Resolv-conf Question

[undaunt]

Hello,

If my intent is to run a jail that acts as a DNS server, per these steps (https://adguard-dns.io/kb/adguard-home/faq/#bindinuse) I'd need to kill systemd-resolve and replace the DNSStubListener with 127.0.0.1 instead of 127.0.0.53.

I've changed --resolv-conf from bind-host to off but I think that is wrong.

Is the implication of this that the only DNS server the client would use would be itself, instead of itself and any other DNS servers as assigned by the TrueNAS host? I have 3 DNS servers. Ideally I would disable the systemd service within each host to free up port 53, but still bind the actual assignment of DNS servers from TrueNAS where I define all 3. Is that correct?

If so, I think my template should be:

startup=1
gpu_passthrough_intel=0
gpu_passthrough_nvidia=0
# Turning off seccomp filtering improves performance at the expense of security
seccomp=1

# Use macvlan networking to provide an isolated network namespace,
# so docker can manage firewall rules
# Alternatively use --network-bridge=br1 instead of --network-macvlan
# Ensure to change eno1/br1 to the interface name you want to use
# You may want to add additional options here, e.g. bind mounts
systemd_nspawn_user_args=--network-bridge=br0
    --resolv-conf=bind-host    

# Script to run on the HOST before starting the jail
# Load kernel module and config kernel settings required for docker
pre_start_hook=#!/usr/bin/bash
    set -euo pipefail
    echo 'PRE_START_HOOK'
    echo 1 > /proc/sys/net/ipv4/ip_forward
    modprobe br_netfilter
    echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables
    echo 1 > /proc/sys/net/bridge/bridge-nf-call-ip6tables

# Only used while creating the jail
distro=debian
release=bookworm

initial_setup=#!/bin/bash
    set -euo pipefail

    apt-get update && apt-get -y install ca-certificates curl
    apt-get install -y nano screen curl wget openssh-server

    USER_NAME="undaunt"
    useradd -u 1000 -m -s /bin/bash $USER_NAME
    usermod -aG sudo $USER_NAME

    # Install AdGuard Home
    curl -s -S -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -v

    # Create and configure AdGuard Home DNS configuration
    mkdir -p /etc/systemd/resolved.conf.d
    touch /etc/systemd/resolved.conf.d/adguardhome.conf
    echo "[Resolve]" >> /etc/systemd/resolved.conf.d/adguardhome.conf
    # echo "DNS=127.0.0.1" >> /etc/systemd/resolved.conf.d/adguardhome.conf - Remove this, else there are 4 nameservers including local
    echo "DNSStubListener=no" >> /etc/systemd/resolved.conf.d/adguardhome.conf

    # Disable systemd-resolved and configure DNS resolution
    mv /etc/resolv.conf /etc/resolv.conf.backup
    ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf

# You generally will not need to change the options below
systemd_run_default_args=--property=KillMode=mixed
    --property=Type=notify
    --property=RestartForceExitStatus=133
    --property=SuccessExitStatus=133
    --property=Delegate=yes
    --property=TasksMax=infinity
    --collect
    --setenv=SYSTEMD_NSPAWN_LOCK=0

systemd_nspawn_default_args=--keep-unit
    --quiet
    --boot
    --bind-ro=/sys/module
    --inaccessible=/sys/module/apparmor

Thank you.

[undaunt]

This does seem to be the case. By only populating that dnsstublistener=no into the override file, I'm getting the TrueNAS host DNS servers added in. All 3 work from each host via dig.

Perhaps this template will help someone!

[Lockszmith-GH]

Thanks for sharing. I'll give it a try. Although, I'm moving out of adguard - to this open-source solution - gravity, wonder if they have a similar setting, I'll update here if it does.

[Jip-Hop]

I run adguard via docker inside a jail and don't need to do anything special to make that work.

[undaunt]

When running the default docker template suggested (or even without docker) debian is tying up port 53. You're not seeing that you're saying?

[Jip-Hop]

Aah yes I see that in the default jail systemd-resolved is binding to port 53 on 127.0.0.53 and 127.0.0.54.

root@test:~# netstat -tulpn | grep resolved
tcp        0      0 127.0.0.54:53           0.0.0.0:*               LISTEN      33/systemd-resolved 
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      33/systemd-resolved 
tcp        0      0 0.0.0.0:5355            0.0.0.0:*               LISTEN      33/systemd-resolved 
tcp6       0      0 :::5355                 :::*                    LISTEN      33/systemd-resolved 
udp        0      0 0.0.0.0:5355            0.0.0.0:*                           33/systemd-resolved 
udp        0      0 127.0.0.54:53           0.0.0.0:*                           33/systemd-resolved 
udp        0      0 127.0.0.53:53           0.0.0.0:*                           33/systemd-resolved 
udp6       0      0 :::5355                 :::*                                33/systemd-resolved 

But that doesn't mean you cant run adguard. I explicitly bind to the static IP of the jail to serve DNS to clients on my LAN. In docker compose it looks like this:

services:
  adguardhome:
    image: adguard/adguardhome
    # Ensure to change to default dns port 53 to 5353 inside conf/AdGuardHome.yaml
    ports:
      - 192.168.1.10:53:5353/tcp
      - 192.168.1.10:53:5353/udp
    volumes:
      - ./adguardhome/work:/opt/adguardhome/work
      - ./adguardhome/conf:/opt/adguardhome/conf
    user: ${ADGUARD_UID}:${ADGUARD_UID}
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs: /tmp:noexec

So maybe I did do something special to make it work.

[undaunt]

I wound up having to not use --bind-host anyway due to an unrelated issue about container download speeds. My TrueNAS host is set to use Cloudflare DNS. Whenver I set it to use my container local DNS, speed craps out to under 10 Mb/s. I'm forcing LAN container DNS within each Jail by not using host DNS and not inheriting. However, we can definitely call this question closed, thanks for getting back to me.