Asus RT-AC68U not blocking or routing traffic through pi-hole

Hello pi-hole community. I recently moved and updated my pi-hole to use v5 and now I'm not seeing any ads blocked nor does traffic appear to be going through the pi-hole. I've tried several fixes as recommended in some posts here but I've had no luck. As soon as I remove the google servers from the 2nd line in my WAN server settings my internet stops working.

I've read issues of ASUS routers assigning their own IP but as I am a noob when it comes to networking I'm not really sure how to fix. Any advice is appreciated, thanks for looking.

Expected Behaviour:

Network traffic goes through pihole and blocks ads.

Actual Behaviour:

Network traffic is not going through the pi-hole and blocking ads.

Debug Token:

https://tricorder.pi-hole.net/96036d4l4v

Router Setup

OS: MacOS running Big Sur
Router: Asus RT-AC68U
Modem: Arris surfboard SB6141
Raspberry pi running pi-hole v5.3.1

LAN settings in router:

WAN settings in router:

Pi-hole settings:

Pi-hole query log (previously when it was working I would see addresses being blocked actively):

[✗] No IPv4 address(es) found on the wlan0 interface.

[✗] No IPv6 address(es) found on the wlan0 interface.

   Scanning all your interfaces for DHCP servers
   Timeout: 10 seconds
   
   * Received 300 bytes from eth0:192.168.1.1
     Offered IP address: 192.168.1.75
     Server IP address: 192.168.1.1
     Relay-agent IP address: N/A
     BOOTP server: (empty)
     BOOTP file: (empty)
     DHCP options:
      Message type: DHCPOFFER (2)
      server-identifier: 192.168.1.1
      lease-time: 86400 ( 1d )
      renewal-time: 43200 ( 12h )
      rebinding-time: 75600 ( 21h )
      netmask: 255.255.255.0
      broadcast: 192.168.1.255
      dns-server: 192.168.1.150
      dns-server: 192.168.1.1
      router: 192.168.1.1
      --- end of options ---
    
   DHCP packets received on interface lo: 0DHCP packets received on interface wlan0: 0
   
   DHCP packets received on interface eth0: 1

    PIHOLE_INTERFACE=wlan0

You configured Pi-hole to listen on wlan0 instead of eth0. Run pihole -r and choose reconfigure.

Please note: your router does advertise itself as DNS server via DHCP as well. Therefore your clients may choose to send DNS requests to your router. If Pi-hole is working again you should remove the google DNS from the WAN settings again to filter those requests as well.

1 Like

OMG that was totally it. Thank you for solving this problem for me which I've been stuck on for 2 days now :pray:

I've also removed the Google server from WAN DNS server2 setting so now I only have my pihole ip in both LAN and WAN.

Also, as a token of my appreciation for the help and pi-hole in general:

4 Likes

Hi @mundert, am just warning you but probably your setup still doesnt filter out ads etc under certain conditions.
As long as your router advertises its own IP to the clients alongside the Pi-hole IP:

You can see what DNS server(s) your router is advertising when running below one on the Pi-hole host:

pi@ph5a:~ $ pihole-FTL dhcp-discover
[..]
   dns-server: 10.0.0.2
[..]

Those are the ones your clients will be querying to resolve domain names to IP addresses etc.
If you read below thread (with a nice recap from @bennor3814), best for you would be to replace the DHCP service on the Asus router with the one from Pi-hole:

To do so, you first have to enable the DHCP service on Pi-hole like below:

Then disable the one on the Asus router:

image

Validate everything Pi-hole is advertising with the pihole-FTL dhcp-discover command again.
Grab a test client (Windows/MacOS or Linux) and dis and reconnect it from/to network to renew its DHCP lease.
Check DNS server(s) this client is configured for now after renewing the DHCP lease:

And run below three on the client in a command prompt/terminal to test name resolution and blocking (flurry.com is on one of the blocklists):

C:\>nslookup pi.hole
Server:  ph5a.dehakkelaar.nl
Address:  10.0.0.2

Name:    pi.hole
Address:  10.0.0.2
C:\>nslookup flurry.com
Server:  ph5a.dehakkelaar.nl
Address:  10.0.0.2

Name:    flurry.com
Addresses:  ::
          0.0.0.0
C:\>nslookup pi-hole.net
Server:  ph5a.dehakkelaar.nl
Address:  10.0.0.2

Non-authoritative answer:
Name:    pi-hole.net
Address:  192.124.249.118

If that al looks good, you can proceed and renew the DHCP leases for the rest of your clients or wait out the DHCP lease time period (usually 24 hours).

1 Like

Thanks for that update deHakkelaar (new users can't mention users), it is very helpful and detailed.

I can attempt this a bit later but I am wondering what the risk is in doing this? That devices which are connected to my wifi won't be able to connect until their DHCP leases are renewed?

Also, to confirm, by doing this it will ensure that ALL traffic goes through the pi-hole since the router won't advertise its own IP anymore?

Thanks and forgive me if I misread what you were saying, very new to networking and the issues that come along with it :slightly_smiling_face:

1 Like

No, the clients that already have a lease from your router will continue to work as before.
If results from the test client are not as expected, you can always revert back to enabling the DHCP service agian on the router ... and disable the one on Pi-hole.

Thats why Pi-hole added a DHCP server feature when the router cant be configured as intended.

1 Like

In addition to everything that's already been posted. Some things to consider. If you use the stock Asus RT-AC68U firmware, and use the router's DHCP server, then you have the general issue of the router including its IP address as the second or third DNS server for network clients. One can input the Pi-Hole's IP address into the WAN DNS fields on the router to try and solve this issue. But doing so creates a potential problem that will randomly crop up. One can encounter a recursive loop by Pi-Hole where it will essentially flood the router with DNS requests which flow back to the Pi-Hole only to go back to the router, causing a breakdown in DNS resolution entirely. I initially used the Pi-Hole IP in the WAN DNS but eventually ran into this recursive loop issue that crippled my network (twice). So I no longer use the Pi-Hole IP address in the router's WAN DNS fields.

Another issue is Guest WiFi networks. If you enable the Guest WiFi option on the Asus RT-AC68U, and set the Access Intranet option to Disable, wireless clients that connect to that Guest WiFi network won't be able to access any local network IP addresses other than the router itself. This means those Guest WiFI client cannot access the Pi-Hole. This was the main reason I went over to using the Asus-Merlin firmware and the YazFi script which is mentioned in the other thread @deHakkelaar mentioned above. I wanted to isolate Guest WiFi clients from the main LAN but still funnel their DNS requests through Pi-Hole. If one decides to disable the Asus router's DHCP server and use Pi-Hole's DHCP server option. Just be aware that Guest WiFi Clients may not be able to reach the Pi-Hole's DHCP server to obtain an IP address when using the stock Asus firmware when one has Access Intranet set to Enabled. Something to be aware of when figuring out how one wants to setup the Asus router and the Pi-Hole.

1 Like

Thanks for that info bennor3814. I don't foresee myself using the guest WiFi option but great to know I may have issues with it if I decide to go the pi-hole DHCP server option.

So far everything seems to be working great as far as ad-blocking goes so I'm pretty happy with the setup as is. I would like to try switching over to pi-hole DHCP server just try it out (and because I like tinkering) but if I notice issues I'll just go back to the setup I have now. Regardless, thanks again for the info, every little kernel helps!

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.