I let the router handle dhcp, while having it hand out each of the piholes IPs as DNS #1 and DNS #2. Those piholes settings are mirrored using Nebula-Sync, so any change made to one pihole gets copied over to the other automatically.
Both of those piholes are setup to wrap outbound DNS reqests in DOH as well, with the router blocking port 53 outbound. So all DNS traffic leaving the network has to be DOH/DOT or it just gets dropped. Currently using NextDNS and quad9 as my upstream DOH providers.
Note: the cloudflared method for DOH is outdated. I’m still using it via the docker image “image: cloudflare/cloudflared:2025.11.1”
I’ve been running two piholes for a few years:
I let the router handle dhcp, while having it hand out each of the piholes IPs as DNS #1 and DNS #2. Those piholes settings are mirrored using Nebula-Sync, so any change made to one pihole gets copied over to the other automatically.
Both of those piholes are setup to wrap outbound DNS reqests in DOH as well, with the router blocking port 53 outbound. So all DNS traffic leaving the network has to be DOH/DOT or it just gets dropped. Currently using NextDNS and quad9 as my upstream DOH providers.
Note: the cloudflared method for DOH is outdated. I’m still using it via the docker image “image: cloudflare/cloudflared:2025.11.1”
I believe This (dns-crypt) is the more recent method.
Oh sweet this is super helpful! Doesn’t seem too complicated. Thanks!