1. USE IPV4 servers from DNS providers that have some decent functionality against ads etc.
These seem to work well but do not provide any granularity into whats is happening with clients etc..... no dashboard LOL.
2. Instead of regular IPV4 servers, use the DOH function within the ROS to better hide I guess traffic request coming and going from the router?
Again no granularity or dashboard.
3. Then we get to other devices, which this thread is focused on, aka the Container/Docker approach.
We have the ability for the router to do DOH, and the router to do a container with adguard/pihole!
Q1. Is it possible to combine BOTH ?
Q2. If not, which is better to implement and why?
(4) Assuming we are going to go ahead with the adguard/pihole on a container/docker approach lets get REAL.
Not the simple cookie cutter examples on youtube that magically describe using this somewhat complex tool with a single bridge and single subnet.
PALEASE...............
(5) Lets at least solve a more typical home/soho MT user that has.
a. single bridge
b. multiple vlans
First problem: Does the container/docker get its own VLAN? Or does it have to be on a separate bridge?
Others: Too numerous to mention as I trip over all of them
![Smile :-)](./images/smilies/icon_smile.gif)
(6) Other Assumptions/Problem areas
SEND USERS TO CONTAINER
- firewall rule allow interface-list=LAN dst-address=adguard/pihole IP { allow users to reach adguard/pihole on container }
- dst-nat rules in-interface-list=LAN dst-port=53 protocol=tcp/udp to-address=adguard/pihole IP exclude src-address=adguard/pihole IP { force users to adguard/pihole }
- input chain rules in-interface-list=LAN dst-port=53 protocols=tcp/udp { to give adguard/pihole access to DNS for initial connection }
- ip dhcp server-networks - set ALL vlan DNS server entries to adguard/pihole IP exclude adguard/pihole vlan (it gets same value as the gateway entry)
Note for Admin to configure adguard/pihole
- dst-nat rule dst-address=subnet gateway IP of container to=address=adguard/pihole IP { to reach pihole/adguard via web-browser }
IP DNS entries.
Allow Remote Requests = YES
Add Servers IPV4 to enable adguard pihole to reach its own servers. Should it be the same ones or different ones pihole/adguard uses.
SourceNAT: Nothing special that I am aware of. The docker/container will fall under the standard sourcnat rule ??? If the docker/container is in its own vlan, then no hairpin is required!
(7) What am I missing that I have not considered ( keeping it to ipv4 ).