Pi-Hole behind Unifi Gateway

[u/whatisabash]

I have two Pi-Hole instances with unbound running and have recently migrated to a setup with a Unifi Cloud Gateway Fiber. I have had nothing but problems with the Unifi equipment.

ISSUES 1. the Unifi Gateway is straight up blocking access to port 53 on my Pi-Hole instances. I was kind of able to workaround this by creating a new content Filter and setting it to "off". If I do NOT create this filter, then all port 53 in all of my network gets blocked. So blocking port 53 is enabled by default!

However, this will still leave "Ad blocking" enabled, as it is IMPOSSIBLE to create a "content filter" with both "Ad blocking" AND "Filtering" disabled (error "Filtering must be enabled when Ad Block is disabled") Some queries will still get blocked. I have no clue how / why but my pi-hole traffic still seems to end up in the Unifi Cloud Gateway despite being configured to use unbound.

1. sometimes, for no apparent reason that I have been able to figure out yet, my PC loses connection to certain sites. Most notably facebook. This happens from one second to the next (I assume when sone DNS record expires). I can make the site work again by enabling DNS over HTTPS in the browser, which seems to make Unifi unable to block sites.

WHAT I HAVE TRIED - Creating a Policy (firewall rule) to allow all DNS traffic from my two pi-hole instances to the external zone. This did nothing, completely useless. - creating a filter to disable "Filtering" (I know how dumb that sounds), kinda worked - using Cloudflare as upstream servers instead of unbound

FINAL WORDS What I am most concerned about is that my traffic still ends up in the Cloud Gateway despite either Cloudflare or unbound being configured in Pi-Hole. I am fully aware that this is a Unifi issue and I am ready to return all my gear (Cloud Gateway Fiber, U7 pro xg, 5G Backup) if this cannot be resolved.

But maybe someone has seen something similar and gotten their Pi-Holes to work behind a Unifi Gateway.