this post was submitted on 10 Aug 2024
24 points (100.0% liked)

Linux

47231 readers
756 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
 

I have a pi hole in my network and I set it as my primary DNS server, and my router (a Mikrotik) as secondary. DHCP sets the DNS servers as pihole, mikrotik in this exact order and I want to keep it that way. I know systemd-resolved uses some algorithm to set the fastest dns as current server, but I don't want/need that. Is there some way to do configure it to just let it be?

I'm running Fedora 40.

all 8 comments
sorted by: hot top controversial new old
[–] [email protected] 9 points 1 month ago

You don't. There's a feature request for adding the ability to always try the primary DNS server first but it's still open.

When you configure multiple DNS servers in systemd-resolved, the resolver will assume all servers are equally valid and produce the same records. This is unlike Windows, which will always try the primary and the randomly try the secondary/tertiary/etc., or dnsmasq which should try the servers in order.

systemd-resolved will rotate through DNS servers, sticking with the one that works when the current server dies. It's not necessarily about speed, but rather about availability. If all DNS servers fail, it'll fall back to whatever fallback DNS server was compiled in by your distro (I believe Google's 8.8.8.8 is compiled in by default but you'll have to check the Fedora sources to see if they're configuring systemd for that).

You can install a DNS resolver that does take the "try every server in the list" approach after removing/disabling systemd-resolved. Make sure to update your resolvconf files to point to said server.

However, I do wonder if your Pi-Hole-then-microtik approach actually works on all devices. If your computer validates DNSSEC records, the fake results returned by Pihole will be discarded as broken, and your computer will probably try to resolve the domain on your router, undoing the blocking Pihole is trying to do. You'll need to disable DNSSEC verification for this approach to work if you're also including a non-blocking DNS server into the chain.

[–] atzanteol 2 points 1 month ago (1 children)

You can't. Well, you shouldn't rely on queries going out in any particular order. All of your DNS servers should behave the same way as clients may fail from the first one to a secondary.

Why do you care which one is being used? What are you trying to do?

[–] [email protected] 1 points 1 month ago (1 children)

I want to have ads blocked with pihole and at the same time to have local DNS served by the router. I know pihole does local DNS, but RouterOS (mikrotik) is much better suited for that.

[–] [email protected] 7 points 1 month ago (1 children)

If you set the Microtik as Pihole's upstream server, you should get both Microtik's local domains and ad blocking.

You may need to disable DNSSEC validation to get it to work if you use a real domain for local records, though.

[–] [email protected] 1 points 1 month ago

Thank you. I'll have it set like this.