Pi-Hole with Unbound reporting Cloudflare DNS when checking for DNS leaks

VPN
1

I have Pi-Hole setup along with Unbound, with Wireguard as the VPN solution. They are all on separate docker containers, on the same Raspberry Pi. I added the correct address and port of the Unbound docker container to Pi-Hole, with no other DNS servers selected. However, when I go to websites like dnsleaktest.com, they report my DNS Servers to be ones from Cloudflare, instead of my own public IP address. I tested this on my Android phone on LTE data, connected to the Wireguard VPN. As a test, while staying on data on my phone, disconnecting the VPN showed the AT&T DNS server as expected, connecting to the VPN immediately switches back to Cloudflare.

In Pi-Hole, all the queries are sent to and answered by the Unbound docker container, as confirmed by the Pi-Hole logs. I am not seeing any query in Pi-Hole going outside my network for resolution, so I am stumped as to what the cause of this is. The best guess that I could come up with is that somehow Unbound got configured in forwarding mode instead of a recursive resolver. I am not an expert on networking or Unbound, so I am looking for anyone who has an idea as to how to solve this. If it helps, I used GitHub - MatthewVance/unbound-docker-rpi: Run Unbound with latest version of OpenSSL on Raspberry Pi with Docker. as the docker image to set up unbound.

2

I was able to fix this issue. As I suspected, the unbound docker image I was using was setup in forwarder mode, meaning that the DNS server was forwarding the queries to Cloudflare. I commented out the include for the forward-mode file in unbound.conf and restarted the unbound container, and now the dnsleakstest (and other tools) only show my public IP as the DNS server.

3

Hard to say without seeing your config, but the short of it is that somewhere on your network you have Cloudflare set as the DNS resolver. Check all your clients, switches, vlans, router, etc., for hard-coded DNS.

4

check for DNS = 1.1.1.1 in your wireguard client config

5

Are you using the WireGuard client app? What does it show for DNS in the config settings on the client app?

6

Wireguard is probably forcing the use of Cloudflare DNS (WARP) somewhere either by config either by design

7

Check your unbound config,

I was once use onbound then just relize inside the unbound somehow it point to cloudflare DoH

8

Thank you for this, you solved this issue for me!

9

Thanks so much man! its 2 am and I can finally sleep lol. BTW I also had to comment out all DNS servers in the etc/pihole/dns-servers.conf in my pihole container.

10

Thank you very much. I was new to unbound and wasn’t sure what to look for.

11

I did check actually and I don’t see it anywhere. I don’t have switches or VLAN setup, and my phone and router definitely don’t have the Cloudflare DNS. I can provide any config here if that would help diagnose this.

12

It is showing the unbound address in the client app for DNS.

13

Nope, you can define in every client config which DNS should be used.

14

No problem, glad it helped someone!

15

Haha you’re welcome, glad this helped someone else too!

16

It has to be set somewhere otherwise it wouldn’t know how to request Cloudflare. Maybe triple check the whole setup again. Start from step one.