Blacklist is being ignored since update last week

fbm224 · July 12, 2022, 9:04pm

Expected Behaviour:

Regex domains in Blacklist are blocked

Actual Behaviour:

Regex domains in Blacklist are ignored

Debug Token:

This caught my eye from the debug:

*** [ DIAGNOSING ]: Dashboard and block page
[✗] Block page X-Header: X-Header does not match or could not be retrieved.
HTTP/1.1 200 OK
Content-type: text/html; charset=UTF-8
Expires: Tue, 12 Jul 2022 20:50:05 GMT
Cache-Control: max-age=0
Date: Tue, 12 Jul 2022 20:50:05 GMT
Server: lighttpd/1.4.55

Thank you!

jfb · July 12, 2022, 9:10pm

This is related to the dashboard, and no effect on blocking behavior, which is done by a separate part of Pi-hole.

Please provide some examples from your dnsmasq log at /var/log/pihole/pihole.log. To view the log in the terminal, you will need to use sudo before you commands, as the file has no read privileges to other users.

Example command to see if there are any Reddit domains in the log - you have this on your regex blacklist:

sudo grep reddit /var/log/pihole/pihole.log | tail -n25

fbm224 · July 12, 2022, 9:57pm

~$ sudo grep reddit /var/log/pihole/pihole.log | tail -n25
Jul 12 15:42:28 dnsmasq[23198]: reply dualstack.reddit.map.fastly.net is 2a04:4e42:400::396
Jul 12 15:42:28 dnsmasq[23198]: reply dualstack.reddit.map.fastly.net is 2a04:4e42:600::396
Jul 12 15:42:58 dnsmasq[23198]: reply dualstack.reddit.map.fastly.net is 2a04:4e42::396
Jul 12 15:42:58 dnsmasq[23198]: reply dualstack.reddit.map.fastly.net is 2a04:4e42:200::396
Jul 12 15:42:58 dnsmasq[23198]: reply dualstack.reddit.map.fastly.net is 2a04:4e42:400::396
Jul 12 15:42:58 dnsmasq[23198]: reply dualstack.reddit.map.fastly.net is 2a04:4e42:600::396
Jul 12 15:42:58 dnsmasq[23198]: reply dualstack.reddit.map.fastly.net is 151.101.1.140
Jul 12 15:42:58 dnsmasq[23198]: reply dualstack.reddit.map.fastly.net is 151.101.65.140
Jul 12 15:42:58 dnsmasq[23198]: reply dualstack.reddit.map.fastly.net is 151.101.129.140
Jul 12 15:42:58 dnsmasq[23198]: reply dualstack.reddit.map.fastly.net is 151.101.193.140
Jul 12 15:43:44 dnsmasq[23198]: reply dualstack.reddit.map.fastly.net is 2a04:4e42::396
Jul 12 15:43:44 dnsmasq[23198]: reply dualstack.reddit.map.fastly.net is 2a04:4e42:200::396
Jul 12 15:43:44 dnsmasq[23198]: reply dualstack.reddit.map.fastly.net is 2a04:4e42:400::396
Jul 12 15:43:44 dnsmasq[23198]: reply dualstack.reddit.map.fastly.net is 2a04:4e42:600::396
Jul 12 15:43:44 dnsmasq[23198]: reply dualstack.reddit.map.fastly.net is 151.101.1.140
Jul 12 15:43:44 dnsmasq[23198]: reply dualstack.reddit.map.fastly.net is 151.101.65.140
Jul 12 15:43:44 dnsmasq[23198]: reply dualstack.reddit.map.fastly.net is 151.101.129.140
Jul 12 15:43:44 dnsmasq[23198]: reply dualstack.reddit.map.fastly.net is 151.101.193.140
Jul 12 15:45:02 dnsmasq[23198]: query[A] www.redditmedia.com from 192.168.1.161
Jul 12 15:45:02 dnsmasq[23198]: forwarded www.redditmedia.com to 1.0.0.1
Jul 12 15:45:02 dnsmasq[23198]: reply www.redditmedia.com is <CNAME>
Jul 12 15:45:02 dnsmasq[23198]: reply dualstack.reddit.map.fastly.net is 151.101.193.140
Jul 12 15:45:02 dnsmasq[23198]: reply dualstack.reddit.map.fastly.net is 151.101.1.140
Jul 12 15:45:02 dnsmasq[23198]: reply dualstack.reddit.map.fastly.net is 151.101.129.140
Jul 12 15:45:02 dnsmasq[23198]: reply dualstack.reddit.map.fastly.net is 151.101.65.140

yubiuser · July 13, 2022, 10:28am

Your RegEx aren't associated with any group. Go to Group Management/Domain and assign them to the default group.

*** [ DIAGNOSING ]: Domainlist (0/1 = exact white-/blacklist, 2/3 = regex white-/blacklist)
   id     type  enabled  group_ids     domain                                                                                                date_added           date_modified        comment                                           
   -----  ----  -------  ------------  ----------------------------------------------------------------------------------------------------  -------------------  -------------------  --------------------------------------------------
   1         3        1                (\.|^)reddit\.com$                                                                                    2022-07-08 22:00:08  2022-07-10 17:14:48                                                    
   4         3        1                (\.|^)imgur\.com$                                                                                     2022-07-09 10:19:58  2022-07-10 17:14:47                                                    
   5         3        1                (\.|^)facebook\.com$                                                                                  2022-07-09 10:20:07  2022-07-10 17:14:46                                                    

*** [ DIAGNOSING ]: Clients

fbm224 · July 13, 2022, 2:48pm

Thank you ! It's working now.

fbm224 · July 14, 2022, 2:44am

Sorry to bother you again, but a few hours later they reverted to being unassigned. I've no idea why this happened.

jfb · July 14, 2022, 2:53am

Fresh debug token please.

fbm224 · July 14, 2022, 3:17am

https://tricorder.pi-hole.net/w88G4LgP/

jfb · July 14, 2022, 5:21am

All three of your regex blacklist entries are shown as assigned to the default group (0).

*** [ DIAGNOSING ]: Domainlist (0/1 = exact white-/blacklist, 2/3 = regex white-/blacklist)
   id     type  enabled  group_ids     domain                                                                                                date_added           date_modified        comment                                           
   -----  ----  -------  ------------  ----------------------------------------------------------------------------------------------------  -------------------  -------------------  --------------------------------------------------
   1         3        1  0             (\.|^)reddit\.com$                                                                                    2022-07-08 22:00:08  2022-07-13 21:38:24                                                    
   4         3        1  0             (\.|^)imgur\.com$                                                                                     2022-07-09 10:19:58  2022-07-13 21:38:31                                                    
   5         3        1  0             (\.|^)facebook\.com$

fbm224 · July 14, 2022, 2:18pm

Yes they are now, because I applied the same fix as before, what I don't get is why they got unassigned seemingly on their own, just hours after I assigned them to default.

jfb · July 14, 2022, 2:22pm

The next time this happens, before you fix it, take a look at a few things. Run these commands and post the output here:

pihole-FTL sqlite3 gravity.db "PRAGMA integrity_check"

ls -lha /etc/pihole/*.db

fbm224 · July 14, 2022, 2:40pm

I will, thank you!

fbm224 · July 14, 2022, 6:11pm

Hi, it happened again:

https://tricorder.pi-hole.net/sIueuVwa/

~$ pihole-FTL sqlite3 gravity.db "PRAGMA integrity_check"
ok

~$ ls -lha /etc/pihole/*.db
-rw-rw-r-- 1 pihole pihole 28M Jul 14 12:59 /etc/pihole/gravity.db
-rw-rw-r-- 1 pihole pihole 28M Jul 11 11:50 /etc/pihole/gravity_old.db
-rw-r--r-- 1 pihole pihole 2.8M Jul 8 21:57 /etc/pihole/macvendor.db
-rw-rw-r-- 1 pihole pihole 185M Jul 14 13:10 /etc/pihole/pihole-FTL.db

yubiuser · July 14, 2022, 7:03pm

Your RegEx are unassociated again.

*** [ DIAGNOSING ]: Domainlist (0/1 = exact white-/blacklist, 2/3 = regex white-/blacklist)
   id     type  enabled  group_ids     domain                                                                                                date_added           date_modified        comment                                           
   -----  ----  -------  ------------  ----------------------------------------------------------------------------------------------------  -------------------  -------------------  --------------------------------------------------
   1         3        1                (\.|^)reddit\.com$                                                                                    2022-07-08 22:00:08  2022-07-14 12:59:06                                                    
   4         3        1                (\.|^)imgur\.com$                                                                                     2022-07-09 10:19:58  2022-07-14 12:59:06                                                    
   5         3        1                (\.|^)facebook\.com$                                                                                  2022-07-09 10:20:07  2022-07-14 12:59:07

I saw that they have been recently modified. Did you perhaps turn them on/off from the Blacklist menu?
You might be affected by: Domains edited from Black/Whitelist page lose Group assignment · Issue #2260 · pi-hole/AdminLTE · GitHub

To workaround until the fix is released: use Group management/Domains instead of Black/Whitelist

fbm224 · July 14, 2022, 8:25pm

Yes !! I do usually turn them on/off daily from the blacklist section. Reddit is kind of addictive

Thank you for your kind help.

beringer · July 15, 2022, 8:05am

I encountered exact the same issue. This workaround does the trick for now, thank you very much!

system · August 5, 2022, 8:06am

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.