The Goal
I needed a way to ensure all my remote devices (laptop, phone) had ad-blocking and secure DNS resolution applied to them, regardless of whether they were on my home network, a coffee shop Wi-Fi, or cellular data.
Architecture & Setup
Instead of opening ports on my public IP, I utilized a mesh VPN approach:
- Host: Proxmox VE node in the homelab.
- Container: Deployed Pi-hole in an unprivileged LXC container (Ubuntu template).
- Networking: Installed Tailscale on the LXC container to assign it a static mesh IP address.
Configuration Steps
Once Tailscale was running in the container, I configured my Tailscale admin console to use the Pi-hole's Tailnet IP as the global nameserver.
# Example command I used to advertise the Pi-hole node
tailscale up --accept-dns=false --advertise-tags=tag:dns
Challenges Encountered
Initially, Pi-hole was dropping queries from the Tailscale interface because it only listens to the local `eth0` interface by default. I resolved this by changing the Pi-hole DNS settings to "Permit all origins", since the LXC container is securely isolated behind the Tailscale network anyway.