Adguard Home inside a jail - DNS not working

[BenRoe]

Hi,
i try to get Adguard Home running inside a jail.

Used the docker template and only changed the systemd_nspawn_user_args

systemd_nspawn_user_args=--network-macvlan=eno1
        --resolv-conf=off
        --system-call-filter='add_key keyctl bpf'
        --bind='/mnt/tank/jailmaker/docker-data/adguard:/docker-data/adguard'

/etc/resolv.conf inside the jail

nameserver 127.0.0.1
search .

Added a static IP like described here.

My compose.yaml

version: "3"

services:
  adguardhome:
    image: adguard/adguardhome
    container_name: adguardhome
    deploy:
      resources:
        limits:
          cpus: '0.50' # max. 50%
          memory: 300m
        reservations:
          cpus: '0.1'
          memory: 100m
    volumes:
      - '/docker-data/adguard/conf:/opt/adguardhome/conf'
      - '/docker-data/adguard/work:/opt/adguardhome/work'
    ports:
        # DNS
        - 53:53/tcp
        - 53:53/udp
        # DHCP server
        #- 67:67/udp
        #- 68:68/tcp
        #- 68:68/udp
        # HTTPS/DNS-over-HTTPS
        #- 443:443/tcp
        # DNS-over-TLS
        - 853:853/tcp
        # DNS-over-QUIC
        #- 784:784/udp
        # DNSCrypt
        #- 5443:5443/tcp
        #- 5443:5443/udp
        # WebUI
        - 80:80/tcp
        - 443:443/tcp
        #- 443:443/udp
        # WebUI Setup
        - 3000:3000/tcp
    restart: unless-stopped

I can access the web interface via 192.168.0.10, but if i set the DNS on my router to 192.168.0.10 or direct to my Mac under Network Settings, no website will be loaded.

Any idea?

[Lockszmith-GH]

My guess is there is a race condition on the 80 and 443 ports. by default Adguard will listen on 0.0.0.0 which means 'all IPs' - you want to force it to listen only on the new static IP you've set.

I have adguard running in a similar fashion, I just used host networking instead for the container - it's 'risky' but it's the only service running in that jail right now.

[Lockszmith-GH]

how did you setup the IP on the TrueNAS SCALE?
You mentioned you followed the instructions.

Did you create a bridge with multiple IP aliases?

[BenRoe]

nslookup is also not working inside the jail.

nslookup google.com 8.8.8.8

Got server not reachable.

I have setup up a vm with debian and docker. This seems to work fine. Will test this more.

[Lockszmith-GH]

This is my network settings (I find the cli easier to review these settings):

Commands:

cli -c 'network general summary'
cli -c 'network interface query'
cli -c 'network interface ip_in_use'
cli -c 'network static_route query'
cli -c 'network route ipv4gw_reachable ipv4_gateway="192.168.xxx.xxx"' # use gateway IP from summary

Output:

### $ cli -c 'network general summary'
+----------------+-----------------+
|            ips | <dict>          |
| default_routes | 192.168.xxx.xxx |
|    nameservers | 192.168.xxx.53  |
|                | 192.168.xxx.54  |
+----------------+-----------------+

### $ cli -c 'network interface query'
+---------+----------+-----------------------------+-------------------+-----------+-----------+-------------+--------+----------------+-------------+
| name    | type     | state.aliases               | aliases           | ipv4_dhcp | ipv6_auto | description | mtu    | bridge_members | stp         |
+---------+----------+-------------------------------+-----------------+-----------+-----------+-------------+--------+----------------+-------------+
| enp14s0 | PHYSICAL | <empty list>                | <empty list>      | false     | false     |             | <null> | <undefined>    | <undefined> |
| enp15s0 | PHYSICAL | xxxx::xxx:xxxx:xxxx:xxxx/64 | <empty list>      | false     | false     |             | <null> | <undefined>    | <undefined> |
| br0     | BRIDGE   | 192.168.xxx.16/24           | 192.168.xxx.16/24 | false     | false     |             | 1500   | enp15s0        | true        |
|         |          | 192.168.xxx.54/24           | 192.168.xxx.54/24 |           |           |             |        |                |             |
+---------+----------+-----------------------------+-------------------+-----------+-----------+-------------+--------+----------------+-------------+

### $ cli -c 'network interface ip_in_use'
+------+----------------+---------+-----------------+
| type | address        | netmask | broadcast       |
+------+----------------+---------+-----------------+
| INET | 192.168.xxx.16 | 24      | 192.168.xxx.255 |
| INET | 192.168.xxx.54 | 24      | 192.168.xxx.255 |
+------+----------------+---------+-----------------+

### $ cli -c 'network static_route query'
(empty list)

### $ cli -c 'network route ipv4gw_reachable ipv4_gateway="192.168.xxx.xxx"' # xxx.xxx will be the ip to your default gateway
true

And this is my jail configuration

sudo cat jails/dockerhost/config
startup=1
docker_compatible=1
gpu_passthrough_intel=0
gpu_passthrough_nvidia=0
systemd_nspawn_user_args=--bind '/mnt/<pool-name>/data/apps/jails/dockerhost:/srv/containeriszed'
# You generally will not need to change the options below
systemd_run_default_args=--property=KillMode=mixed --property=Type=notify --property=RestartForceExitStatus=133 --property=SuccessExitStatus=133 --property=Delegate=yes --property=TasksMax=infinity --collect --setenv=SYSTEMD_NSPAWN_LOCK=0 systemd_nspawn_default_args=--keep-unit --quiet --boot

[BenRoe]

I noticed that you don't use

--network-macvlan=eno1
--resolv-conf=bind-host

in systemd_nspawn_user_args.

Btw you ssl cert for your website is not valid.

[Lockszmith-GH]

The reason I did not use macvlan: macvlan doesn't support accepting communications from the host on the outwards IP (apperantly there are some networking tricks that might support this, but I didn't want to go there)

Not sure about bind-host - I'm using host binding inside the dockerhost, but I don't recall what answeres generated this from the jailmaker script.

(as for website - yeah, it's pointing to the void right now, need to fix that)

[BenRoe]

I got it working.
I don't know why, but until i assigned a static IP to the jail, as described here, nslookup or dig could not resolve.
So i keep the DHCP and assign a static IP via the FritzBox.

user args in my jail config

systemd_nspawn_user_args=--network-bridge=br0
        --system-call-filter='add_key keyctl bpf'
        --bind='/mnt/tank/jailmaker/docker-data/pihole:/docker-data/pihole'