Bahn.de extreemely slow

General
1

Hi,
www.bahn.de is very, very slow and it is still the same problem (PiHole Limits Functionality- How to Fix?) and it's definitely pi-hole.
If I deactivate pi-hole, then the bahn.de site works wonderfull. As soon as pi-hole is activated, the pages takes ages.
Chrome, Edge, Firefox - all the same issue.

any idea?

greets
Monti

2

I can use the website with no problems in Chrome (desktop) + Edge (Win10 mobile).

Are you blocking any of these?

hdshlsdbbahn-vh.akamaihd.net
www.img-bahn.de
reiseauskunft.bahn.de
rabdc.bahn.de
ps.bahn.de
www.dbbahnpark.info

3

I was able to fix it by rejecting https-requests.
Add a filter rule on your Pi-Hole (or the router in-between) which reject (not blocks!) https-requests to the pihole-host.

4

@MontgomeryB Just out of curiosity: Do you use any non-standard blocking lists? I cannot see any issues with their page with only the standard lists and no explicit HTTPS rejection rules.

5

No blocking! Some of them are even whitelisted.

6

fyi: The mobile version of bahn.de and its ticket order stuff works fine. The desktop versions don't

7

Very weird - I just tried it again and it works flawlessly for me (I'm using the Fahrplanauskunft several times a week). As said, I have no firewall rules in place on my Pi-hole.

8

strange, indeed.

@knebb - how did you exactly solve your problem? where to config what.

9

@MontgomeryB
I do not really remember, to be honest.

It was during my first days with pi-hole. I realized very quickly of having issues with (partially) https:// sites. For http there was no issue as Pi-hole properly send some small pics instead of the orignial ad. But obviously Pi-hole could not answer https-requests (as it would have to generate a valid https-certificate to prevent the browsers from mocking).

At this time the request just timed out trying to access https://ip-of-pihole/ which took ages and often brought the whole page down. There was no one replying to https-requests.

Instead of getting just no answer and waiting for ages (default behaviour) I decided to let the browser know about the fact no one will reply. So the browser knows immediate about "no reply".

So I created a filter rule on the Pi-hole which simply REJECTs (instead of BLOCK) any request to http-Port 443 to the Pi-hole server.

So now the browser gets an immediate reply and knows very quick about not being able to get the requested element (which is an ad because of the IP). and displays all other elements properly.

Since I did this change Nearly every site is running fine and fast.

10

Thank you, knebb!

If anyone knows, please give me a hint.

So, @all of you - have a nice winter holiday and a very first-class 2018

cheers
Monti

11

Ah, that may be the difference then. I'm directly getting this when trying to access htps://pi.hole

Screenshot at 2017-12-23 13-31-55

and it should actually be standard when you have no firewall enabled.

@MontgomeryB What device did you install your Pi-hole on?

The following assumes that you are running Raspbian on a Rasbperry Pi (or similar) and have no firewall rules installed. If this is not true we have to negotiate how to properly set up your firewall, but that shouldn't be a big deal!

Solution for Raspbian: Check you actually have n firewall rules installed. Use sudo iptables -L --line-numbers, it should show something like

Chain INPUT (policy ACCEPT)
num target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
num target     prot opt source               destination     

Chain OUTPUT (policy ACCEPT)
num target     prot opt source               destination

if there is anything more, we'll most likely have to deal with that differently.

If there are no firewall rules, you can straightforwardly add the HTTPS REJECT rule like this:

iptables -A INPUT -p tcp --dport 443 -j REJECT

If you also use IPv6, add an IPv6 rule as well:

ip6tables -A INPUT -p tcp --dport 443 -j REJECT

Thanks, same to you (btw, I have never used first class with DB so far :slight_smile: )

12

Yippie, solved it :smile:

  • ip6tables -A INPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset
  • ip6tables -A INPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset
  1. edit the IPV4_ADDRESS and IPV6_ADDRESS in /etc/pihole/setupVars.conf
  • IPV4_ADDRESS=0.0.0.0
  • IPV6_ADDRESS=0000:0000:0000:0000:0000:0000:0000:0000

see:

Blockquote see tps://discourse.pi-hole.net/t/pi-hole-unnutzbar-mit-mac-ipad-iphone/4435/13

  1. Done! :confetti_ball:

:vortex: is realy a nice Christmas present :christmas_tree:

All the best
Monti

13

Note that setting the values to 0.0.0.0 instead of only installing the proper firewall rules may have unintended side effects as the blocking page and maybe even the Pi-hole dashboard being not reachable any more.