I've got a modest homelab setup: a couple computers and a server with the pfsense router pointing all DNS queries to my pi hole on a Pi Zero W. The server exposes a few services via cloudflare tunnel. It's been working pretty well.

Then I started setting up a server for a friend. It's a big repurposed server board running proxmox and will eventually have a handful of VMs and LXCs, all on a network. It's for his business, so I'm setting up Netbird on it for his half-dozen employees to be able to access it for fileshares and stuff. I'm connecting my Linux desktop, too, so I can do sysadmin for him.

The trouble is that domain name resolution is getting hairy between my pihole and his netbird. Since it's not my network, I can't add my pihole as a DNS resource, but I do need to keep a connection to his network.

Anyone have any wisdom to share as to how to handle this properly and still be able to use my pihole for DNS filtering in my house?

I have no netbird experience, but if it's just like wireguard can you split tunnel instead of full tunnel to your friends network?

I think with a split tunnel you should still be able to access his network and resources?

I haven't come across a way to split tunnel, but it's worth looking into. I'm managing it all by CLI anyway, so maybe there's a command for that.

It’s for his business

Nope. Nope nope nope. You don't want to be the one responsible for anything when he and his employees are having problems, especially at odd hours or when you're not around to fix something.

Depends on if the friend is paying for the service :P

I use Netbird and Pi-Hole, but I don't understand what issues you're having. If you're connected to Netbird, you should be able to use the Netbird DNS names to reach other devices, e.g. fileserver.netbird.cloud

If you set up resources correctly on his netbird network it effectively is a split tunnel. You don't have to route anything through it but his "file shares and stuff".

I have a rather gnarly nested double nat within my house where the homelab is isolated behind it's own separate firewall and have some limited resources on both. It's been perfectly serviceable.

I believe I have a resource of *.whathaveyou.net on the netbird gateway inside the network and no default route. If you do have that default route I believe you can have it as a separate resource and disable it.

Self-hosted netbird is pretty incredible to be honest.

And he is :)

That part has worked fine so far. My trouble seems to be that my desktop is defaulting to netbird for DNS instead of the pihole, so I lose the pihole blocking. I suppose the easiest solution is just to netbird down when I'm not using it so DNS goes back to default.

Ah, understood. It depends on your client OS, e.g. for Linux it should be possible. You just need to configure no nameservers in Netbird: https://docs.netbird.io/manage/dns#default-behavior-no-nameservers-configured

NetBird is based in WireGuard and using split tunneling by default.

Just disable DNS in your client.

https://docs.netbird.io/manage/dns/dns-settings#client-side-dns-control