AdguardHome installation fails with 'CNI network "dns" not found'

[lidnele]

Hi,

I've attempted to follow the guide located here: https://github.com/unifi-utilities/unifios-utilities/tree/main/AdguardHome on a UDMPro, but without much success.

It seems to ALMOST do as expected, except the "dns" network is never created and I don't know why. I'm sure it's obvious.

This is what I've done (I've tried it some times, so at the top I'm just showing that the "half done" installations have been undone):

Welcome to UbiOS

# podman container rm adguardhome
Error: no container with name or ID adguardhome found: no such container
# podman network rm dns -f
Error: unable to find network configuration for dns
# ip link delete br2.mac
Cannot find device "br2.mac"
# more /mnt/data/on_boot.d/10-dns.sh 
#!/bin/sh

## configuration variables:
VLAN=2
IPV4_IP="10.0.5.3"
# This is the IP address of the container. You may want to set it to match
# your own network structure such as 192.168.5.3 or similar.
IPV4_GW="10.0.5.1/24"
# As above, this should match the gateway of the VLAN for the container
# network as above which is usually the .1/24 range of the IPV4_IP

# if you want IPv6 support, generate a ULA, select an IP for the dns server
# and an appropriate gateway address on the same /64 network. Make sure that
# the 20-dns.conflist is updated appropriately. It will need the IP and GW
# added along with a ::/0 route. Also make sure that additional --dns options
# are passed to podman with your IPv6 DNS IPs when deploying the container for
# the first time. You will also need to configure your VLAN to have a static
# IPv6 block.

# IPv6 Also works with Prefix Delegation from your provider. The gateway is the
# IP of br(VLAN) and you can pick any ip address within that subnet that dhcpv6
# isn't serving
IPV6_IP=""
IPV6_GW=""

# set this to the interface(s) on which you want DNS TCP/UDP port 53 traffic
# re-routed through the DNS container. separate interfaces with spaces.
# e.g. "br0" or "br0 br1" etc.
FORCED_INTFC="br2"

# container name; e.g. nextdns, pihole, adguardhome, etc.
CONTAINER=adguardhome

if ! test -f /opt/cni/bin/macvlan; then
    echo "Error: CNI plugins not found. You can install it with the following command:" >&2
    echo "       curl -fsSLo /mnt/data/on_boot.d/05-install-cni-plugins.sh https://raw.githubusercontent.com/unifi-utilities/unifios-utilities/main/cni-plugins/05-install-cni-plugins.sh && /bin/sh /mnt/data/on_boot.d/05-install-cni-plugins.sh" >&2
    exit 1
fi

# set VLAN bridge promiscuous
ip link set "br${VLAN}" promisc on

# create macvlan bridge and add IPv4 IP
ip link add "br${VLAN}.mac" link "br${VLAN}" type macvlan mode bridge
ip addr add "${IPV4_GW}" dev "br${VLAN}.mac" noprefixroute

# (optional) add IPv6 IP to VLAN bridge macvlan bridge
if [ -n "${IPV6_GW}" ]; then
  ip -6 addr add "${IPV6_GW}" dev "br${VLAN}.mac" noprefixroute
fi

# set macvlan bridge promiscuous and bring it up
ip link set "br${VLAN}.mac" promisc on
ip link set "br${VLAN}.mac" up

# add IPv4 route to DNS container
ip route add "${IPV4_IP}/32" dev "br${VLAN}.mac"

# (optional) add IPv6 route to DNS container
if [ -n "${IPV6_IP}" ]; then
  ip -6 route add "${IPV6_IP}/128" dev "br${VLAN}.mac"
fi

# Make DNSMasq listen to the container network for split horizon or conditional forwarding
if ! grep -qxF "interface=br${VLAN}.mac" /run/dnsmasq.conf.d/custom.conf; then
    echo "interface=br${VLAN}.mac" >> /run/dnsmasq.conf.d/custom.conf
    kill -9 "$(cat /run/dnsmasq.pid)"
fi

if podman container exists "${CONTAINER}"; then
  podman start "${CONTAINER}"
else
  logger -s -t podman-dns -p "ERROR Container ${CONTAINER} not found, make sure you set the proper name, you can ignore this error if it is your first time setting it up"
fi

# (optional) IPv4 force DNS (TCP/UDP 53) through DNS container
for intfc in ${FORCED_INTFC}; do
  if [ -d "/sys/class/net/${intfc}" ]; then
    for proto in udp tcp; do
      prerouting_rule="PREROUTING -i ${intfc} -p ${proto} ! -s ${IPV4_IP} ! -d ${IPV4_IP} --dport 53 -j LOG --log-prefix [DNAT-${intfc}-${proto}]"
      iptables -t nat -C ${prerouting_rule} 2>/dev/null || iptables -t nat -A ${prerouting_rule}
      prerouting_rule="PREROUTING -i ${intfc} -p ${proto} ! -s ${IPV4_IP} ! -d ${IPV4_IP} --dport 53 -j DNAT --to ${IPV4_IP}"
      iptables -t nat -C ${prerouting_rule} 2>/dev/null || iptables -t nat -A ${prerouting_rule}

      # (optional) IPv6 force DNS (TCP/UDP 53) through DNS container
      if [ -n "${IPV6_IP}" ]; then
        prerouting_rule="PREROUTING -i ${intfc} -p ${proto} ! -s ${IPV6_IP} ! -d ${IPV6_IP} --dport 53 -j LOG --log-prefix [DNAT-${intfc}-${proto}]"
        ip6tables -t nat -C ${prerouting_rule} 2>/dev/null || ip6tables -t nat -A ${prerouting_rule}
        prerouting_rule="PREROUTING -i ${intfc} -p ${proto} ! -s ${IPV6_IP} ! -d ${IPV6_IP} --dport 53 -j DNAT --to ${IPV6_IP}"
        ip6tables -t nat -C ${prerouting_rule} 2>/dev/null || ip6tables -t nat -A ${prerouting_rule}
      fi
    done
  fi
done
# more /mnt/data/podman/cni/20-dns.conflist 
{
  "cniVersion": "0.4.0",
  "name": "dns",
  "plugins": [
    {
      "type": "macvlan",
      "mode": "bridge",
      "master": "br2",
      "mac": "00:1c:b4:04:2a:01",
      "ipam": {
        "type": "static",
        "addresses": [
          {
            "address": "10.0.5.3/24",
            "gateway": "10.0.5.1"
          }
        ],
        "routes": [
          {"dst": "0.0.0.0/0"}
        ]
      }
    }
  ]
}
# netstat -r
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
10.0.0.0        *               255.255.255.0   U         0 0          0 br0
10.0.3.0        *               255.255.255.0   U         0 0          0 br3
10.0.4.0        *               255.255.255.0   U         0 0          0 br4
10.0.5.0        *               255.255.255.0   U         0 0          0 br2
<censored>   *               255.255.255.224 U         0 0          0 eth8
# /mnt/data/on_boot.d/10-dns.sh 
logger: unknown priority name: ERROR Container adguardhome not found, make sure you set the proper name, you can ignore this error if it is your first time setting it up
# netstat -r
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
10.0.0.0        *               255.255.255.0   U         0 0          0 br0
10.0.3.0        *               255.255.255.0   U         0 0          0 br3
10.0.4.0        *               255.255.255.0   U         0 0          0 br4
10.0.5.0        *               255.255.255.0   U         0 0          0 br2
10.0.5.3        *               255.255.255.255 UH        0 0          0 br2.mac
<censored>   *               255.255.255.224 U         0 0          0 eth8
# podman run -d --network dns --restart always  \
>     --name adguardhome \
>     -v "/mnt/data/AdguardHome-Confdir/:/opt/adguardhome/conf/" \
>     -v "/mnt/data/AdguardHome-Workdir/:/opt/adguardhome/work/" \
>     --dns=127.0.0.1 --dns=1.1.1.1 \
>     --hostname adguardhome \
>     adguard/adguardhome:latest
ERRO[0000] CNI network "dns" not found                  
Error: error configuring network namespace for container 80b778088586e7845098495a6e853c7fa4c2592b96552226f1456304d3c59cb0: CNI network "dns" not found
# podman network ls
NAME     VERSION   PLUGINS
podman   0.4.0     bridge,portmap
# 

[boostchicken]

You didnt put a network .conflist in the right directory and give it the name of "dns"

[SSJPKXL]

Can someone guide me a bit on how to do this? I already run headless Raspberry Pi as local DNS server with AdGuard Home and I am familiar with it, but I want to migrate it to UDM. I do not use Docker on Raspberry Pi. I just use the CURL command AdGuard Home team posted on GitHub. I am not familiar with containers, MacVLAN's, and such.

When reading UDM AdGuard Home guide, I get stuck at step 8. Am I supposed to run a command at that point? How do I get actual AdGuard Home onto UDM? On Raspberry Pi, files are downloaded with CURL command directly to /opt/AdGuardHome and then AdGuard Home SystemD service is started.

Some other quesitons:

• Am I supposed to create a full Corporate Network on UDM for AdGuard Home or can I create a VLAN-only network? All my VLAN's are port-based and as such are untagged.
• Which interfaces does MacVLAN bridge? I prefer everything to be routed, not bridged...
• Does MacVLAN interface accept custom IPTables? EBTables?

[SamErde]

Start with the instructions for setting up UniFi-utilities, then follow the next readme for installing AdGuard Home.

https://github.com/unifi-utilities/unifios-utilities/blob/main/on-boot-script/README.md

[SSJPKXL]

I already have UDM utilities and CNI and on-boot scripts. How do I get actual AdGuard Home files into UDM Podman??? The guide does not explain that. It says:
...
7. Execute /data/on_boot.d/10-dns.sh
8. Run the AdguardHome docker container
...

How can I run AdGuard Home Docker container without any AdGuard Home files? Where do I get them? Do I run some specific command after step 7?

[SamErde]

Step 8 includes the commands that you need to run. after you create those two folders, the podman run command provided will pull the container image and start it.

mkdir /data/AdguardHome-Confdir
mkdir /data/AdguardHome-Workdir

podman run -d --network dns --restart always  \
    --name adguardhome \
    -v "/data/AdguardHome-Confdir/:/opt/adguardhome/conf/" \
    -v "/data/AdguardHome-Workdir/:/opt/adguardhome/work/" \
    --dns=127.0.0.1 --dns=1.1.1.1 \
    --hostname adguardhome \
    adguard/adguardhome:latest

[SSJPKXL]

Step 8 includes the commands that you need to run. after you create those two folders, the podman run command provided will pull the container image and start it.

mkdir /data/AdguardHome-Confdir
mkdir /data/AdguardHome-Workdir

podman run -d --network dns --restart always  \
    --name adguardhome \
    -v "/data/AdguardHome-Confdir/:/opt/adguardhome/conf/" \
    -v "/data/AdguardHome-Workdir/:/opt/adguardhome/work/" \
    --dns=127.0.0.1 --dns=1.1.1.1 \
    --hostname adguardhome \
    adguard/adguardhome:latest

Thank you! Which version of AdGuard Home does it pull? Where can I see the actual link? I may want to use the latest Edge release instead of Stable release.

[dominictayloruk]

No working macvlan module for 2.4 - 2.5 so the DNS network never gets fully created.

See here https://github.com/whi-tw/macvlan-unifios

[SSJPKXL]

No working macvlan module for 2.4 - 2.5 so the DNS network never gets fully created.

See here https://github.com/whi-tw/macvlan-unifios

MacVLAN UniFi OS 1.4.0 lists UDM firmware "2.4.27" as supported. Does it not support 2.5.X as well?

[dominictayloruk]

Doesn't load correctly, assume the module is corrupted at build.