Docker容器中的Pihole和Unbound -未绑定不接收请求

Question

我正在尝试在Raspberry pi 3上运行2个Docker容器，一个用于Unbound，另一个用于Pihole。这个想法是Pihole将首先阻止任何请求，然后再使用Unbound作为其DNS服务器。我一直在按照pihole的文档运行，找到了here，并启动了两个容器，pihole也正常工作。但是，在运行docker exec pihole dig pi-hole.net @127.0.0.1 -p 5333或-p 5354时，我得到的响应是

; <<>> DiG 9.10.3-P4-Debian <<>> pi-hole.net @127.0.0.1 -p 5354
;; global options: +cmd
;; connection timed out; no servers could be reached

我推测这可能与pihole容器无法通过localhost与Unbound容器通信有关，因此更新了我的docker-compose以尝试使用netowkr桥纠正此问题。然而，在那之后，我仍然得到相同的错误，无论我尝试什么端口。我是新的Docker和Unbound，所以这是一个深入的研究！我的docker-compose.yml和unbound.conf如下所示。

docker-compose.yml

version: "3.7"

services:
  unbound:
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN
    container_name: unbound
    image: masnathan/unbound-arm
    ports:
      - 8953:8953/tcp
      - 5354:53/udp
      - 5354:53/tcp
      - 5333:5333/udp
      - 5333:5333/tcp
    volumes:
      - ./config/unbound.conf:/etc/unbound/unbound.conf
      - ./config/root.hints:/var/unbound/etc/root.hints
    restart: always
    networks:
      - unbound-pihole
  pihole:
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN
    container_name: pihole
    image: pihole/pihole:latest
    ports:
      - 53:53/udp
      - 53:53/tcp
      - 67:67/udp
      - 80:80
      - 443:443
    volumes:
      - ./config/pihole/:/etc/pihole/
    environment:
      - ServerIP=10.0.0.20
      - TZ=UTC
      - WEBPASSWORD=random
      - DNS1=127.0.0.1#5333
      - DNS2=no
    restart: always 
    networks:
      - unbound-pihole

networks:
  unbound-pihole:
    driver: bridge

unbound.conf

server:
# If no logfile is specified, syslog is used
# logfile: "/var/log/unbound/unbound.log"
verbosity: 0

port: 5333
do-ip4: yes
do-udp: yes
do-tcp: yes

# May be set to yes if you have IPv6 connectivity
do-ip6: no

# Use this only when you downloaded the list of primary root servers!
root-hints: "/var/unbound/etc/root.hints"

# Trust glue only if it is within the servers authority
harden-glue: yes

# Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
harden-dnssec-stripped: yes

# Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
# see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
use-caps-for-id: no

# Reduce EDNS reassembly buffer size.
# Suggested by the unbound man page to reduce fragmentation reassembly problems
edns-buffer-size: 1472

# TTL bounds for cache
cache-min-ttl: 3600
cache-max-ttl: 86400

# Perform prefetching of close to expired message cache entries
# This only applies to domains that have been frequently queried
prefetch: yes

# One thread should be sufficient, can be increased on beefy machines
num-threads: 1

# Ensure kernel buffer is large enough to not loose messages in traffic spikes
so-rcvbuf: 1m

# Ensure privacy of local IP ranges
private-address: 192.168.0.0/16
private-address: 169.254.0.0/16
private-address: 172.16.0.0/12
private-address: 10.0.0.0/8
private-address: fd00::/8
private-address: fe80::/10

谢谢!

Answer 1

从access-control section下的docs https://nlnetlabs.nl/documentation/unbound/unbound.conf/

  By default only localhost is allowed, the rest is refused.   The
  is  refused, because that is protocol-friendly. The DNS
  protocol is not designed to handle dropped packets due  to  pol-
  icy,  and  dropping  may  result in (possibly excessive) retried
  queries.

默认情况下，未绑定的服务器仅侦听来自localhost的连接。在这种情况下，对DNS服务器的请求可以允许从运行未绑定的docker容器内部接受。

因此，要允许通过docker-compose中的unbound解析DNS，请将以下内容添加到unbound.conf

server:
   access-control: 0.0.0.0/0 allow