Redirect all traffic from Green to PiHole

[jon]

Hello Sujan - Welcome to the IPFire Community!

When reading through the Community posts you will see that PiHole is not recommended due to security issues. Since the pi-hole filters DNS records, DNSSEC is not possible from the client to the external DNS server (hope I explained this correctly).
See:

Pi-Hole and IPFire, which way round?

I think you should not use pi-hole, because it breaks DNSSEC. You will need to trust your DNS.

Having said that…
What you have proposed above is what I have setup for my GREEN network.

Client (DNS) → PiHole (DNS) → IPFire (DNS) → to external DNS Server

This works fine but as I said it is not secure.

@sujan

how to redirect all traffic to PiHole from all clients?

To force clients to a specific DNS server see:
https://wiki.ipfire.org/configuration/firewall/dns

The below is being testing but has not been released:

Forcing all DNS traffic from the LAN to the firewall

DNS has always been designed to use both UDP and TCP port 53, with UDP being the default, and fall back to using TCP. If --protocol remains undefined, then all port 53 on any protocol will be redirected. The first ACCEPT is to let the firewall know that the mentioned IP can send directly and does not get redirected. The second entry defines the REDIRECT, to the FW (and it decides which DNS to us), instead to the destination DNS the workstation wants to us. What are you asking that I am missi…

Hope this helps,
Jon