# PiHole - Add KeepAlive on two Pi's
Setting up `keepalived` for dual Pi-holes requires installing the package on both machines, writing a short configuration file on each, and pointing your network/AD DNS forwarder to the shared Virtual IP (VIP).
### Prerequisites & Example Values
Check your network interface name using `ip a` (usually `eth0` for wired or `wlan0` for Wi-Fi).
- **Pi-hole A (Primary):** `192.168.1.10` (Interface: `eth0`)
- **Pi-hole B (Secondary):** `192.168.1.11` (Interface: `eth0`)
- **Shared Virtual IP (VIP):** `192.168.1.99` (Choose an unused static IP outside your DHCP range)
### Step 1: Install `keepalived` on Both Pi-holes
Run the following commands on **both** Pi-hole servers:
```
sudo apt update
sudo apt install -y keepalived
```
Allow the Linux kernel to bind to non-local IP addresses (needed so Pi-hole can bind to the VIP even when it's not the active master):
```
echo "net.ipv4.ip_nonlocal_bind=1" | sudo tee -a /etc/sysctl.d/99-keepalived.conf
sudo sysctl --system
```
### Step 2: Configure Pi-hole A (Primary / MASTER)
Create the configuration file on **Pi-hole A**:
```
sudo nano /etc/keepalived/keepalived.conf
```
Paste the following configuration:
```
vrrp_script check_pihole {
# Verify Pi-hole DNS service is answering queries locally
script "dig +short +time=1 +tries=1 @127.0.0.1 google.com > /dev/null 2>&1"
interval 2
weight -20
}
vrrp_instance VI_PIHOLE {
state MASTER
interface eth0 # Replace with your interface if different (e.g., wlan0)
virtual_router_id 51 # Must be identical on both Pis (1-255)
priority 100 # Higher priority = primary holder of VIP
advert_int 1
authentication {
auth_type PASS
auth_pass SecretPass123 # Must match on both Pis (max 8 chars)
}
virtual_ipaddress {
192.168.1.99/24 # Your shared VIP
}
track_script {
check_pihole
}
}
```
Save and exit (`Ctrl+O`, `Enter`, `Ctrl+X`).
### Step 3: Configure Pi-hole B (Secondary / BACKUP)
Create the configuration file on **Pi-hole B**:
```
sudo nano /etc/keepalived/keepalived.conf
```
Paste the following configuration:
```
vrrp_script check_pihole {
script "dig +short +time=1 +tries=1 @127.0.0.1 google.com > /dev/null 2>&1"
interval 2
weight -20
}
vrrp_instance VI_PIHOLE {
state BACKUP
interface eth0 # Replace with your interface if different
virtual_router_id 51 # Must match Pi-hole A
priority 90 # Lower priority than Master
advert_int 1
authentication {
auth_type PASS
auth_pass SecretPass123 # Must match Pi-hole A
}
virtual_ipaddress {
192.168.1.99/24 # Same shared VIP
}
track_script {
check_pihole
}
}
```
Save and exit (`Ctrl+O`, `Enter`, `Ctrl+X`).
### Step 4: Start and Enable the Services
Run these commands on **both** Pi-holes:
```
sudo systemctl enable keepalived
sudo systemctl restart keepalived
```
### Step 5: Verify Failover Operation
1. **Check which Pi holds the VIP:** On **Pi-hole A**, run:
```
ip a show eth0
```
You should see `inet 192.168.1.99/24` listed as a secondary IP on the interface.
2. **Test Failover:**
- Stop the service on Pi-hole A:
```
sudo systemctl stop keepalived
```
- Run `ip a show eth0` on **Pi-hole B** — `192.168.1.99` will immediately appear on Pi-hole B.
- Start `keepalived` back up on Pi-hole A:
```
sudo systemctl start keepalived
```
- Pi-hole A will reclaim the VIP because its priority (`100`) is higher than Pi-hole B's (`90`).
3. **Update Upstream Settings:** Set the DNS forwarder address on your Active Directory DNS server, Synology NAS, or pfSense/DHCP scope to point strictly to the Virtual IP (**`192.168.1.99`**).