UTM 9 DHCP with DNS Availability List

Hello Matthias,

so your pi-hole is sitting at 192.168.0.254?

yes sir - will edit this in my initiating post.

Hello Matthias,

ok, then why do you expect the client to contact another DNS-Server, if you communicate only one server IP in your DHCP-configuration?

The client will contact 192.168.0.254 and will keep contacting this one.

My solution to this would be to have a second DNS server entry pointing to the Sophos gateway and then have the UTM to do the decision which DNS to contact instead, if the pi-hole fails.

Hi Philipp,

with my (wrong) config I am not expecting any other contact than to the pihole. 

I tried your solution - oddly it doesnt work. The UTM as secondary DNS is not resolving any names/URLs to clients when the pihole is down.

Perhaps this should be the question:
That is actually my question: how am I using DNS forwarders with a configured DHCP?

I seem to be missing anything... 

Thanks

Matthias

Hello Matthias,

give us a screenshot of your "DNS forwarders" settings (edit window of the UTM GUI)

Hello Matthias,

give us a screenshot of your "DNS forwarders" settings (edit window of the UTM GUI)

Hi Philipp,

right here (pi-hole available):

If I turn off the pi-hole:

so the switching actually works...

Do I need a special (Network-/Service-)Definition for this to work?

When I use Support>Tools>DNS Lookup it works, when the pihole is unavailable:

"Trying "sophos.com"

;; Truncated, retrying in TCP mode.

Trying "sophos.com"

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10466

;; flags: qr rd ra; QUERY: 1, ANSWER: 40, AUTHORITY: 0, ADDITIONAL: 0


;; QUESTION SECTION:

;sophos.com.			IN	ANY

Received 2604 bytes from 127.0.0.1#53 in 0 ms"


I am lost...

Hello Matthias,

I believe you, that your DNS is working ON THE UTM. But that's not the point of view of the clients: you offer your DHCP-clients the IP address of the pi-hole only. They don't know about any other way to resolve DNS-requests.

So you have two ways to go: either you change that first DNS-Server address in your DHCP configuration to the IP of the Sophos UTM (I think this is 192.168.0.1) or you use my suggestion from above (second DNS entry ...)

With the second method you need to remove the pi-hole from the DNS availibilty group, because this makes no sense, then.

Thanks Philipp, it seems to work the way you suggested - I fiddled around quiet a bit... but well. It does the job.

I was preferring the availability list though. Is that a general "not working with dhcp" or am i just missing something?

Thanks a lot.