Source
r/pihole•
metaping

Better way to rout router pihole settings?

I'm stumped on how to get pihole to be the only DNS server. I think it's working for my LAN Desktop with the exception of Mircrosoft Edge, which I assume its Edge being Edge. Ad block tests are done on this site.

Right now I tested on my personal phone manually reserving a DHCP for it, and manually typing in the DNS as per here, which seems to work for now, though if that is my only recourse then it would be a bit of a shame since it means I would have to do so for the few remaining devices amongst my family.

If it helps, I'm using pihole on a Pi Zero W on wireless (couldn't get the ethernet adapter working), followed mostly this LTT forum guide but installing Raspberry Pi OS Full, did an initial update non-headless of the OS, before proceeding to do a headless install.

My router is an ISP provided Halo Router and if it helps, this is my debug log.

EDIT: I had no luck setting up DNS over HTTPS using cloudflared, though I did come across this post and might spend time understanding it in the future. For now I would 1st like to see if I can get my Zero W to run pihole as recommended before moving on to trying out getting ethernet to work, DNS over HTTPS, 2nd pihole etc

EDIT2: Due to timezone differences expect replies to take more than 12h, mods feel free to delete this post at your discretion.

EDIT 3: Under prerequisites on pihole doc i have not tinkered with any of those iptable/ port things, might that be an issue? Off to bed now.

EDIT 4: Ads are only selectively blocked on my browser, so looks like pihole isn't blocking my ethernet desktop either, perhaps my browsers/ desktop has its own ad block settings/ dns settings overriding it? Will have to check when I get back. Other mobile devices are not connected/ blocked by pi though, so that's another issue...

Posted Nov 30, 2020, 5:21 PM UTC · edited

522
PaulMc_•

Hmm. Have you configured your router to point DNS to Pihole? That should handle it for all your devices.

3
metapingOP•

pretty sure i did , unless my router cannot do so. When I put DNS2 to be same as 1, internet gets knocked out so I went with 8.8.4.4 for dns2. Unless I'm not supposed to use 192.168.1.171 for dns1? That shouldn't be the case though since putting that as my dns on mobile blocks ads.

1
mroshaw•

Can you leave DNS 2 blank? If you leave the secondary Google DNS in there, your router is likely to use it, bypassing the Pi. You should indeed put the IP address of your Pi Hole in DNS 1. Make sure 192.168.1.171 is allocated statically to your Pi MAC address.

3
metapingOP•

Tried before, access to websites immediately not available, same for when i put in dummy addresses like 10.20.30.40 or having dns1 and 2 be the same.

1
mroshaw•

Is your Pi definitely on 192.168.1.171? Have you assigned a static IP to the Pi Mac address?

When I first installed a Pi Hole, my router simply wouldn't work with a local DNS. I had to use a different router in the end. I saw the same behavior, no DNS resolution and so nothing Internet related was working.

2
PaulMc_•

I'm not using DNS2, only DNS1. Some routers won't allow this.

I also am using the DHCP server in Pihole.

It seems pretty solid so far. I just need to figure out how to automate updating the filters.

2
metapingOP•

How i wish my router was like yours, though that probably doesn't explain my putting the same pi dns for 1 & 2 makes me unable to surf the net. Would you say making pihole your DHCP server instead of the router was the trick that solved your issue?

Do you think a script like this could help with the updates of your filters?

edit: nt like it would work for me, i saw a on off switch for dhcp on my router i think, toggled it but the router didn't allow

1
PaulMc_•

I have an Orbi, and my reason for not using it's DHCP server is that it would sometimes stop serving IP addresses (though everything else worked properly).

I hate to suggest it, but upgrading your router might be a good investment.

Good luck!

2
Syn-Ack-Attack•

Do you notice it only when using Edge? The reason I ask are some browsers are turning on DNS over HTTPS. Which in and of itself is a good thing, just not when you’re trying to use your own (DOH bypasses your assigned DNS and uses it’s own). In the command line try command nslookup google.com. The top few lines should tell you if Windows/OS is using it for DNS.

Edit: For clarity.

3
metapingOP•

Incognito Edge was very blatant, every ad appears, incognito Firefox and Chrome doesn't show any, though my web surfing activities doesn't reflect on pihole's log. I am assuming they are appearing as localhost? Not sure but yes, no ads on fox or chrome i think.

Will check browser/ windows is having its on dns over https when im back, as well as nslookup when i get back, results to be edited here.

EDIT 1: Quick test before I left house. I had an idea, since pornhub and tsumino had their ad and pop ups denied on my mobile now, i tried these 2 sites on incognito firefox, from what i skimmed through,Pornhub ads got blocked but not tsumino's so looks like my desktop is not covered by pihole but maybe the desktop's own dns/ ad blocker settings

EDIT 2: https://imgur.com/8krN9dl here's what I've got busy now if there's time I'll try to figure out what it all means

1
Nixellion•

There are three ways of doing this, generally.

  1. You can set up router to advertise pihole as DNS server for clients. Con is that devices may only update this Info when reconnecting to the network or they may cache it for even longer.
  2. You can set your router to be the main DNS server as usual, but router itself will use pihole as it's upstream dns. Con of this approach is that router has DNS cache, so changes you do on pihole, like blocking a site, may take time to be seen by the router, depending on domain names's ttl. On some router you can manually Clear cache.
  3. You can redirecr all outgoing traffic for port 53 towards your pihole.

Option 3 is the only one that can force devices/apps that have hardcoded DNS to use your pihole. And even then only if they use basic dns, and not https dns which uses port 433 and if you block that you will block all https websites for yourself.

2
metapingOP•

1 requires the router itself to be capable of doing so by typing in some lines in some argument field in the router settings right? So that's out of the option since I don't think I see any in mine.

Maybe I'll look up option 2 when I'm back from work, since 3 sounds more... technically challenging and limited.

1
Nixellion•

1-2 should be available on most routers, 3 is not limited in any way and ideally you should combine 1/2 and 3. It may be challenging if you never worked with firewall rules or port forwarding before, but its not really hard at all once you figure it out.

2
metapingOP•

Yea that will take some days for me to rack my brain, will see how it goes. 1 is the recommended setup in pihole docs right, I think i misunderstood your initial post

1
Nixellion•

I suppose it is, this way they will talk to pihole directly and show up there under different IPs and hostnames. With 2 it will only display your router as making requests, unless you use pihole as DHCP server or some other workaround. But it has other benefits, like you can quickly fallback to any other DNS if pihole fails by changing it there. If you use option 1 then it wont work.

​

By the way, make sure you don't use secondary DNS. Either at all, or it should also be your pihole. Some people (myself included) may think that it works like "user DNS2 if DNS1 is not reachable". But in fact it works like "Ask both at the same time, and whoever gets the response faster - use that. And if the response is blocked then check the other dns". So basically if you have any other DNS there then your pihole wont work. It will respond some queries, but whatever's blocked will just be queried from the second dns.

2
Aether_Erebus•

So the pihole works on your phone if you set it up to use it? What about other computers? Can you ping say google.com from the pi?

1
metapingOP•

Yes, pihole noticeably works on my phone but only after I reserved a dhcp for it on my router, and changing my phone's wifi connection from dhcp to static, and manually typing in my pi's ip as the dns address (192.168.1.171).

I presume my Ethernet desktop is working, maybe routed through localhost or something, because activity log wise it previously mostly show hourly localhost activities, which doesn't convince me...

will try pinging later

EDIT 1: I had an idea, since pornhub and tsumino had their ad and pop ups denied on my mobile now, i tried these 2 sites on incognito firefox, from what i skimmed through,Pornhub ads got blocked but not tsumino's so looks like my desktop is not covered by pihole but maybe the desktop's own dns/ ad blocker settings?

EDIT 2: this is what I got

64 bytes from 74.125.24.105 (74.125.24.105): icmp_seq=138 ttl=109 time=7.92 ms

64 bytes from 74.125.24.105 (74.125.24.105): icmp_seq=139 ttl=109 time=7.58 ms

64 bytes from 74.125.24.105 (74.125.24.105): icmp_seq=140 ttl=109 time=7.94 ms

64 bytes from 74.125.24.105 (74.125.24.105): icmp_seq=141 ttl=109 time=7.52 ms

64 bytes from 74.125.24.105 (74.125.24.105): icmp_seq=142 ttl=109 time=7.68 ms

64 bytes from 74.125.24.105 (74.125.24.105): icmp_seq=143 ttl=109 time=7.97 ms

64 bytes from 74.125.24.105 (74.125.24.105): icmp_seq=144 ttl=109 time=4.34 ms

^C --- www.google.com ping statistics --- 144 packets transmitted,

144 received, 0% packet loss,

time 364ms rtt min/avg/max/mdev = 4.337/8.875/65.394/6.406 ms

1