Newb here and attempting to configure DNS Hijacking with NAT rule to masquerade redirected traffic back to the client showing the requested DNS server address.
I have this working with 1 PiHole and I have Option 6 set in DHCP with both PiHole addresses so they are advertised correctly. I want the second PiHole to act as secondary service clients can use if the 1st goes offline.
I understand that the Port Forward can only redirect from the Source Zone (Lan) to a single address, however, I am wanting the rule to allow two both PiHoles to match as exceptions e.g. !192.168.1.2 !192.168.1.3 so that their DNS requests pass through without re-direction. Under Advanced Settings, Source MAC address I can add custom MAC addresses matching the devices with preceding ! but this does not work for either device if I use the MAC addresses alone. It appears to only work with a custom Source IP address preceded by ! . Via Luci there is not an add function to input multiple Source IP addresses. The other option is an IP range, which I presume is CIDR notation. I am using only two successive addresses and not sure if this can be input as a range - 192.168.1.2 and 192.168.1.3.
As it is now, the first PiHole answers queries correctly and queries to non 192.168.1.2 addresses are redirected to 192.168.1.2 and masqueraded to show the requesting DNS server as responding. However the second PiHole answers all requests with SERVFAIL
Solved. Looked up and used the CIDR notation for the two successive IPs as the IP range input !192.168.1.2/31 for 192.168.1.2 -192.168.1.3. Appears to be working correctly
Following the instructions, in Luci under Firewall - Port Forwards, define in a new rule under General Settings the DNS Hijack and redirect is defined to a single IP address. Then in the Advanced Settings tab of the same rule is where you define the source MAC addresses or Source IP address or address range.
I could not find any guides that explicitly address using multiple DNS/PiHole services but it seemed logical that exceptions for all cases would need to be defined here otherwise the intercept would catch the traffic in a chain of additional rules defined. I tried using multiple MAC addresses, but after some initial testing this did not appear to work, it only worked for the IP defined in the redirect which was also in the IP address field as an exception at the time. My testing was minimal and so I would need to go back to verify this. When entering these exceptions I placed (!) at the front of all the entries by using the custom entry field at the bottom of the pop-up IP or MAC address selector.
I then looked at defining the IP range instead of using multiple MAC addresses. Being a newb I generally know what CIDR notation is, but nothing about calculating it. I used https://mxtoolbox.com/SubnetCalculator.aspx to input my first Pi-Hole IP and then selected the notation pop-up on the right to get the notation for the range I want which was only the next successive IP, 192.168.1.2/31 which is only 2 IPs in the range. Save & Apply and everything worked.
if you want them to be used equally, put a load balancer in front of them.
I got two Piholes, running in the free for life Oracle cloud tier, the primary receives
requests from the clients, the 2nd one, the hijacked requests trying to escape my LAN.
both IPs are provided to the clients via DHCP.
