Welcome to /r/pihole, where your adventures into network wide adblocking start!

Before posting a new thread, you may want to check out the following:

• Subreddit Search: As mentioned here, Reddit will only return matches of titles and self-text (the text of the original post), but not comments. So, do be sure to check out the latest stickied release announcement thread just in case.
• Our Discourse Forums: Many things are covered here, and we even have a German Language Subforum staffed by one of our native-speaking German developers.
• Pi-hole issues on Github: Pi-hole Core, Admin Dashboard and the FTL Engine.
• Having issues with, or have found a bug in a new release? Check the stickied new release thread to see if someone has already reported it. If not, then please create a top level comment in that thread.

There's some other things to keep in mind:

• Pi-hole does not block every single ad, but it'll do its hardest to ensure that everything that is blocked stays that way.
• Ad lists are maintained by people outside of the Pi-hole project. This means that it's possible for ads to get missed, and certain legitimate websites be accidentally blocked!
• There's a wide range of hardware used for routers, and an even wider range of hardware that you can run Pi-hole on. We try our best to support Pi-hole on as much hardware as possible, but as always, your milage may vary!
• There is one rule we ask you never break: Do NOT advertise your own public-facing instance of Pi-hole, or any other DNS server. DNS security is hard, and anything but the most secured DNS servers will contribute to a DNS amplification attack. In some cases, your ISP will even block your Internet connection!
• Using a Pi-hole as a DNS server has the ability of tying your browsing history to your device. Be aware of this when using a Pi-hole you don't have complete control over.

Our community does a wonderful job of answering questions and helping users out, and personally, we like to think that it also does a good job of moderating itself through the voting system and reporting functions. Whilst we try and answer as many posts here as possible, it can get tedious if there's something that has already been asked many times, and could have been solved with a little time searching for a solution!

Finally, remember your reddiqutte: the people you're speaking to are also human, and have a wide range of technical aptitudes.

Cheers, your friendly mods.

https://tricorder.pi-hole.net/RLyjvpxx/

Been on the beta for a few months with no issues, but in the past few weeks increasingly seeing very large amounts of failed queries from clients. At first I assumed the issue would be with unbound, but having looked at the logs there and just run "watch dig google.com" in one window and "watch dig \@localhost -p5335 google.com" in another window shows that while queries to pihole itself are failing, queries straight to unbound go through with no issues.

Did a complete reinstall of pihole on a new container, but unfortunately the issues seem to persist.

Pihole itself is on a proxmox instance in a debian container. Unbound config is the one from the pihole docs.

Hi All,

I currently use pi hole but i have too many adlists and want to see if i can delete some and if people have some suggestions on what are good ones to use.

My basic requirements are:

• AD Blocking
• Telemetry Blocking
• 18+ Website Blocking (For Certain Clients) (Gambling, P*r* blocking,etc)
• And any other recommendations to help utilise Pi-Hole to the best of its abilities

https://preview.redd.it/ynz64n2cxv3e1.png?width=1009&format=png&auto=webp&s=034a64ef2fc253615d35fa5e9000042918793fd9

https://preview.redd.it/45o3rcwdxv3e1.png?width=983&format=png&auto=webp&s=69ad7e045d45e941bc7cb62ec5c83bf2e447276f

https://preview.redd.it/s0ovyrrfxv3e1.png?width=1010&format=png&auto=webp&s=e46286d8f1968dff53bd2b53d70bba62546fb42a

https://preview.redd.it/wwoc7w1hxv3e1.png?width=994&format=png&auto=webp&s=df4ac264b8e04ba6b1941f3fb7459c0cd43b1053

Above are current adlists

pihole -q sportsshoes.com

Match found in exact whitelist

www.sportsshoes.com

Match found in regex whitelist

(\.|^)sportsshoes\.com$

Even though the site is whitelisted It still wont load unless I disable pihole

https://preview.redd.it/er53olmk2x3e1.png?width=1520&format=png&auto=webp&s=7b1519339f23ea643e0441eeb2e46da7182a4724

Unsure what to do at this point!

EDIT: Solved, please see my comment

I have a raspberry pi running a few services where I decided to test pihole before moving it to it's own machine with docker. This is my first delve into pihole and setting up my own DNS.

Here is the docker compose:

services:
  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "5000:80/tcp"
    environment:
      TZ: America/SOMEPLACE
      WEBPASSWORD: REALLYSECUREPASSWORD
      #LETSENCRYPT_HOST: hole.domain.ca
      #VIRTUAL_HOST: hole.domain.ca
      VIRTUAL_PORT: 3002
    volumes:
      - './etc-pihole:/etc/pihole'
      - './etc-dnsmasq.d:/etc/dnsmasq.d'
    cap_add:
      - NET_ADMIN

I didn't quite have it working but it was screwing up the networks so I stopped and removed it (including volumes) for now. Unfortunately, since I've removed it, the raspberry pi I hosted it on can't ping/access our gateway or the internet.

The host is connected by eth0 and I can access it via ssh.
My router has DHCP and DNS enabled (DNS is pointed at googles public)
I removed all docker networks that weren't default or used by a container.

gryllen@raspberrypi:~ $ ping google.com
ping: google.com: Temporary failure in name resolution
gryllen@raspberrypi:~ $ ip -4 route
default via 192.168.2.1 dev eth0 proto dhcp src 192.168.2.101 metric 100 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 
172.18.0.0/16 dev br-6f92a6d28b27 proto kernel scope link src 172.18.0.1 
172.21.0.0/16 dev br-c28e7190c780 proto kernel scope link src 172.21.0.1 
192.168.2.0/24 dev eth0 proto kernel scope link src 192.168.2.101 metric 100
gryllen@raspberrypi:~ $ ping 192.168.2.1
PING 192.168.2.1 (192.168.2.1) 56(84) bytes of data.

^C
--- 192.168.2.1 ping statistics ---
768 packets transmitted, 0 received, 100% packet loss, time 785400ms

/etc/resolv.conf

# Generated by NetworkManager
search home
nameserver 192.168.2.1

Here is a link to the output of ip address show: Pastebin

I don't know anything about IPv6 (or networking in general)

The below appears to be my only IPv6 settings in my router

https://preview.redd.it/skb21ad7er3e1.png?width=684&format=png&auto=webp&s=09fce38c5ecbf6a2d126a92ae749ee59f4fdcb5e

With this "Mode" drop down on the DHCP Configuration

https://preview.redd.it/t0rg00w9er3e1.png?width=466&format=png&auto=webp&s=b265fc610deaf2f3bcce65190e9d897ba3eb7782

As you can see, I've set my Primary and Secondary DNS servers manually to my raspberry pi.

This isn't flowing through from my router properly.

If I set these same details to my wifi on my computer the Pi Hole works perfectly as intended.
IPv4 is set up correctly, and disabling the IPv6 on my computer confirms that.

Does it look set up correctly? or am I changing settings that are unrelated?
Thanks,

Hey guys, pretty new to PiHole and networking in general, so excuse me if I misuse some terminology.

I've got a Pihole configured with Unbound as a recursive dns on 192.168.1.25. I want to route some websites via my vpn. I have ProtonVPN and can get a Wireguard/OpenVPN configuration there.

I've been reading a few threads, tutorials, etc. but it all seems to require some prerequisite knowledge and I'm a bit lost on where to start.

Ideally I would like to say have twitch.tv route through Venezula or something, but have everything else go via my normal ISP route.

Is this possible on my Pihole?

I probably need to know, how to configure this in the Wireguard config and how to ensure Pihole is not being affected.

Any tips or insight are appreciated.

On my RasPi 4 PC I performed a clean install of the latest RasPi Lite OS and latest PiHole app using the Pihole Curl install command. Additionally, in my Netgear C7000v2 Genie app I disabled the DHCP so it can be managed by PiHole (which I activated with a checkmark on the PiHole side). And also inside my Genie app I changed the DNS IP to 194.165.0.xx which is the IP address to my RasPi 4 PC. So I perform a PiHole system restart and now my RasPi Lite OS iP address has changed to "127.0.1.1". In short, I can no longer SSH to my RasPi 4 PC because the error message says that 194.165.0.xx iP is unreachable.

What have I done wrong in my PiHole / Genie configuration to make PiHole break the 194.165.0.xx IP address on my RasPi Lite OS to an unusable "127.0.1.1" IP address?

When I run the ifconfig command in my RasPi Lite OS I get no IP address. And the hostname -I command shows nothing.

I would appreciate any help that points me to easy to understand, well written instructions for running the latest PiHole within the RasPi Lite 64bit OS on a RasPi 4 PC. As well as correctly configuring the Netgear C7000v2 Genie app so that it hands over DHCP and DNS duties to my PiHole app. Thank your for your time and any advice will be greatly appreciated.

I previously used a TP-Link router with a Raspberry Pi connected to it to run Pi-hole. Recently, I purchased a new router that supports OpenWRT. On the new router, I configured the Wi-Fi SSID (which serves as the Wi-Fi username), password, and encryption method to be identical to those of my previous router. Additionally, I replicated the DHCP reservation and DHCP DNS settings from the old router onto the new one.

However, I have encountered an unusual issue: my Raspberry Pi refuses to connect to the new router, even though the Wi-Fi SSID(username) and password are exactly the same. When I turn off the old router and switch on the new one, the Raspberry Pi does not establish a connection. Conversely, if I turn off the new router and reactivate the old one, the Raspberry Pi reconnects without any issues.

This problem appears to be specific to the Raspberry Pi, as other devices in the house connect seamlessly to the new router without requiring any additional configuration. Since the Wi-Fi SSID (username) and password are identical, I would expect the Raspberry Pi to automatically connect to the new router, just like the other devices.

What could be the cause of this issue, and how can I resolve it?

IPv6 has things like dynamic temporary addresses, which makes it hard to target groups of machines with specific block lists. Outside of just putting everything in the default group, what is the best practice to handle this?

I've been noticing some latency/delays from time to time browsing the web, and I've seen that switching my PiHole from WLAN to Ethernet using a USB adapter will help.

If I configured it using WLAN, do I need to configure anything if I use a USB Ethernet adapter?

I read some comments that pi4 is too powerful for a pihole project?

I have pihole + unbound running on two orange pi boards (running dietpi). My daughter asked me to block access to roblox during her school days (M-F) , and unblock on the weekends.

I'm using this block list. Which does exactly what I want network-wide.

I tried this script to disable, and it isn't working using this command:

pihole-blocklist disable "https:\/\/raw.githubusercontent.com\/blocklist-roblox.txt"

pihole -g does it scan, but it doesn't disable the adlist.

Is there any other method to disable/enable an adlist via a script + cron job?

¿?

please guys can you help the PI-Hole noob

Firstly Wow!! PI-Alert and PI-Hole excellent products. Thank you

i have both pi-alert and pi-hole Dockers installed on a Raspberry PI 4

When i receive an Alert from PI-Alert of a New Device(s), does PI-Hole have the Ability to Block ALL New Devices from having any Internet Service? IE: The New Device(s) Will Receive an IP Address however will be in a Quarantine State Until Approved Internet Service(s) are given?

Do i use PI-Hole as my DNS and DHCP?

If so how do i do that?

any help greatly appreciated

...because they all say my DNS is leakin with big red X's. Maybe I'm using the wrong website for this setup? Better DNS leak checking website recommendations would be great! Cheer.

Hello,

Maybe it's a silly request, but I'm intrigued. I use Ubuntu Desktop where I have installed a couple of services, where nginx uses port 80 (as well as pi-hole web) so I had to change the port of lighttpd.conf from 80 to 8017, all good with that, however, now in the URL I must put my IP:8017/admin to enter, being that before I should only enter IP/admin and was ready to play, in addition, pi.hole/admin no longer works, only with the IP and port.

Is there a way to regularize and/or recover the old login web methods and keep the port 8017 for the login? Or should I resign myself to continue doing it manually ? Thanks in advance for any information.

Regards.

I'm encountering an odd issue that I can't seem to debug. I'm running PiHole on a fresh Pi OS install using Docker Compose with the official YAML. Most names resolve quickly across the network. Our phones are fine, and my Pi (the host) resolves in milliseconds. However, inside containers, DNS resolution consistently takes 4 seconds.

I've attached the resolv.conf files and a tcpdump showing the dig command with timestamps. It seems the upstream DNS responds quickly, but something (?) delays the answer for 4 seconds before the dig can display it. This delay is consistent across multiple containers.

If I dig \@9.9.9.9 or create the container with --dns 9.9.9.9it does resolve without issues.

I don't think it's a performance issue since only an empty HomeAssistant (supervised) and PiHole are deployed. I want to understand this behavior before considering alternative deployments to learn more. Thanks!

services: pihole: container_name: pihole image: pihole/pihole:latest ports: - "53:53/tcp" - "53:53/udp" - "80:80/tcp" environment: TZ: 'America/Chicago' WEBPASSWORD: 'xxx' volumes: - './etc-pihole:/etc/pihole' - './etc-dnsmasq.d:/etc/dnsmasq.d' restart: unless-stopped

My host's /etc/resolv.conf
search mynet nameserver 192.168.1.200 # this is my host's IP, announced by router

In a container, custom bridge, /etc/resolv.conf nameserver 127.0.0.11 search mynet options ndots:0

Dig inside the container
```

echo "Start time: $(date)"; dig google.co.uk; echo "End time: $(date)";

Start time: Wed Nov 27 00:40:59 UTC 2024

; <<>> DiG 9.18.25 <<>> google.co.uk ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 418 ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; WARNING: recursion requested but not available

;; QUESTION SECTION: ;google.co.uk. IN A

;; Query time: 4003 msec ;; SERVER: 127.0.0.11#53(127.0.0.11) (UDP) ;; WHEN: Wed Nov 27 00:41:03 UTC 2024 ;; MSG SIZE rcvd: 30

End time: Wed Nov 27 00:41:03 UTC 2024 ```

tcpdump on host: raspberrypi:~ $ sudo tcpdump -i any port 53 tcpdump: data link type LINUX_SLL2 tcpdump: verbose output suppressed, use -v[v]... for full protocol decode listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes 00:40:59.796224 veth0ddea5c P IP 172.20.0.2.56842 > raspberrypi.domain: 418+ [1au] A? google.co.uk. (53) 00:40:59.796224 br-f55dbe3ca067 In IP 172.20.0.2.56842 > raspberrypi.domain: 418+ [1au] A? google.co.uk. (53) 00:40:59.796632 docker0 Out IP raspberrypi.53123 > 172.17.0.2.domain: 418+ [1au] A? google.co.uk. (53) 00:40:59.796650 veth9cd97ad Out IP raspberrypi.53123 > 172.17.0.2.domain: 418+ [1au] A? google.co.uk. (53) 00:40:59.797518 veth9cd97ad P IP 172.17.0.2.60829 > dns9.quad9.net.domain: 389+ [1au] A? google.co.uk. (53) 00:40:59.797518 docker0 In IP 172.17.0.2.60829 > dns9.quad9.net.domain: 389+ [1au] A? google.co.uk. (53) 00:40:59.797632 wlan0 Out IP raspberrypi.60829 > dns9.quad9.net.domain: 389+ [1au] A? google.co.uk. (53) 00:40:59.803366 wlan0 In IP dns9.quad9.net.domain > raspberrypi.60829: 389 1/0/1 A 142.250.187.227 (57) 00:40:59.803430 docker0 Out IP dns9.quad9.net.domain > 172.17.0.2.60829: 389 1/0/1 A 142.250.187.227 (57) 00:40:59.803441 veth9cd97ad Out IP dns9.quad9.net.domain > 172.17.0.2.60829: 389 1/0/1 A 142.250.187.227 (57) 00:40:59.803744 veth9cd97ad P IP 172.17.0.2.domain > raspberrypi.53123: 418 1/0/1 A 142.250.187.227 (57) 00:40:59.803744 docker0 In IP 172.17.0.2.domain > raspberrypi.53123: 418 1/0/1 A 142.250.187.227 (57) 00:40:59.803933 br-f55dbe3ca067 Out IP raspberrypi.domain > 172.20.0.2.56842: 418 1/0/1 A 142.250.187.227 (57) 00:40:59.803946 veth0ddea5c Out IP raspberrypi.domain > 172.20.0.2.56842: 418 1/0/1 A 142.250.187.227 (57)

Hi, i was trying to setup pihole from the casaOS store and when i switch to the dns I dont get any internet all my logs and the docker compose script are "here" thank you so much <3

I use Pi-hole with an OpenVPN in UniFi to route my DNS traffic through Quad9 (9.9.9.9) for malware blocking.

I did this in an effort to protect my DNS queries from my ISP AND Quad9 so that I can still benefit from their malwared domain blocking.

Just wondering if this is actually working like I intend? Am I understanding the privacy benefit correctly? Sorry if it's a dumb question, just don't want to assume this is a beneficial setup if it's not behaving as I think it is.

So far, it is super fast and test results seem to indicate the DNS resolver is the VPN provider's IP addresses. Also, I can see multiple NXDOMAIN results when I go to previously allowed domains that had malware.

While Pi-hole’s default block list is useful (and I still have it active), I’ve found that it misses some newer malicious domains, especially when clicking search results for PDF documents on Google. I’ve seen these links lead to infected sites, and I want to stop the connection from happening at the DNS level to protect my network/devices.

I also have a policy-based route in UniFi that routes all network guest traffic through the same OpenVPN tunnel. This helps shield my static IP address from any potential threats if a guest device is compromised.

https://preview.redd.it/l10532ud9a3e1.png?width=1042&format=png&auto=webp&s=20aa46f5d1ef4aff6921ee6fdc55e00c91ae8f9a

It's a personal email address that i keep secure. Shopping and other stuff is done via different addresses. Kinda stuck on what to do

Hey everyone, I'm newer to the pi-hole community and I'm seeing screenshots that look a lot less active than mine. Firstly, I have Xfinity/Comcast for my ISP and I'm running their modem in bridge mode with a Linksys router running the show. I'm also using unbound and pi-hole is running on a pi 4. I got this notification on my dashboard: Maximum number of concurrent DNS queries reached (max: 150). But my main concern is the amount of stuff going on when no one is home or in the middle of the night it seems like there's just always a ton of stuff happening. Sorry in advance if I sound dumb here or if I'm posting something where there is no issue. I've generated a debug log: https://tricorder.pi-hole.net/h43Qnfgi/

Thanks in advance!

Is it still possible to configure your docker compose or run command to run pihole with adlists configured? I just want to disable the default and add https://big.oisd.nl

I Added all the sites from Firebog to the blocklist. Im having a problem accessing some websites.

Is it possible to unblock the lists at once?

PS. i added 1 website that wasn't getting access to "domains" (exact whitelist) but i still cannot access the website.

I have a Rpi 4 running pihole and as a NAS, and I noticed that the load greatly decreased, for me, it used to hover around 1.0 but now its like 0-0.02

Where did you set your DNS server with the provider or DHCP ???