Solved Run AdGuard as DNS on my NAS through Docker

[Mnl-]

Hi there,

Very happy to find this place where I might get some precious help!
I'm running through docker and docker-compose, AdGuard (kind of PiHole) on my Synology NAS.
My NAS is up to date.

As I want to use it as DNS on my router, I need it run on the port 80 (as not all devices can manage a DNS with a specific port).
To be able to do that, I have create a docker macvlan network following a nice tutorial found online.

Nevertheless, a macvlan can be accessed by all devices on the network expect by the host (my NAS) itself.
I learned that today while search how to solve my issue for hours

I would like to find a way to solve this for the following reasons:

• It's annoying
• I can't access it from other containers
• My Syno can't use the DNS
• The reverse proxy from the Syno can't go its job to provide HTTPS as it cant access it
  

Leads I have tried to dig:

• Free 80/443 of my Syno, don't really like forcing stuff and didn't work
• Using ipvlan instead of macvlan but Synology current Docker version seems to not support it

I have attached here the Reverse Proxy settings + the docker compose file.

Thanks for reading this. I hope someone as a solution.

Best

 

[Shadow]

I believe the dockers have to be connected to some kind of different docker bridge network. Then the NAS and other dockers connected to that network should then use the IP address of that different docker network. I've been trying to figure this out but no success.

Docker is starting to become less and less attractive to me...

 

[Telos]

Thanks for reading this. I hope someone as a solution.

I took a different approach, following the video I posted in the other AH thread. Did you try that?

 

[Mnl-]

I took a different approach, following the video I posted in the other AH thread. Did you try that?

Could you please link it?

 

[one-eyed-king]

A kernel security feature forbids that a macvlan ip and its parent network interface can communicate with each other. This is not a restriction of docker.

The section Host access of this blogpost Using Docker macvlan networks · The Odd Bit covers what needs to be done. Though, the solution will be ephemaral and needs to be reapplied on nas restart. Make sure to put those commands into a task@system start.

@Shadow: what is a docker? Are you refering to containers as dockers? if so, why?!

 

[Shadow]

@Shadow: what is a docker? Are you refering to containers as dockers? if so, why?!

I should get a good night sleep before I post stuff via my mobile phone.

The section Host access of this blogpost Using Docker macvlan networks · The Odd Bit covers what needs to be done. Though, the solution will be ephemaral and needs to be reapplied on nas restart. Make sure to put those commands into a task@system start.

So if this is done right, then the host NAS can communicate to the containers with it's macvlan IP address? That would be awesome! Gonna look into this. Thanks!

Could you please link it?

If you'd use the search function on this forum, then you'd find this threat.

 

[Mnl-]

A kernel security feature forbids that a macvlan ip and its parent network interface can communicate with each other. This is not a restriction of docker.

I have read that afterwards that security is showing that the solution I chose have backside.

The section Host access of this blogpost Using Docker macvlan networks · The Odd Bit covers what needs to be done. Though, the solution will be ephemaral and needs to be reapplied on nas restart. Make sure to put those commands into a task@system start.

I will look this asap, thanks a lot for this information!

 

[Shadow]

The section Host access of this blogpost Using Docker macvlan networks · The Odd Bit covers what needs to be done. Though, the solution will be ephemaral and needs to be reapplied on nas restart. Make sure to put those commands into a task@system start.

I will look this asap, thanks a lot for this information!

Well I can confirm that this indeed works...

My gosh. This is sweet. So now on the Synology DNS package I can just set the LAN IP of my AdGuard docker container as forwarder. And I can also confirm this works!

 

[one-eyed-king]

Its a simply trickery to bypass the limitations Don't forget to add a task to re-create the new macvlan interface after a reboot ....

 

[Shadow]

Don't forget to add a task to re-create the new macvlan interface after a reboot ....

Done on both my NAS'es running Docker!

Thanks again!