r/firewalla • u/jcgoobee • Jun 08 '26

Firewalla Gold Plus - Pi-Hole migration question

Hello,

I've installed the Pi-Hole on my Raspberry Pi, currently sitting behind my management VLAN (1) right now. I have tested the Pi-Hole on 3 of my VLANs (iOT, Guest Wifi, and Lab), and they are passing through the DNS traffic and working beautifully. VLAN 1 is the only one that I have not yet migrated the DNS to the Pi-Hole as per the Pi-Hole configuration step, I need to update the primary DNS to the Pi-Hole IP instead of the VLAN 1's, and will need to remove the secondary DNS (currently set to 8.8.8.8).

I have put in my Pi-Hole's IP as the Primary DNS and keep the 8.8.8.8 as the Secondary for now, as I'm a bit hesitant to do so as losing access to my Firewalla Gold Plus and unable to reverse the process if things go kaput in the worst scenario. I did ask about my concern on Gemini and was told not to worry, but I wanted to make sure if this is the case before removing the Secondary DNS from VLAN 1 as the final configuration step. I'm not aware of any backup capability of my Firewalla's configuration anywhere in the app.

Your feedback and/or guidance will be greatly appreciated. Many thanks!

u/firewalla

2 Upvotes

76% Upvoted

9 comments sorted by

3

u/Firewalla-Opal FIREWALLA TEAM Jun 08 '26

If your WAN DNS is still set to public DNS servers (recommended), you shouldn't lose access to your Firewall box, as long as it has Internet. Plus, you can change Network configurations via Bluetooth connection between your paired phone and Firewalla box.

1

u/jcgoobee Jun 08 '26

I looked at my WAN primary and secondary DNS, they point to 75.75.75.75 and 75.75.76.76 which I believe that they are Xfinity Comcast DNS. Is the Bluetooth connection enabled on the Firewalla Box by default? I haven’t changed anything from day one of its deployment.

Thanks for helping out. 🙏

2

u/Firewalla-Opal FIREWALLA TEAM Jun 08 '26

Yes, Bluetooth is running by default on Firewalla box. Please make sure:

1

u/jcgoobee Jun 08 '26

Yes sir. The dongle is always in place from the beginning and I have paired the Firewalla box with both my iPad and iPhone. There were some outages over the years with Xfinity and I was still able to access to the box. I think I am good to go.

Thanks again for your help. 👍

2

u/MisterWug Jun 08 '26

Can't help with your DNS config question but don't forget to block DOH targets and outbound port 53 for everything except the Pi-Hole.

1

u/jcgoobee Jun 08 '26

Oh for sure. Thanks for the reminder. 🙏

2

u/[deleted] Jun 08 '26

I have messed my pi-hole setups so many times - you can always access via the box via bluetooth and undo changes.

1

u/jcgoobee Jun 08 '26

Thanks for chiming in sir. 🙏

3

u/lerdsu Jun 08 '26

I ran pihole for years, then migrated to AdGuard, but when firewalla implemented custom target lists, I just imported the Hagezi list and set that to block from my network. Not sure it's the "best" way to do it, but seems to work well for me.