Ad blocking not working only on Windows 10 machine

Please follow the below template, it will help us to help you!

Expected Behaviour:

blocks ads on windows 10 machine

Actual Behaviour:

does not block ads on windows 10 machine

Debug Token:

6fivkdmgg3

Pihole works great except on my windows 10 machine. I am trying to force the machine to manually use the 192.168.8.2 (pi hole) address, but still see ads. When I visit the pi hole test page [Mod Edit: Link no longer available], the third party ad says blocked, but others show up. On roku and os x devices ads are blocked properly. Is there some system setting I should try? It doesn't seem like the PC is actually connecting to 192.168.8.2, because if I change the dns server in the settings I still have internet... I am changing this in the ipv4 area of the network properties.

When i run ipconfig -all:

Wireless LAN adapter Wi-Fi:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Killer Wireless-n/a/ac 1535 Wireless Network Adapter
Physical Address. . . . . . . . . : 9C-B6-D0-E6-DE-6D
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.8.5(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Wednesday, December 12, 2018 4:27:58 PM
Lease Expires . . . . . . . . . . : Thursday, December 13, 2018 4:50:06 PM
Default Gateway . . . . . . . . . : 192.168.8.1
DHCP Server . . . . . . . . . . . : 192.168.8.1
DNS Servers . . . . . . . . . . . : 192.168.8.2
NetBIOS over Tcpip. . . . . . . . : Enabled

Check the IPv6 settings in the WIN10 client and see which DNS is used there. If not needed, you can disable IPv6 on this client and avoid potential Pi-Hole bypasses.

IPv6 is off on the Win10 machine and when I installed Pi Hole, only checked the IPv4 option.

Have you flushed the DNS cache on the Win client and released/renewed the lease?

Yes, several times, I ran ipconfig /release, ipconfig /renew.

Also ran ipconfig /dnsflush before the release / renew.

It may be the browser you are using in Windows. Some of the newer browsers can provide their own DNS service, and bypass Pi -Hole.

Are you seeing all the browser traffic going through Pi-Hole?

I'm using wi-fi, no network cable. I tried plugging in a cable and manually setting the ethernet dns to 192.168.8.2 (raspberry pi), same result.

When i nslookup on the PC I get:

Server: raspberrypi
Address: 192.168.8.2
Non-authoritative answer:
Name: google.com
Addresses: 2607:f8b0:4005:804::200e
216.58.194.174

On the mac where pihole works:

Server: 192.168.8.2
Address: 192.168.8.2#53
Non-authoritative answer:
Name: google.com
Address: 172.217.6.78

The PI hole is seeing the PC's traffic come through. Here's an output of the log when connecting to the pihole ads page. Several items say "cached" - maybe this is the problem?

Dec 13 12:14:57 dnsmasq[16130]: query[A] canonicalizer.ucsuri.tcs from 192.168.8.5 
Dec 13 12:14:57 dnsmasq[16130]: cached canonicalizer.ucsuri.tcs is NXDOMAIN 
Dec 13 12:14:59 dnsmasq[16130]: query[A] accounts.google.com from 192.168.8.5 
Dec 13 12:14:59 dnsmasq[16130]: forwarded accounts.google.com to 8.8.8.8 
Dec 13 12:14:59 dnsmasq[16130]: query[A] clientservices.googleapis.com from 192.168.8.5 
Dec 13 12:14:59 dnsmasq[16130]: forwarded clientservices.googleapis.com to 8.8.8.8 
Dec 13 12:14:59 dnsmasq[16130]: query[A] www.googleapis.com from 192.168.8.5 
Dec 13 12:14:59 dnsmasq[16130]: cached www.googleapis.com is <CNAME> 
Dec 13 12:14:59 dnsmasq[16130]: cached googleapis.l.google.com is 216.58.195.234 
Dec 13 12:14:59 dnsmasq[16130]: cached googleapis.l.google.com is 172.217.0.42 
Dec 13 12:14:59 dnsmasq[16130]: cached googleapis.l.google.com is 172.217.6.74 
Dec 13 12:14:59 dnsmasq[16130]: cached googleapis.l.google.com is 216.58.195.74 
Dec 13 12:14:59 dnsmasq[16130]: cached googleapis.l.google.com is 216.58.192.10 
Dec 13 12:14:59 dnsmasq[16130]: cached googleapis.l.google.com is 172.217.164.106 
Dec 13 12:14:59 dnsmasq[16130]: cached googleapis.l.google.com is 172.217.6.42 
Dec 13 12:14:59 dnsmasq[16130]: cached googleapis.l.google.com is 172.217.5.106 
Dec 13 12:14:59 dnsmasq[16130]: query[A] mtalk.google.com from 192.168.8.5 
Dec 13 12:14:59 dnsmasq[16130]: cached mtalk.google.com is <CNAME> 
Dec 13 12:14:59 dnsmasq[16130]: forwarded mtalk.google.com to 8.8.8.8 
Dec 13 12:14:59 dnsmasq[16130]: reply accounts.google.com is 216.58.194.173 
Dec 13 12:14:59 dnsmasq[16130]: reply clientservices.googleapis.com is 216.58.195.227 
Dec 13 12:14:59 dnsmasq[16130]: reply mtalk.google.com is <CNAME> 
Dec 13 12:14:59 dnsmasq[16130]: reply mobile-gtalk.l.google.com is 74.125.199.188 
Dec 13 12:14:59 dnsmasq[16130]: query[A] clientservices.googleapis.com from 192.168.8.5 
Dec 13 12:14:59 dnsmasq[16130]: cached clientservices.googleapis.com is 216.58.195.227 
Dec 13 12:14:59 dnsmasq[16130]: query[A] www.googleapis.com from 192.168.8.5 
Dec 13 12:14:59 dnsmasq[16130]: cached www.googleapis.com is <CNAME> 
Dec 13 12:14:59 dnsmasq[16130]: cached googleapis.l.google.com is 172.217.5.106 
Dec 13 12:14:59 dnsmasq[16130]: cached googleapis.l.google.com is 216.58.195.234 
Dec 13 12:14:59 dnsmasq[16130]: cached googleapis.l.google.com is 172.217.0.42 
Dec 13 12:14:59 dnsmasq[16130]: cached googleapis.l.google.com is 172.217.6.74 
Dec 13 12:14:59 dnsmasq[16130]: cached googleapis.l.google.com is 216.58.195.74 
Dec 13 12:14:59 dnsmasq[16130]: cached googleapis.l.google.com is 216.58.192.10 
Dec 13 12:14:59 dnsmasq[16130]: cached googleapis.l.google.com is 172.217.164.106 
Dec 13 12:14:59 dnsmasq[16130]: cached googleapis.l.google.com is 172.217.6.42 
Dec 13 12:14:59 dnsmasq[16130]: query[A] mtalk.google.com from 192.168.8.5 
Dec 13 12:14:59 dnsmasq[16130]: cached mtalk.google.com is <CNAME> 
Dec 13 12:14:59 dnsmasq[16130]: cached mobile-gtalk.l.google.com is 74.125.199.188 
Dec 13 12:14:59 dnsmasq[16130]: query[A] accounts.google.com from 192.168.8.5 
Dec 13 12:14:59 dnsmasq[16130]: cached accounts.google.com is 216.58.194.173 
Dec 13 12:14:59 dnsmasq[16130]: query[A] ssl.gstatic.comfrom 192.168.8.5 
Dec 13 12:14:59 dnsmasq[16130]: cached ssl.gstatic.com is 216.58.195.67 
Dec 13 12:14:59 dnsmasq[16130]: query[A] clients2.google.com from 192.168.8.5 
Dec 13 12:14:59 dnsmasq[16130]: forwarded clients2.google.com to 8.8.8.8 
Dec 13 12:14:59 dnsmasq[16130]: reply clients2.google.com is <CNAME> 
Dec 13 12:14:59 dnsmasq[16130]: reply clients.l.google.com is 216.58.195.238 
Dec 13 12:14:59 dnsmasq[16130]: query[A] clients4.google.com from 192.168.8.5 
Dec 13 12:14:59 dnsmasq[16130]: forwarded clients4.google.com to 8.8.8.8 
Dec 13 12:14:59 dnsmasq[16130]: reply clients4.google.com is <CNAME> 
Dec 13 12:14:59 dnsmasq[16130]: reply clients.l.google.com is 172.217.5.110 
Dec 13 12:15:00 dnsmasq[16130]: query[A] ogs.google.com from 192.168.8.5 
Dec 13 12:15:00 dnsmasq[16130]: cached ogs.google.com is <CNAME> 
Dec 13 12:15:00 dnsmasq[16130]: forwarded ogs.google.com to 8.8.8.8 
Dec 13 12:15:00 dnsmasq[16130]: reply ogs.google.com is <CNAME> 
Dec 13 12:15:00 dnsmasq[16130]: reply www3.l.google.com is 216.58.194.174 
Dec 13 12:15:00 dnsmasq[16130]: query[A] docs.google.com from 192.168.8.5 
Dec 13 12:15:00 dnsmasq[16130]: forwarded docs.google.com to 8.8.8.8 
Dec 13 12:15:00 dnsmasq[16130]: reply docs.google.com is 172.217.0.46 
Dec 13 12:15:01 dnsmasq[16130]: query[A] adservice.google.com from 192.168.8.5 
Dec 13 12:15:01 dnsmasq[16130]: /etc/pihole/gravity.list adservice.google.com is 0.0.0.0 
Dec 13 12:15:01 dnsmasq[16130]: query[A] fonts.gstatic.com from 192.168.8.5 
Dec 13 12:15:01 dnsmasq[16130]: forwarded fonts.gstatic.com to 8.8.8.8 
Dec 13 12:15:01 dnsmasq[16130]: reply fonts.gstatic.com is <CNAME> 
Dec 13 12:15:01 dnsmasq[16130]: reply gstaticadssl.l.google.com is 216.58.195.227 
Dec 13 12:15:02 dnsmasq[16130]: query[A] rcm-na.amazon-adsystem.com from 192.168.8.5 
Dec 13 12:15:02 dnsmasq[16130]: /etc/pihole/gravity.list rcm-na.amazon-adsystem.com is 0.0.0.0 
Dec 13 12:15:02 dnsmasq[16130]: query[A] rcm-na.amazon-adsystem.com from 192.168.8.5 
Dec 13 12:15:02 dnsmasq[16130]: /etc/pihole/gravity.list rcm-na.amazon-adsystem.com is 0.0.0.0 
Dec 13 12:15:02 dnsmasq[16130]: query[A] js.stripe.com from 192.168.8.5 
Dec 13 12:15:02 dnsmasq[16130]: forwarded js.stripe.com to 8.8.8.8 
Dec 13 12:15:02 dnsmasq[16130]: query[A] pagead2.googlesyndication.com from 192.168.8.5 
Dec 13 12:15:02 dnsmasq[16130]: /etc/pihole/gravity.list pagead2.googlesyndication.com is 0.0.0.0 
Dec 13 12:15:02 dnsmasq[16130]: query[A] fonts.gstatic.com from 192.168.8.5 
Dec 13 12:15:02 dnsmasq[16130]: forwarded fonts.gstatic.com to 8.8.8.8 
Dec 13 12:15:02 dnsmasq[16130]: reply fonts.gstatic.com is <CNAME> 
Dec 13 12:15:02 dnsmasq[16130]: reply gstaticadssl.l.google.com is 216.58.194.163 
Dec 13 12:15:02 dnsmasq[16130]: reply js.stripe.com is <CNAME> 
Dec 13 12:15:02 dnsmasq[16130]: reply stripecdn.map.fastly.net is 151.101.0.176 
Dec 13 12:15:02 dnsmasq[16130]: reply stripecdn.map.fastly.net is 151.101.64.176 
Dec 13 12:15:02 dnsmasq[16130]: reply stripecdn.map.fastly.net is 151.101.128.176 
Dec 13 12:15:02 dnsmasq[16130]: reply stripecdn.map.fastly.net is 151.101.192.176 
Dec 13 12:15:02 dnsmasq[16130]: query[A] ws-na.assoc-amazon.com from 192.168.8.5 
Dec 13 12:15:02 dnsmasq[16130]: /etc/pihole/gravity.list ws-na.assoc-amazon.com is 0.0.0.0 
Dec 13 12:15:02 dnsmasq[16130]: query[A] ws-na.assoc-amazon.com from 192.168.8.5 
Dec 13 12:15:02 dnsmasq[16130]: /etc/pihole/gravity.list ws-na.assoc-amazon.com is 0.0.0.0 
Dec 13 12:15:02 dnsmasq[16130]: query[A] googleads.g.doubleclick.netfrom 192.168.8.5 
Dec 13 12:15:02 dnsmasq[16130]: /etc/pihole/gravity.list googleads.g.doubleclick.net is 0.0.0.0 
Dec 13 12:15:03 dnsmasq[16130]: query[A] tpc.googlesyndication.com from 192.168.8.5 
Dec 13 12:15:03 dnsmasq[16130]: /etc/pihole/gravity.list tpc.googlesyndication.com is 0.0.0.0 
Dec 13 12:15:03 dnsmasq[16130]: query[A] fls-na.amazon-adsystem.com from 192.168.8.5 
Dec 13 12:15:03 dnsmasq[16130]: /etc/pihole/gravity.list fls-na.amazon-adsystem.com is 0.0.0.0 
Dec 13 12:15:03 dnsmasq[16130]: query[A] ir-na.amazon-adsystem.com from 192.168.8.5 
Dec 13 12:15:03 dnsmasq[16130]: /etc/pihole/gravity.list ir-na.amazon-adsystem.com is 0.0.0.0 
Dec 13 12:15:04 dnsmasq[16130]: query[A] js.stripe.com from 192.168.8.5 
Dec 13 12:15:04 dnsmasq[16130]: cached js.stripe.com is <CNAME> 
Dec 13 12:15:04 dnsmasq[16130]: cached stripecdn.map.fastly.net is 151.101.192.176 
Dec 13 12:15:04 dnsmasq[16130]: cached stripecdn.map.fastly.net is 151.101.128.176 
Dec 13 12:15:04 dnsmasq[16130]: cached stripecdn.map.fastly.netis 151.101.64.176 
Dec 13 12:15:04 dnsmasq[16130]: cached stripecdn.map.fastly.net is 151.101.0.176 
Dec 13 12:15:04 dnsmasq[16130]: query[A] pagead2.googlesyndication.com from 192.168.8.5 
Dec 13 12:15:04 dnsmasq[16130]: /etc/pihole/gravity.list pagead2.googlesyndication.com is 0.0.0.0 
Dec 13 12:15:04 dnsmasq[16130]: query[A] fonts.gstatic.com from 192.168.8.5 
Dec 13 12:15:04 dnsmasq[16130]: forwarded fonts.gstatic.com to 8.8.8.8 
Dec 13 12:15:04 dnsmasq[16130]: reply fonts.gstatic.com is <CNAME> 
Dec 13 12:15:04 dnsmasq[16130]: reply gstaticadssl.l.google.com is 216.58.195.227 
Dec 13 12:15:06 dnsmasq[16130]: query[A] 1.gravatar.com from 192.168.8.5 
Dec 13 12:15:06 dnsmasq[16130]: forwarded 1.gravatar.com to 8.8.8.8 
Dec 13 12:15:06 dnsmasq[16130]: query[A] 0.gravatar.com from 192.168.8.5 
Dec 13 12:15:06 dnsmasq[16130]: forwarded 0.gravatar.com to 8.8.8.8 
Dec 13 12:15:06 dnsmasq[16130]: reply 0.gravatar.comis 192.0.73.2 
Dec 13 12:15:06 dnsmasq[16130]: reply 1.gravatar.com is 192.0.73.2 
Dec 13 12:15:06 dnsmasq[16130]: query[A] 2.gravatar.com from 192.168.8.5 
Dec 13 12:15:06 dnsmasq[16130]: forwarded 2.gravatar.com to 8.8.8.8 
Dec 13 12:15:06 dnsmasq[16130]: reply 2.gravatar.com is 192.0.73.2 
Dec 13 12:15:06 dnsmasq[16130]: query[A] m.stripe.network from 192.168.8.5 
Dec 13 12:15:06 dnsmasq[16130]: forwarded m.stripe.network to 8.8.8.8 
Dec 13 12:15:06 dnsmasq[16130]: query[A] m.stripe.network from 192.168.8.5 
Dec 13 12:15:06 dnsmasq[16130]: forwarded m.stripe.network to 8.8.4.4 
Dec 13 12:15:06 dnsmasq[16130]: forwarded m.stripe.network to 8.8.8.8 
Dec 13 12:15:06 dnsmasq[16130]: query[A] q.stripe.com from 192.168.8.5 
Dec 13 12:15:06 dnsmasq[16130]: /etc/pihole/gravity.list q.stripe.com is 0.0.0.0 
Dec 13 12:15:06 dnsmasq[16130]: reply m.stripe.network is <CNAME> 
Dec 13 12:15:06 dnsmasq[16130]: reply b.stripecdn.comis <CNAME> 
Dec 13 12:15:06 dnsmasq[16130]: reply stripecdn.map.fastly.net is 151.101.0.176 
Dec 13 12:15:06 dnsmasq[16130]: reply stripecdn.map.fastly.net is 151.101.64.176 
Dec 13 12:15:06 dnsmasq[16130]: reply stripecdn.map.fastly.net is 151.101.128.176 
Dec 13 12:15:06 dnsmasq[16130]: reply stripecdn.map.fastly.net is 151.101.192.176 
Dec 13 12:15:07 dnsmasq[16130]: query[A] pagead2.googlesyndication.com from 192.168.8.5 
Dec 13 12:15:07 dnsmasq[16130]: /etc/pihole/gravity.list pagead2.googlesyndication.com is 0.0.0.0

The two ads it is not blocking on that page are the amazon and google. This is the url:

https://pi-hole.net/pages-to-test-ad-blocking-performance/

The leaderboard ad and the square ad show up from both google and amazon on PC. On the Mac they do not.

On both mac and pc if you visit:

https://blockads.fivefilters.org/?pihole

says ad block enabled.

Using chrome:

Version 71.0.3578.98 (Official Build) (64-bit)

Same problem occurs in firefox or microsoft edge unfortunately...

There is nothing in the hosts file. This is what's inside (everything is commented out). Do I need to add something?

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     [rhino.acme.com](http://rhino.acme.com/)          # source server
#       38.25.63.10     [x.acme.com](http://x.acme.com/)              # x client host
# localhost name resolution is handled within DNS itself.
# 127.0.0.1       localhost
# ::1             localhost

Ok, well any suggestions of things to try? It seems like the pihole is getting the pc and trying to block the ads, but on the browser the ads are still occuring. It's almost like the PC is one step ahead of the pihole... It lets everything through where the mac and linux machines block all of the junk. I even tried turning off the Avast firewall and windows firewall and no effect...

Ok, PROBLEM SOLVED! Looked up Avast DNS, there is a feature in the program called "safe site" which guards against malicious / fake web sites and presents problems with Open DNS among other things upon looking it up on google. I turned off this protection layer, cleared chrome cache, and ipconfig /flushdns, everything works now. Looks just like how the mac does.

THANK YOU THANK YOU THANK YOU.

And, no, was not using Avast on the macs.

Thanks so much for your help. Really happy about fixing this.

Hi there,
I am also having this issue with my SurfacePro running Windows 10. I only see the Amazon Ad on the test blocking site but see other ads on other sites. I have disabled 'Real Site' in Avast. Should I specify certain DNS servers in my Windows Network Adapter settings or not?
Thanks so much for any help you can give. This has been super frustrating.

I see the IP address of my Pi-hole but my default gateway is also listed.

Thanks so much for your help and Happy New Year! I rebooted the Surface and now the ad is gone!!!!

So I just wanted to give you an update. It turns out that my problem wasn't (or wasn't only) Avast and their
'real site' component. I also run PIA (Private Internet Access) VPN and it uses a DNS address to mask what I am doing to my ISP etc. So I decided that when I bring up that VPN I will do so with its ad blocking capability enabled (MACE). That did the trick. So I guess pi-hole is not 'sucking up' the ads for my PC but the PIA ad blocker is. As long as I don't have to put up with them, I am good.

Thanks again for your help.

Arsastoria

1 Like