Unbound in Docker with PiHole - Regain Your Privacy - Cybersecurity at Home

[@agroleau04]

Thanks Jim, I have been watching your content for the last couple of weeks and I just wanted to say that it is absolutely brilliant!

[@Jims-Garage]

Thanks, that's extremely kind

[@Damia-cz8og]

@@Jims-Garage please not proxmox yeah computer or rpi4 and from scratch pi-hole and total and step by step and configuration and where and where to get and Unbound

[@Net-Extension]

Very useful and in depth. Exactly what I needed. I have struggled a lot setting it up the correct way and understanding the parameters. Great tutorial

[@Jims-Garage]

Glad it was helpful!

[@peterjackson9546]

Absolutely brilliant! I've been searching for this sort of content for the best part of 5 years! Definitely going to explore more of your videos!

[@Jims-Garage]

Thanks, really appreciate the feedback 🙂

[@iiilllii140]

Thanks, Finally someone who comes up with a detailled explanation why we are doing the things we are doing. Great video.

[@Jims-Garage]

Thanks for watching!

[@thespencerowen]

Great video! I ran pinhole years ago. I’m considering spinning up adGuard. I would love to see a comparison between the two

[@Jims-Garage]

Great suggestion!

[@victordepta4069]

Great video! I'm a big fan of your work!!! Keep up the great work!!!

[@Jims-Garage]

@@victordepta4069 thanks, that's much appreciated

[@brahman88]

Thank you for the informative video. As with all your videos, you make a potentially complex topic very easy to understand and implement. I'm already utilising PiHole over a Cloudflare tunnel and I'm not too worried about the privacy concerns but the additional protection Unbound provides against DNS poisoning is interesting so I may look at switching.

[@Jims-Garage]

Thanks, I put it in the camp of nice to have but not essential.

[@markandrow4010]

Thank you James, Great video about hosting the recursive server.

[@Jims-Garage]

Thanks, appreciate the feedback.

[@xandev4s]

I've tried to use your configuration from the video, but it's not working correctly. The problem is with unbound.conf file and interface - this should be left at default 53, as you're already mapping it to 5053 from the container :)

[@davidwestra8181]

Also, you don’t need to specify load balancing for a single container in traefik labels if the server port is already configured on a standard web port. Only if it’s something else like 9000, 8080, etc.

[@KyleKrajnyak]

A how-to on deploying this in a Docker Swarm setup would be great 😄

[@-rm-rf]

Nice now I can understand what I’ve been using for a while already 😂

[@Jims-Garage]

Haha, great. Better late than never!

[@typkrft]

Love your videos, but there are number of issues with your configuration. At least as it's shown on video. 1. `PIHOLE_DNS_: 172.23.0.8#5053` You're referencing the unbound IP with the Host Port 2. Your environment and volumes sections should have it's list items indented. Additionally you are mixing data classes. Either use `- SOME_VAR=true` or `SOME_VAR: true`. It will fail due to syntax otherwise. 3. You don't need to expose unbound ports unless you are going to use elsewhere. Since pihole and unbound are on the same network they will still be able to communicate internally. 4. You don't need a hostname for pihole unless you are going to reference that somewhere else. This is a friendly message. Just a few things I noticed. Love your content. Cheers

[@JeronimoStilton14]

1. that is what you want? You set the DNS for pihole to pass through the unbound ip. He fixed 2 and 3 on his github.

[@frostiefops]

Tip for anyone using a fresh installation ubuntu server (22.04 in my case): Disable systemd-resolved before trying this, it conflicts on port 53 and causes an error when running docker-compose You can disable it by running these commands: sudo systemctl stop systemd-resolved sudo systemctl disable systemd-resolved sudo reboot

[@Jims-Garage]

Thanks for the commands.

[@user-gx3st2th8q]

What does systemd-resolved do? @frostiefops

[@frostiefops]

@@user-gx3st2th8q I believe it is an internal dns server/resolver of sorts - thinking back it might not be such a great idea to disable it but my homelab seems to be running fine without it

[@niro1960]

you are my man, thx...took me hours:(

[@romayojr]

looks like you've moved onto to using vs code, i love using it. good stuff as always.

[@Jims-Garage]

Thanks. I think it works a lot better to demonstrate.

[@Louis-bs3ji]

thanks for your help again got it to work !

[@Jims-Garage]

Awesome 😎

[@dankkster]

Great video, thank for posting!

[@Jims-Garage]

You're welcome

[@philiprichardson7447]

Hi Jim, thank you so much for this video... it was an entry into the rabbithole of pihole, unbound and docker for me. After following your guide, I decided to set up two pihole containers on the same raspberry pi 4, so that I could have a DNS for my children (i.e. more restricted internet use), and one for everyone else. I ended up with a user-defined bridge (for the communication between the pihole containers and the unbound one); and the two pihole containers also on an ipvlan. This way only pihole is exposed to the LAN and it can't be circumvented by using the Unbound port 5053. It also means that both pihole containers and the unbound container can listen on port 53 (i.e. no port mapping). I was wondering whether you'd considered this networking setup; and whether there are reasons not to use it? / The benefits of the port mappings on a bridge network that this video shows?

[@Jims-Garage]

Seems fine to me. I'll be doing something similar when my kids are old enough to access the internet.

[@franciscogomez2088]

Thanks Jim!, could set this up in a Docker Swarm with replication and a way to still see all the individual clients? That would be (I think) the ultimate setup, in case one node fails the other one would pick it up or in case of upgrading one node.

[@Jims-Garage]

Yes, that should be possible, same with kubernetes.

[@davidetabacco2162]

Hello thanks for the great videos, my compose file is failing error "network proxy declared as external, but could not be found" I'm running this on a Synology NAS any hint?

[@Jims-Garage]

@@davidetabacco2162 thanks. Change it to whatever your proxy network is called, or create a network called proxy. If you don't want a proxy remove it.

[@AsherLeong]

Im trying to make all devices on my network use pihole as my dns, so i pointed my router’s dns resolver to the ip of the lxc running pihole (im using proxmox). This works well, and pihole is blocking sites as expected, however, pihole as well as the other docker containers on the same LXC have issues with dns resolution. Is there something im missing, or would i have to manually change the dns settings on each of my devices for it to work?

[@DeepakNaidu]

A thorough and clear explanation as always. Is this something you move to kubernetes cluster or keep it portainer forever?

[@Jims-Garage]

You could host in docker, swarm or Kubernetes. It's completely up to you. I'll likely deploy in Kubernetes.

[@Glatze603]

Hi Jim, why not using unbound on OPNsense and configure DoT with Cloudflare?

[@Jims-Garage]

Using pfSense or OpnSense is a perfectly valid option, I simply didn't want to assume that everyone is using it. You can absolutely use a Cloudflare Tunnel or a VPN if you want as per example. It depends who you want to know your requests, always a trade off.

[@Glatze603]

On top I use ADHomeGuard on OPNsense.

[@Glatze603]

@@Jims-Garage I talked about DNS over TLS with Cloudflare, not CF Tunnel or a VPN.

[@Jims-Garage]

@@Glatze603 if you do it that way you're using unbound as a forwarder same as PiHole default setup. This way Cloudflare sees everything. Unbound is by design a recursive DNS firstly.

[@epochphilosophy]

Hey, I am very curious. If privacy is the goal with Unbound why not use DNS over HTTPS to encrypt your DNS? Are there specific reasons you may want to use Unbound instead?

[@Jims-Garage]

It's a balance. With DNS over HTTPS you're letting a 3rd party do the recursive part. This means they know everything. If you self host, non encrypted, it communicates with the authoritative servers directly, there's no caching and no 3rd party knows exactly what you're doing. Obviously when you visit a site your ISP knows.

[@Jims-Garage]

@@PNW-JTYep, and the same as when you then visit the site, ISP knows as it routes your traffic. It all is a trade-off, there cannot be a perfect solution.

[@andresrevilla7932]

Thanks Jim. Another supperb video. I am trying to implement in a QNAP NAS. As i have checked `prt :53 is used by service DNSMASQ.. I have disable it and use your installation .. All works, except some containers (crowdsec and others) that they haven't got dns service, so no internet inside dockers .. Anyone has tested in QNAP NAS ?

[@joydavid1759]

Thanks, Jim for sharing and am new to this space, so I have a question how can I do the same installation on CasaOS container, I have installed pi-hole, and other apps(home assistant) running on CasaOS. if you could provide guides I would greatly appreciate it.

[@Jims-Garage]

Sorry, I'm not sure. Perhaps ask in my Discord.

[@igihara2662]

Hello Jim for a beginner, on rpi 4, Rpi OS - if i want to use your setup for example i need to make 2 folders in for e.g. Documents copy files for each unbound and pihole for starting this containers, do i need any change in `volumes` section in .yml file?

[@Jims-Garage]

Amend the volumes to whatever you want, mine are simply how I have it configured. Some are mandatory though for functionality.

[@JohnWeland]

This might be my next project. I’ve tried pi hole a handful of times over the years but inevitably after a few months, my Internet slows to a crawl. I’m gonna go back and watch your pole video and see if I can glean an answer as to why that is

[@Jims-Garage]

Interesting, that's odd. Do you run out of space? I've never had that issue and have been using for about 6 years.

[@JohnWeland]

@@Jims-Garage maybe in the past it had been ran on a pi4 with a 16gb SD. I haven’t tried since I’ve been SATA booting my Pi’s

[@zigotica]

Excellent video as always, thank you so much for all your content, I am learning a lot. In my case, I use the OPNsense unbound, and have the other settings as you in PiHole, except that I also check the "Use Conditional Forwarding" and refer to the DCHP server IP, just at the end of the settings page, in order to get the hostnames instead of simple IPs in the logs. Am I doing smth wrong in terms of security? Thanks again

[@Jims-Garage]

Thanks. No, that sounds fine. Just make sure you're not forwarding the DNS queries, otherwise it defeats one of the main benefits of self hosting it.

[@zigotica]

@@Jims-GarageI'm not sure about your concern. If executing a dig or nslookup to google, both return my pihole IP

[@monish05m]

How do you use vscode on windows to create and edit docker conatiners on Linux machine ?

[@Jims-Garage]

There's an SSH plugin that allows you remote.

[@nihoniumog5185]

Hi jim. Need your help. I tried to install on my raspi pi, but so far no luck. I did update the unbound image source like yoy suggested. Can you make compose with no traefik?

[@Jims-Garage]

@@nihoniumog5185 hey, delete the network and Traefik labels, add ports section. That will do it.

[@davidwestra8181]

You don’t need to change or expose any ports for unbound. Because the end user does not access unbound directly and you are routing from PiHole to Unbound over a docker network with their own IPs, port 53 is not in conflict.

[@RaviKumar-mj3gs]

Thanks Jim. I have moved to all Kubernetes, no more docker compose! how to do this in Kubernetes?

[@mrsentencename7334]

if i put pi hole through a vpn with gluetun will that mean everything on network will be on a vpn if the dns is my server ip in router?

[@Jims-Garage]

@@mrsentencename7334 no, it means that DNS requests go over the VPN.

[@mrsentencename7334]

@@Jims-Garage even if I use pi hole as my dhcp sever?

[@oliveirajmr]

If you use opnsense skip the unbound part and just use the built in one. Does the same 😊

[@Jims-Garage]

Agreed, makes sense. Just be sure to disable forwarding requests.

[@ragman1976]

Hi Jim, thx for this playlist, 10 out of 10! I followed this guide, in the unbound log I got the messasge: "unbound[1:0] warning: unbound is already running as pid 1." Is that an issue?

[@Jims-Garage]

Not familiar with the error message, is it working as expected?

[@ragman1976]

@@Jims-GarageAlthough the error message runnig it since two days..works fine

[@martinzipfel7843]

Hi Jim, great video. Are you sure your docker-compose.yml is correct? I kept getting service.pihole.environment variable must be mapped error. I had to remove the `-` in front of the environment variables or put `" "` around the variable to get around the error. After `docker compose up -d` I get the message `error response from daemon: network proxy not found` any idea what that is about? I can see in portainer that the bridge was created but the container were not created.

[@Jims-Garage]

Proxy network is if you're using Traefik. Change it to whatever your proxy network is called (delete if not using)

[@martinzipfel7843]

@@Jims-Garage Hi Jim, thanks for the trouble shooting. I deleted all the Traefik stuff but didn't delete the proxy config which I have done now but I seem to have no luck with your docker file. Now I get the error `Error starting userland proxy: listen tcp4 0.0.0.0:53: bind: address already in use` but it is a brand new installation with only portainer running. I currently have pihole running already for couple of years but the combination with unbound sounds like a must have.

[@drmetroyt]

How to install this using unraid community applications ? Both pinhole and unbound and make them communicate with each other

[@Jims-Garage]

I'm not sure, I've never used unraid I'm afraid.

[@batb6627]

Thanks for the video! Just a question, what's the difference/benefits of using this over cloudflare tunnels?

[@Jims-Garage]

Not a great deal, but there are privacy and security benefits from hosting the recursive server yourself. It helps against Cloudflare knowing all of your DNS queries, plus protects you from DNS poisoning attacks.

[@batb6627]

@@Jims-Garage do you think it is possible to combine both approaches ? If cloudflare is down or as a load balancing or parallel requests?

[@Jims-Garage]

@@batb6627 the reason you are using Cloudflare is for security, it's providing an encrypted tunnel to Cloudflare so only Cloudflare can see the DNS query. Unbound is resolving the IP for you by contacting authoritative nameservers. The two things are disparate.

[@batb6627]

@@Jims-Garage okay, I get get it! Thanks for your reply, I'm pretty sure it'll be helpful for others

[@scubeedu2]

Hi Jim - almost have this running, but as someone mentioned below a couple months ago, I'm getting the following error. Any ideas? "Error starting userland proxy: listen tcp4 0.0.0.0:53: bind: address already in use"

[@Jims-Garage]

If you're using Ubuntu you might need to apply the port 53 fix.

[@scubeedu2]

@@Jims-Garage is that documented on your Github site somewhere? Thanks for your help! 👌

[@e.colemantlpss6406]

I have an error and as somebody who knows sweet FA about this stuff have no idea where to start. Network docker-compose_dns_net Created 0.2s Error response from daemon: network proxy not found This after running sudo docker compose up -d. Please help........

[@Jims-Garage]

Do you have Traefik? If so, amend proxy network to your Traefik network. As mentioned in the video, if you're not using a proxy then delete the labels section and the proxy network

[@e.colemantlpss6406]

@@Jims-Garage No not running Traefik and as per your video I did remove the entire labels section. I see you have an empty proxy: line under the ipv4 address. Anything to do with it? As a test I removed the proxy: line and it ran the container up without errors. Pihole is getting requests but not passing them to unbound.

[@Jims-Garage]

@@e.colemantlpss6406 good, glad it's working. The proxy: value tells it to put it on the proxy network which is specified at the bottom of the compose file.

[@e.colemantlpss6406]

@@Jims-Garage It's not working :( I give up

[@Jims-Garage]

@@e.colemantlpss6406 in what way wasn't it working?

[@SpookyLurker]

Why wouldn't you setup an LXC in Proxmox and just integrate Unbound with Pi-Hole?

[@Jims-Garage]

You could. I prefer the security of VMs and flexibility of Docker though. 1 click for a full restore.

[@SpookyLurker]

@@Jims-Garage Are you gonna do a video for this based on RKE2?

[@Jims-Garage]

@@SpookyLurker I'll likely add the Kubernetes manifest files. I've already shown how to convert docker to Kubernetes

[@AtindriyaDas]

Thanks very much!!

[@Jims-Garage]

You're welcome

[@luigitech3169]

Nice, does unbound also works with adguard? I prefere it instead of pihole

[@Jims-Garage]

I don't know but I imagine you can specify upstream DNS? If so, should be good to go.

[@batb6627]

Yes, I can confirm it works too!

[@andrewtegala]

How do you deploy Unbound with PiHole on CasaOS?

[@Jims-Garage]

Sorry, I don't know. I don't use CasaOS

[@streamx2]

Can you stop saying Umbound, its UNBOUND, LIKE UN)DER

[@Jims-Garage]

Yes, I know what it is, English is my native language... I only hear Unbound, albeit I did have a cold at the time of recording.

[@jordanpfeifer9587]

i get an error inside logs for unbound that says exec /unbound.sh format error. it wont assign the ip address of dnsnet. is there something ive done wrong

[@niro1960]

me2

[@jordanpfeifer9587]

Update to this. I was using the wrong version of unbound

[@rutvijpatil2032]

Hi I am new to docker world , After running the docker compose , I am getting below Error : ⠼ Network unbound_dns_net Created 0.3s Error response from daemon: network proxy not found Can someone help ?

[@Jims-Garage]

Create the network (you can follow my Traefik video as mentioned), or change it to whatever network you want.