I had an issue with my Pi-Hole recently where after resolving I found my networks no longer had DNS resolution. After some troubleshooting I found the Unbound process (PI-Hole upstream) was sending DNS resolution requests to the internet over a virtual NIC (192.168.5.1) that was blocked by firewall for sending data over port 53. The only IP that can do this is the physical NIC on 192.168.3.47. I have opened up port 53 traffic on the Virtual interface temporarily. The reason I have these virtual interfaces is there are 2 processees running on the PI to forward UDP/IGMP broadcasts across VLAN's to enable Chromecast/screensharing and DLNA from some of my isolated VLAN's. It's essentially acting as a router for this type of traffic as my router that's managing the VLAN's isn't capabale of doing this. The devices are a NAS on VLAN1, TV's on VLAN5, and mobiles on VLAN 5.
I want to set it so that all internet traffic on the PI goes out always through the physical NIC, 192.168.3.47 so I can revert the firewall changes and all internal traffic stays the same. I've been told best practice would be to modify the routing table somehow but not sure what to do.
Routing Table:
default via 192.168.3.1 dev eth0 src 192.168.3.47 metric 202 <--- physical NIC on VLAN3 - Port 53 traffic is allowed. PI-Hole sits on this IP and returns DNS to all VLANs via Inter-LAN routing with firewalls segregating traffic.
default via 192.168.5.1 dev eth0.5 proto dhcp src 192.168.5.47 metric 204 <--- Virtual NIC for UDP broadcast/Chromecast to isolated VLAN5 - Port 53 traffic is temporarily allowed. TV's and mobiles reside on this LAN.
default via 192.168.1.1 dev eth0.12 proto dhcp src 192.168.1.47 metric 205 <--- Virtual NIC for UDP/Chromecast to isolated VLAN1. NAS with DLNA sits on this subnet with firewalls open to TVs and mobiles on VLAN 5.
192.168.1.0/24 dev eth0.12 proto dhcp scope link src 192.168.1.47 metric 205 <--- VAN1.
192.168.3.0/24 dev eth0 proto dhcp scope link src 192.168.3.47 metric 202 <--- VLAN3
192.168.5.0/24 dev eth0.5 proto dhcp scope link src 192.168.5.47 metric 204 <---VLAN5.
Assuming I need to add a default route for all traffic through 192.168.3.47 interface.
Then specify LAN scope for VLAN3/VLAN5 for LAN ranges only, negating internet traffic. I don't think this would affect the UDP/IGMP broadcasting. This should force all internet traffic to go through the 192.168.3.47 interface? Please can I get some advise on what needs to be modified here and how/why.
Any help much appreciated,
Will
