||
The `unbound` package can come with a systemd service called `unbound-resolvconf.service` and default enabled.
|
||||
It instructs `resolvconf` to write `unbound`'s own DNS service at `nameserver 127.0.0.1` , but without the 5335 port, into the file `/etc/resolv.conf`.
|
||||
That `/etc/resolv.conf` file is used by local services/processes to determine DNS servers configured.
|
||||
If you configured `/etc/dhcpcd.conf` with a `static domain_name_servers=` line, these DNS server(s) will be ignored/overruled by this service.
|
||||
Recent Debian-based OS releases auto-install a package called [`openresolv`](https://wiki.archlinux.org/title/Openresolv), which will cause unexpected behaviour for pihole and unbound. Openresolv's service/config instructs `resolvconf` to write `unbound`'s own DNS service at `nameserver 127.0.0.1` , but without the 5335 port, into the file `/etc/resolv.conf`. That `/etc/resolv.conf` file is used by local services/processes to determine DNS servers configured. You need to remove openresolv, or edit the configuration file and disable the service to work-around the misconfiguration.
|
||||
|
||||
#### Option 1 - Remove openresolv
|
||||
|
||||
If you are sure you don't need the features of openresolv, then removal of the package is the simplest option.
|
||||
|
||||
```bash
|
||||
sudo apt purge openresolv
|
||||
```
|
||||
|
||||
#### Option 2 - Step 1 - Disable the Service
|
||||
|
||||
openresolv has a systemd service called `unbound-resolvconf.service.`
|
||||
To check if this service is enabled for your distribution, run below one and take note of the `Active` line.
|
||||
It will show either `active` or `inactive` or it might not even be installed resulting in a `could not be found` message:
|
||||
|
||||
@@ -197,16 +205,26 @@ It will show either `active` or `inactive` or it might not even be installed res
|
||||
sudo systemctl status unbound-resolvconf.service
|
||||
```
|
||||
|
||||
To disable the service if so desire, run below two:
|
||||
To disable the service if so desire, run the two statements below:
|
||||
|
||||
```bash
|
||||
sudo systemctl disable unbound-resolvconf.service
|
||||
sudo systemctl stop unbound-resolvconf.service
|
||||
|
||||
```
|
||||
|
||||
|
||||
#### Option 2 - Step 2 - Disable the file resolvconf_resolvers.conf
|
||||
|
||||
Disable the file resolvconf_resolvers.conf from being generated when resolvconf is invoked elsewhere.
|
||||
|
||||
```bash
|
||||
sudo systemctl stop unbound-resolvconf.service
|
||||
sudo sed -Ei 's/^unbound_conf=/#unbound_conf=/' /etc/resolvconf.conf
|
||||
sudo rm /etc/unbound/unbound.conf.d/resolvconf_resolvers.conf
|
||||
```
|
||||
|
||||
### Alternative Solution - Step 1
|
||||
|
||||
To have the `domain_name_servers=` in the file `/etc/dhcpcd.conf` activated/propagate, run below one:
|
||||
|
||||
```bash
|
||||
@@ -253,12 +271,28 @@ sudo touch /var/log/unbound/unbound.log
|
||||
sudo chown unbound /var/log/unbound/unbound.log
|
||||
```
|
||||
|
||||
Third, restart unbound:
|
||||
On modern Debian/Ubuntu-based Linux systems, you'll also have to add an AppArmor exception for this new file so `unbound` can write into it.
|
||||
|
||||
Create (or edit if existing) the file `/etc/apparmor.d/local/usr.sbin.unbound` and append
|
||||
|
||||
``` plain
|
||||
/var/log/unbound/unbound.log rw,
|
||||
```
|
||||
|
||||
to the end (make sure this value is the same as above). Then reload AppArmor using
|
||||
|
||||
``` bash
|
||||
sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.unbound
|
||||
sudo service unbound restart
|
||||
```
|
||||
|
||||
Lastly, restart unbound:
|
||||
|
||||
```
|
||||
sudo service unbound restart
|
||||
```
|
||||
|
||||
|
||||
### Uninstall `unbound`
|
||||
|
||||
To remove `unbound` from your system run
|
||||
|
||||
@@ -21,3 +21,4 @@ last_updated: Sun Sep 06 14:28:14 2020 UTC
|
||||
- [Pi-hole Visualizer](https://www.reddit.com/r/pihole/comments/82ikgb/pihole_visualizer_update/)
|
||||
- [Enable/Disable Pi-Hole from your iPhone Home Screen](https://codeopolis.com/posts/how-to-control-pi-hole-from-your-iphone/)
|
||||
- [Pi-hole Shortcuts: Native macOS client](https://github.com/dotWee/macOS-PiholeShortcuts)
|
||||
- [Discord Pi-hole Bot: Bot for easy Pi-hole server management and stats through discord](https://github.com/josephistired/Discord-Pi-hole-Bot)
|
||||
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
mkdocs==1.4.2
|
||||
mkdocs-git-revision-date-localized-plugin==1.1.0
|
||||
mkdocs-material==9.0.6
|
||||
mkdocs-material==9.0.11
|
||||
mkdocs-redirects==1.2.0
|
||||
|
||||
Reference in New Issue
Block a user