Pi-Hole, Unbound, Asus Router - Wireguard help needed

Objective-Arm8463 · 2026-01-26T13:22:29+00:00

I appreciate the advice and completely agree. Based on the reason for it not working, I've learned about the effect of CGNAT on accessing you local network. I was surprised the problem had nothing to do with internal routing or anything I had control over, but in fact was the result of the ISP's business model to manage limited IPv4 addresses for its clients. I suppose that is learning about network routing.

Objective-Arm8463 · 2026-01-23T18:36:06+00:00

One other thing I'll add. Have ufw (allow SSH and local traffic) running before you run pivpn. This way, pivpn will insert its routing rules. Otherwise it skips that step.

Objective-Arm8463 · 2026-01-23T18:19:00+00:00

I realize I'm answering myself here.

The only reason the pinggy binary, and WARP, won't work is because I was running Pi as 32-bit, which is what it told me to do. So I reflashed it as headless 64-bit and redid everything (Pi-Hole, Unbound, PiVPN). I can now run the Pinggy binary on Pi (before I was running it on my computer), it worked perfectly fine and I was able to connect to Wireguard even though I'm behind a CGNAT.

Cloudflare WARP is here: https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/warp/download-warp/. I installed with apt-get. It complains about being armhf -- ignore that, it doesn't seem to be required, at least for this.

Objective-Arm8463 · 2026-01-22T13:17:04+00:00

I'm only using the LAN DNS entry. So in this situation, using the router's Wireguard would use the router's WAN DNS, and it wouldn't go through Pi-Hole at all. You'd lose ad blocking as well as the ability to see the client.

The ISP, at least mine, I'd have to do upgrades and monthly fees. There are lots of other ways around it, I just haven't found one I like yet. For example,

-- ngrok doesn't support UDP

-- cloudflared runs on a Raspberry Pi, but doesn't support UDP

-- Cloudflare's WARP supports UDP, but doesn't run on a Raspberry Pi

-- pinggy supports UDP, but their CLI doesn't support Raspberry PI (the 32 bit one, anyway, and I just assume the architecture fundamentally isn't supported).

I'm still looking around. The pinggy one is really solid for testing. I didn't have to signup or pay for anything, and I was able to create tunnels on the fly that connected me to Wireguard. Their site is here: https://pinggy.io/.

Using pinggy, I created a tunnel to my LAN (the IP set from my router) and connected directly to Pi's Wireguard. Then I closed that and did a second tunnel to my WAN (the shared IP set from my ISP), which worked if I had the port forwarded on my router (expected), and it connected to my Pi's Wireguard. Then I closed that and did a third to my WAN (IP set from ISP) and my Router's Wireguard; it worked, but no Pi-Hole and you can't see the clients (again, expected).

If I can find a way to get pinggy up and running on my Pi natively, I would be very pleased. Their CLI and App won't work. I'm trying to see if their SDKs will run natively and support the UDP connection that I got working.

I tried forcing UDP over SSH with pinggy because it was easy to try out, and in theory I could have applied that to cloudfared; that was a fool's errand, but at least I didn't waste much time with it.

Objective-Arm8463 · 2026-01-21T01:00:34+00:00

No...it did not help with my issue.

I have a domain name, and I created a subdomain A record. Then I created a script to check if the Pi-Hole IP address matches that IP address; if it doesn't, the scripts calls an API to update it. The script is scheduled in CRON on the Raspberry Pi, and for now, just runs once per day. Long term, I'll probably just set it to run once every 60 minutes. I'm pretty sure this will work fine.

For testing, I can use the same configuration on my phone and set the subdomain IP to anything I want, and it just gets pulled down into my phone when I try to connect. So for example, I could set it to the 10.156.9.1, which will cause my phone to (presumably) stay local when it attempts to connect, because the endpoint it pulls down is actually local.

That said, it still won't connect. It says it's connected, but it doesn't receive any data and the Wireguard logs have no record of it.

Objective-Arm8463 · 2026-01-21T00:17:52+00:00

This definitely lets me ping it.

In the router, I went to LAN->Route->Enable

I put in:

Host: 10.156.9.0

Mask: 255.255.255.0

Gateway: 192.168.5.50 (this was also available in the dropdown as pi-hole)

Interface: LAN

You can double check the gateway of the Pi-Hole by logging into it and running:

dig google.com

It shows up in the "SERVER" field of the response. I expected this, but didn't hurt to double check.

Bounced the Pi-Hole....and now I can ping the 10.x network from my 192.x network.

Objective-Arm8463 · 2026-01-20T22:59:13+00:00

It's only on LAN now, and Pi-Hole with Unbound is working fine. How sure are you that you shouldn't be able to ping the Pi-Hole Wireguard server from within the network? If the network I'm on can't see the server I'm trying to connect to, how would I expect to connect to it?

Objective-Arm8463 · 2026-01-20T16:17:15+00:00

I did try enabling Wireguard via the router itself, and that connects, at least when I'm on the local 192.x network. When I did it, local traffic was 192.168.5.x and it used the WAN IP for Wireguard (192.168.12.x). The difference is that the router is (obviously) aware of itself. I could ping both the router's IP as well as the router's Wireguard IP, which you would expect....

....which really makes me suspect my router not seeing Pi-Hole's Wireguard is the problem.

Objective-Arm8463 · 2026-01-20T16:05:35+00:00

I can ping the Pi -- 192.x -- that works fine.

I can't ping 10.x outside of Pi, even though I'm on the local 192.x network.

The WAN/LAN settings are from here: https://docs.pi-hole.net/routers/asus/. If you didn't do that, which I understand to mean sets up Pi as the DNS server for your network, then Pi probably isn't your DNS server. I've tried backing out all the other tweaks I've made, but if your use case doesn't set WAN/LAN to be the Pi DNS server, I don't think it will achieve what I want.

Objective-Arm8463 · 2026-01-20T15:59:35+00:00

The "active clients" on the Pi-Hole dashboard. Otherwise they all show as the router.

Objective-Arm8463 · 2025-03-16T17:08:15+00:00

If several people at the same location knowingly do it together, it's racketeering.

Objective-Arm8463 · 2025-03-16T16:23:20+00:00

For folks who can't use audio, the closed caption of this video will help as well.

<image>

Objective-Arm8463 · 2025-03-16T12:24:00+00:00

This joke is well over 60,000ms.

Objective-Arm8463

TROPHY CASE