Setting internal DNS server with piHole and Tailscale

Make Pi-hole accept DNS requests coming from Tailscale

In Pi-hole go to:

Settings → DNS → Interface settings

Pi-hole normally restricts which interfaces or source networks it answers. Tailscale traffic arrives through the tailscale0 interface, so the default local-only mode can reject it. Pi-hole Documentation

For a first test, select:

Permit all origins

or in recent Pi-hole versions: sudo pihole-FTL --config dns.listeningMode "ALL"

Then: sudo systemctl restart pihole-FTL

This setting is safe only if port 53 is not exposed to the public Internet. Your router should not forward TCP/UDP 53 to the Raspberry Pi. Pi-hole itself warns that ALL can otherwise create an open DNS resolver. Pi-hole Documentation

A more restrictive configuration can be done later.

3. Verify Pi-hole is listening on DNS port 53

On the Pi: sudo ss -lunpt | grep ':53'

You should see Pi-hole listening on port 53, for example: udp UNCONN 0 0 0.0.0.0:53 tcp LISTEN 0 32 0.0.0.0:53

Then find your Tailscale IP again: tailscale ip -4

Suppose it is: 100.88.12.34

4. Configure Tailscale DNS

Open:

Tailscale Admin Console → DNS

Under Nameservers:

Add nameserver → Custom

Enter: 100.88.12.34

Then enable:

Override DNS servers

This is important. It tells tailnet clients to use Pi-hole instead of whatever DNS their current Wi-Fi/mobile network supplies. Tailscale

So your Tailscale DNS page should effectively contain: Nameservers

100.88.12.34 Global nameserver

Override DNS servers: ON

You can leave MagicDNS enabled. MagicDNS and your Pi-hole nameserver can coexist; MagicDNS handles tailnet machine names while your configured nameserver handles normal DNS lookups. Tailscale

5. Check the iPhone Tailscale setting

On the iPhone:

Tailscale → Settings

Make sure:

Use Tailscale DNS settings is enabled.

The exact wording can vary slightly by Tailscale version.

Do not manually configure the iPhone Wi-Fi DNS to 100.88.12.34.

Let Tailscale install its VPN DNS configuration. This is what makes it work on: Home Wi-Fi Other Wi-Fi 4G / 5G hotspots

Tailscale explicitly requires clients to accept the tailnet DNS configuration for the DNS settings configured in the admin console to take effect. Tailscale

6. Test from the iPhone

Disconnect the iPhone from your home Wi-Fi and use 4G/5G. Keep Tailscale connected.

Open Safari and visit several websites.

On the Raspberry Pi run: sudo tcpdump -ni tailscale0 port 53

Then browse on the iPhone.

You should see packets similar to: 100.70.23.14.54321 > 100.88.12.34.53

If you see them, Tailscale routing is working and any remaining problem is Pi-hole configuration.

If you see nothing, the problem is on the Tailscale/iPhone DNS side.

Internet │ │ Upstream DNS e.g. Cloudflare │ ▼ ┌──────────────┐ │ Pi-hole │ │ Raspberry Pi │ │ 100.x.x.x │ └──────▲───────┘ │ DNS :53 Tailscale tunnel │ ┌───────────┴───────────┐ │ │ iPhone Laptop Tailscale Tailscale

In Tailscale: MagicDNS ON Global nameserver Pi-hole 100.x.x.x Override DNS ON

In Pi-hole initially: DNS listening mode ALL