Add more than two keywords in regex list, it will block domains with "download" keywords

v3-3

#1

I add some key words of blocked domain in the regex list. If I add these key words more than two, pihole will also block domains with “download” keywords. And I tried to empty the regex list and do a repeat way. This issue will show l, too.

How to solve this problem?


#2

Please provide examples of the domains you added, how you added them and the results. Thanks.


#3

For an example
I add one regex keywords of the domain name I want to block. After this action, if I add a keyword again, I use nslookup or dig command, it will return like it below

nslookup downloads.plex.tv
Server: 10.35.10.1
Address: 10.35.10.1#53
Name: downloads.plex.tv
Address: 0.0.0.0

It means that it has a regex keyword “download”, but there is no this keywords in pihole’s regex list.


#4

How do you know this to be the case? The domain could be in your gravity list.

In this case, which key word did you add as a regex (and how does it appear in /etc/pihole/regex.list ), and what does the query log show for this lookup?

The query log will tell you if the query was blocked by gravity or by regex.

Example - I made a wildcard blacklist entry for “ru.com”. Then I ran dig dog.ru.com and the reply is 0.0.0.0 from Pi-Hole (it was blocked). The query log shows the following:

With regex debugging mode on, this query shows in /var/log/pihole-FTL.log as follows, showing me again that the blocking was done by this regex filter.

[2019-02-11 12:03:21.846] DEBUG: Regex in line 3 "(^|\.)ru\.com$" matches "dog.ru.com"

https://docs.pi-hole.net/ftldns/configfile/


#5

The tail logs shows me it has been blocked by regex list, but my regex and gravity list dosen’t has that keywords. That’s to say, when I lookup a domain contains “download” at will, it’ll must be blocked, if there are over than two keywords.


#6

Enable regex debug mode and you can see which regex filter is blocking which domain.

https://docs.pi-hole.net/ftldns/configfile/


#7


[✓] Your debug token is: n4zzptmwu9




#8

You have a regex for ad, download contains the letters ad and is blocked.


#9

ok, I got that! Thank you for the help.