LOW
The severity is assessed as LOW because this scenario primarily involves best practices for setting up redundant DNS services rather than addressing a specific vulnerability. The risk lies in potential downtime if the primary AdGuard Home instance fails and failover mechanisms are not properly configured, but there's no inherent exploitability issue.

The scenario described involves setting up two instances of AdGuard Home, one on a Proxmox-hosted Debian LXC container and the other potentially on a Raspberry Pi Zero 2W or Pi 3 for redundancy. The primary concern is ensuring that both instances can be used effectively as DNS servers with minimal disruption to clients in case of failure of the primary server. Using keepalived for high availability could ensure seamless failover between these two AdGuard Home instances. Additionally, integrating Unbound might improve DNS resolution performance and security by providing a secondary caching resolver. The setup must consider network connectivity options such as Ethernet over USB adapter or Wi-Fi on the Pi device to ensure stable operation.

Affected Systems
  • AdGuard Home
  • Debian LXC Container
  • Raspberry Pi Zero 2W/3
Remediation
  • Install AdGuard Home on both the Debian LXC container and the Raspberry Pi device using their respective official installation methods.
  • Configure keepalived on both systems to enable failover between them. Ensure that each system is set up with unique IP addresses for VIP (Virtual IP) in case of failover.
  • Set up Unbound as a secondary DNS resolver on both devices if additional caching and security are desired, configuring it according to best practices for network isolation.
  • Test the failover mechanism by simulating failures in one instance to ensure that clients can seamlessly transition to the backup server without interruption.
Stack Impact

In a homelab setup, this configuration would directly impact DNS resolution reliability. The Debian LXC container and Raspberry Pi devices running AdGuard Home must be properly configured with keepalived for high availability, ensuring network services like DHCP are set up to point clients to these servers correctly.

Source →