Skip to main content
RunBook Academy

← All break/fix scenarios in Proxmox VE

beginnerNetworking~10 min

DNS resolution from VMs fails after enabling Pi-hole

Reported symptoms

  • ●VMs cannot resolve DNS names after switching to Pi-hole
  • ●Host still resolves DNS correctly (uses different resolver)
  • ●Some VMs work, some do not (intermittent)
  • ●nslookup from the VM times out

Evidence

  • · cat /etc/resolv.conf on the VM (look for pihole IP)
  • · nslookup example.com <pihole-ip> from the host
  • · tcpdump -ni any port 53 shows no traffic from the VM
  • · pihole -g (gravity update) shows successful blocklist update
Diagnosis and resolutionclick to reveal

Root cause

Common causes: - Pi-hole's IP changed (DHCP lease) and the VM's resolv.conf points to the old IP - Firewall rule blocks port 53 from the VM subnet to Pi-hole - Pi-hole is configured to only listen on a specific interface and the VM traffic comes via a different one - The VM's DHCP lease has the wrong DNS (DHCP server still pushing the old one)

Remediation

1. Confirm Pi-hole is listening: `ss -tlnp | grep :53` Should show 0.0.0.0:53 or specific IP:53 2. Test DNS from Pi-hole host: `dig @127.0.0.1 example.com` If this fails, Pi-hole itself is broken 3. Test from the affected VM: `dig @<pihole-ip> example.com` If this fails, network issue between VM and Pi-hole 4. Check firewall: `iptables -L -n | grep 53` Allow if blocked: `iptables -A INPUT -p udp --dport 53 -j ACCEPT` 5. If Pi-hole moved (IP change): - Update DHCP server's DNS option to the new IP - Renew leases: `dhclient -r && dhclient` inside the VM - Or set static DNS inside the VM's network config 6. If Pi-hole is intentionally on a specific IP, ensure the VM's subnet has a route to that IP.

Verification

- `dig example.com` from the VM returns a valid IP - All VMs on the subnet can resolve DNS - Pi-hole's query log shows requests from the VMs - Web browsing works inside the VMs

Prevention

- Give Pi-hole a static IP (not DHCP) - Use DHCP reservations for the Pi-hole host - Document the Pi-hole IP in a runbook - Configure a secondary DNS as fallback (e.g., 1.1.1.1) so VMs have a backup if Pi-hole is down