How can I use a local Pihole as DNS server ?

[schklom]

Describe the bug
I can't use pihole's DNS capabilities for some reason.
If NETWORK can whitelist the local-network to reach the vpn, then surely the vpn should be able to reach the network.
How can I use my local pihole's DNS server ?

To Reproduce without docker CLI
docker-compose.yml if used (hide credentials)

version: '3'
services:
  pihole:
    image: pihole/pihole:latest
    restart: unless-stopped
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "8888:80/tcp"
    dns:
      - 127.0.0.1
    environment:
      TZ: ${TZ}
      WEBPASSWORD_FILE: /run/secrets/pihole_password
      DNSSEC: "true"
      PIHOLE_DNS_: 127.0.0.1;8.8.8.8
    secrets:
      - pihole_password
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${DOCKERCONFIG}/pihole/etc-pihole/:/etc/pihole/
      - ${DOCKERCONFIG}/pihole/etc-dnsmasq.d/:/etc/dnsmasq.d/
    networks:
      - pihole
  
  vpn:
    image: bubuntux/nordvpn:3.7.4
    container_name: vpn
    restart: "no"
    security_opt:
      - no-new-privileges:true
    cap_add:
      - NET_ADMIN               # Required
      - SYS_MODULE              # Required for NordLynx
    sysctls:
      - net.ipv4.conf.all.rp_filter=2 # Required for Nordlynx
    devices:
      - /dev/net/tun            # Required
    volumes:
      # Before booting container, this fil gets filled with:
      # nameserver 10.0.0.3
      # options ndots:0
      - ${DOCKERCONFIG}/nordvpn/resolv.conf:/etc/resolv.conf
    environment:                # Review https://github.com/bubuntux/nordvpn#environment-variables
      - USER=${NORDVPN_USERNAME}   # Required
      - PASS=${NORDVPN_PASSWORD}   # Required
      - CONNECT=${NORDVPN_CONNECT}
      - TECHNOLOGY=NordLynx
      - TZ=${TZ}
      - NETWORK=10.0.0.0/24
      - DNS=10.0.0.3
  ...

Expected behavior
As usual, the vpn can connect to the Internet and retrieves the list of countries etc, then gets an IP.

Logs

$ docker logs -f vpn
+ [[ -n '' ]]
+ [[ '' =~ ^[0-9]+$ ]]
++ ip -o addr show dev eth0
++ awk '$3 == "inet" {print $4}'
+ DOCKER_NET=172.20.0.3/16
+ kill_switch
++ ip -o addr show dev eth0
++ awk '$3 == "inet6" {print $4; exit}'
+ local docker6_network=
+ iptables -F
+ iptables -X
+ iptables -P INPUT DROP
+ iptables -P FORWARD DROP
+ iptables -P OUTPUT DROP
+ iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+ iptables -A INPUT -i lo -j ACCEPT
+ iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i lo -j ACCEPT
+ iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+ iptables -A OUTPUT -o lo -j ACCEPT
+ iptables -A OUTPUT -o tap+ -j ACCEPT
+ iptables -A OUTPUT -o tun+ -j ACCEPT
+ iptables -A OUTPUT -m owner --gid-owner vpn -j ACCEPT
+ iptables -t nat -A POSTROUTING -o tap+ -j MASQUERADE
+ iptables -t nat -A POSTROUTING -o tun+ -j MASQUERADE
+ [[ -n 172.20.0.3/16 ]]
+ iptables -A INPUT -s 172.20.0.3/16 -j ACCEPT
+ iptables -A FORWARD -d 172.20.0.3/16 -j ACCEPT
+ iptables -A FORWARD -s 172.20.0.3/16 -j ACCEPT
+ iptables -A OUTPUT -d 172.20.0.3/16 -j ACCEPT
+ [[ -n 10.0.0.0/24 ]]
+ for net in ${NETWORK//[;,]/ }
+ return_route 10.0.0.0/24
++ ip route
++ awk '/default/ {print $3}'
+ local network=10.0.0.0/24 gw=172.20.0.1
+ grep -q 10.0.0.0/24
+ ip route
+ ip route add to 10.0.0.0/24 via 172.20.0.1 dev eth0
+ iptables -A INPUT -s 10.0.0.0/24 -j ACCEPT
+ iptables -A FORWARD -d 10.0.0.0/24 -j ACCEPT
+ iptables -A FORWARD -s 10.0.0.0/24 -j ACCEPT
+ iptables -A OUTPUT -d 10.0.0.0/24 -j ACCEPT
+ [[ -n '' ]]
+ ip6tables -F
+ ip6tables -X
+ ip6tables -P INPUT DROP
+ ip6tables -P FORWARD DROP
+ ip6tables -P OUTPUT DROP
+ ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+ ip6tables -A INPUT -p icmp -j ACCEPT
+ ip6tables -A INPUT -i lo -j ACCEPT
+ ip6tables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+ ip6tables -A FORWARD -p icmp -j ACCEPT
+ ip6tables -A FORWARD -i lo -j ACCEPT
+ ip6tables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+ ip6tables -A OUTPUT -o lo -j ACCEPT
+ ip6tables -A OUTPUT -o tap+ -j ACCEPT
+ ip6tables -A OUTPUT -o tun+ -j ACCEPT
+ ip6tables -A OUTPUT -m owner --gid-owner vpn -j ACCEPT
+ [[ -n '' ]]
+ [[ -n '' ]]
+ pkill nordvpnd
+ rm -f /run/nordvpnd.sock
+ '[' '!' -S /run/nordvpnd.sock ']'
+ sg vpn -c nordvpnd
+ sleep 0.25
+ '[' '!' -S /run/nordvpnd.sock ']'
+ nordvpn login -u USERNAME -p 'PASSWORD'
/2021/02/10 22:05:38 Get "https://zwyr157wwiu6eior.com/v1/servers/countries": dial tcp: i/o timeout
\2021/02/10 22:05:39 Post "https://zwyr157wwiu6eior.com/v1/users/tokens": dial tcp: i/o timeout
-2021/02/10 22:05:43 Get "https://zwyr157wwiu6eior.com/v1/servers/countries": dial tcp: lookup zwyr157wwiu6eior.com on 10.0.0.3:53: read udp 172.20.0.3:49753->10.0.0.3:53: i/o timeout
|2021/02/10 22:05:44 Post "https://boi9osyg1uwtyafn.com/v1/users/tokens": dial tcp: i/o timeout
\2021/02/10 22:05:48 Get "https://x9fnzrtl4x8pynsf.com/v1/servers/countries": dial tcp: i/o timeout
/2021/02/10 22:05:49 Post "https://icpsuawn1zy5amys.com/v1/users/tokens": dial tcp: i/o timeout
|2021/02/10 22:05:53 Get "https://2ohvff3e8v46kb8.info/v1/servers/countries": dial tcp: i/o timeout
-2021/02/10 22:05:54 Post "https://4qlnp8csnrj5zla.me/v1/users/tokens": dial tcp: i/o timeout
/2021/02/10 22:05:58 Get "https://q8uvnsgljgste3f.info/v1/servers/countries": dial tcp: i/o timeout
-2021/02/10 22:05:59 Post "https://w569ut7zbkiqf5b.xyz/v1/users/tokens": dial tcp: i/o timeout
-2021/02/10 22:06:23 Get "https://w569ut7zbkiqf5b.xyz/v1/helpers/ips/insights": dial tcp: i/o timeout
+ setup_nordvpn
+ [[ -n NordLynx ]]
+ nordvpn set technology NordLynx
Technology is successfully set to 'NordLynx'.
+ [[ -n '' ]]
+ [[ -n '' ]]
+ [[ -n '' ]]
+ [[ -n 10.0.0.3 ]]
+ nordvpn set dns 10.0.0.3
DNS is set to '10.0.0.3' successfully.
+ [[ -n 172.20.0.3/16 ]]
+ nordvpn whitelist add subnet 172.20.0.3/16
Subnet 172.20.0.0/16 is whitelisted successfully.
+ [[ -n 10.0.0.0/24 ]]
+ for net in ${NETWORK//[;,]/ }
+ nordvpn whitelist add subnet 10.0.0.0/24
Subnet 10.0.0.0/24 is whitelisted successfully.
+ [[ -n '' ]]
+ [[ -n on ]]
+ nordvpn -version
NordVPN Version 3.7.4
+ nordvpn settings
Technology: NordLynx
Kill Switch: disabled
CyberSec: disabled
Notify: disabled
Auto-connect: disabled
DNS: 10.0.0.3
Whitelisted subnets:
        172.20.0.0/16
        10.0.0.0/24
+ create_tun_device
+ mkdir -p /dev/net
+ [[ -c /dev/net/tun ]]
+ nordvpn connect Switzerland -g p2p
Please enter your login details.
Stdin/Stdout should be terminal
+ exit 1

Additional context

$ uname -a
Linux HOSTNAME 5.9.0-0.bpo.5-arm64 #1 SMP Debian 5.9.15-1~bpo10+1 (2020-12-31) aarch64 GNU/Linux
$ cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 10 (buster)"
NAME="Debian GNU/Linux"
VERSION_ID="10"
VERSION="10 (buster)"
VERSION_CODENAME=buster
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

I am using user namespaces with Docker, on a Raspberry Pi 4.

Any idea how to configure the vpn to enjoy pihole ?

Many thanks in advance ;)

[bubuntux]

please review the documentation, there is a DNS env variable on which you can define the DNS that the container will use

[schklom]

I already tried that, but I get timeouts during lookups.
Pihole is exposed to the local network, so I tried to use the local IP 10.0.0.3+0.0.0.0+127.0.0.1, and each time it can never connect to anything and the container crashes.
As a last resort, I put Pihole as primary DNS on the router and put my router's IP as DNS in your container. While it can find a new IP from Nordvpn, afterwards this is what happens

$ docker exec -ti vpn curl https://api.nordvpn.com/vpn/check/full
curl: (6) Could not resolve host: api.nordvpn.com

And the logs from pihole stay empty the entire time :/

When using public DNS like 8.8.8.8, it works fine however.

[bubuntux]

you have to remember that the network is gonna be inside of docker, so the ip should looks like something 17.xxx
i believe you are just using the wrong ip

[schklom]

Oh ok, I understand what you mean now.
However, I exposed pihole's ports to the LAN network, so I was hoping to reach the DNS with the LAN ip.
Do you mean that I must put the vpn and pihole in the same docker bridge network ?
If possible, I'm trying to keep docker networks separated for security reasons.

Is it doable without playing with iptables ?

Sorry to take so much of your time, and thanks for the container and the help I appreciate both a lot :)