Blocking most times works rare times not

The issues I am facing:

The DNS request bypasses the pihole and it sends the request to the upstream server.
The DNS request on the pihole won't cache, thus sending it upstream to next pihole and it does the same thing at random times.
The DNS request on the pihole sends the request upstream even though its cached.
The DNS request bypasses the pihole quire log info page in admin.

After a Reboot of all devices all the issues were less frequent.
It seems to be a more a Windows 11 issue because I still have some adds on spotify.

I have implemented Clear dnsmasq cache without restarting the service on my first port of call (Dnsmasq) but not on piholes yet.

Details about my system:

First port of call: A Raspberry pi 3b running DNSMasq version 2.80 (wired)
Second port of call: ASUS TravelMate I5-4210u Ubuntu 20.04 running Phole (WIFI)
Third port of call: A Raspberry pi 3b running Pihole (wired)
Fourth port of call: A Raspberry pi 3b running Pihole (wired)

Spare Raspberry pi 3b running Pihole (wired) used as standby backup DNS incase all the above fails.

Modem: Archer VR300 v2 00000000: Firmware 1.3.0 0.8.0 v00a2.0 Build 210827 Rel.70593n

All the devices are on My home style UPS. Inverter 4000w, car battery, car battery charger.

What I have changed since installing Pi-hole:

I have a massive increased of the DNS cache size: 2 000 000.
I have decreased database interval. Raspberry pi 3b = 2 hours. Travelmate = 24 hours.
Also I have cron job to kill the pihole-FTL database. Sometimes the FTL takes l long time to start.

#!/bin/bash
cd /etc/pihole
service pihole-FTL stop
pkill -9 pihole-FTL
rm pihole-FTL.db
service pihole-FTL start

Some questions

  • Can you elaborate on how these five resolvers are working together?
  • Clarify what and where the "upstream server" is in the context of this arrangement
  • Describe how a client's DNS request touches them and moves through them
  • What is the purpose of this arrangement?
  • Which Pi-hole instance contains the gravity database that you wish to implement, ie adlists, black/whitelists?
  • From the point of view of clients, are blocked domains ultimately being blocked and non-blocked domains being resolved, regardless of what you see on the Pi-hole instances?
  • Why is the FTL database being periodically removed, and on which Pi-hole or Pi-holes?

Please generate a debug log, upload it when prompted and post the token URL here.

The Debug via web interface has hung.
I tried in terminal and its hung on *** [ DIAGNOSING ]: Dashboard headers
Should I reboot?
I still have DNS?

Pihole logs and Blocklists folder in nextcloud.

The file "Pihole terminal 16 dec 2022 .txt" contains debug output so far.

I did have them in parallel, the DNSMasq Forwarded to 3 separate piholes (for fault tolerance) .
I now have all but one is forwarded in series DNSMasq > Pihole9 > Pihole10 > Pihole8 > Internet.
I tried this because Linux was better than windows when running spotify and blocking adds.

My "upstream server" is the next one in line. DNSMasq > Pihole9 > Pihole10 > Pihole8 > Internet.

Clients ask a DNSMasq server it forwards to the Pihole the request can go thru upto 3 Piholes.

I get bored easy. I like to experiment a lot with what I have to report faults and learn how it works.
I had a car that ran on microsoft Quick BASIC 4.5 in Realtime firing the spark plugs in my car.

They all have my 1.9 million blocklist. plus the domain page in the pihole with approx 802 entries. Most times when I add a domain to one I add it to all the others. The teleport function is sometimes used between piholes. When The domain page gets this long I usually update my lists to reflect the changes in white and black lists. It gets very slow to add more when its this long.

I do a lot of testing and gathering information researching subjects with The YaCy Search Engine this can cause issues with the database. FTL very Slow to start.

1 Like

I did a reboot and it was ok.
The debug log.
https://tricorder.pi-hole.net/tzayH9LU/

The Spotify client has been sending extra Valid DNS requests to spclient.wg.spotify.com but its triggered on the back of many other microsoft DNS requests. Hence the hosts file.

I found a handy DNS program which I have been using to troubleshooting the windows > pihole setup.

Nirsost DNSSniffer

I had wireshark running as well and got a diagraph of what goes on with spotify.
I have a 4 GB packet log over 2 days with ads on spotify. My PC is too old to do much with it.

I had bat file with 6 Nslookup's running in an endless loop to test the speed of DNS in windows and check for timeouts.

With the help of Dnssniffer I was able to see the requests, some go unanswered. You could also see the triggered requests.

I ended up adding each domain as it came along.

Here's addition to the hosts file used on all my Piholes, Windows, Linux.

# dnsquerysniffer

127.0.0.1 13.224.186.35.in-addr.arpa
127.0.0.1 lh3.googleusercontent.com
127.0.0.1 dns.msftncsi.com
127.0.0.1 login.live.com
127.0.0.1 optimizationguide-pa.googleapis.com
127.0.0.1 www.msftconnecttest.com
127.0.0.1 go.microsoft.com
# tabs after microsoft.com
127.0.0.1 go.microsoft.com	
127.0.0.1 go.microsoft.com		
127.0.0.1 go.microsoft.com			
127.0.0.1 v10.events.data.microsoft.com
127.0.0.1 umwatson.events.data.microsoft.com
127.0.0.1 slscr.update.microsoft.com
127.0.0.1 teams.events.data.microsoft.com
127.0.0.1 checkappexec.microsoft.com
127.0.0.1 heads-fa.scdn.co
127.0.0.1 i.scdn.co
127.0.0.1 heads-fa.scdn.co
127.0.0.1 www.googletagservices.com
127.0.0.1 checkappexec.microsoft.com
127.0.0.1 dealer.spotify.com
# Tabs
127.0.0.1 dealer.spotify.com		
127.0.0.1 dealer.spotify.com				
127.0.0.1 dealer.spotify.com						
127.0.0.1 pagead2.googlesyndication.com
127.0.0.1 pubads.g.doubleclick.net
127.0.0.1 securepubads.g.doubleclick.net
127.0.0.1 adeventtracker.spotify.com
127.0.0.1 pubads.g.doubleclick.net
127.0.0.1 ads-eu.amillionads.com
127.0.0.1 googleads.g.doubleclick.net
127.0.0.1 insight.adsrvr.org
127.0.0.1 media-eu.amillionads.com
127.0.0.1 gcdn.2mdn.net
127.0.0.1 adeventtracker.spotify.com
127.0.0.1 evoke-windowsservices-tas.msedge.net
127.0.0.1 assets.msn.com
127.0.0.1 settings-win.data.microsoft.com
# sp-gue1 replys 127.0.0.1 before this.
127.0.0.1 ap-gue1.spotify.com
127.0.0.1 api-partner.spotify.com
127.0.0.1 ade.googlesyndication.com
127.0.0.1 video-fa.scdn.co
127.0.0.1 update.ultraviewer.net
127.0.0.1 vortex.data.microsoft.com
127.0.0.1 dc.services.visualstudio.com
127.0.0.1 bloodhound.spotify.com
127.0.0.1 dc.services.visualstudio.com
127.0.0.1 config.teams.microsoft.com
# 127.0.0.1 5.1.168.192.in-addr.arpa
127.0.0.1 b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
127.0.0.1 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
127.0.0.1 b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa	
127.0.0.1 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa	
127.0.0.1 b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa		
127.0.0.1 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa		
127.0.0.1 b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa			
127.0.0.1 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa			

127.0.0.1 248.46.232.199.in-addr.arpa
127.0.0.1 248.46.232.199.in-addr.arpa	
127.0.0.1 248.46.232.199.in-addr.arpa		
127.0.0.1 248.46.232.199.in-addr.arpa		
127.0.0.1 arc.msn.com



This was the stats yesterday after My Nslookup loop running for a few hours.
It cycled approx 2000 times according to yahoo lookups and there was the spotify clent domain with 50000 hits.

I now have no adds on spotify in windows and linux. Have Android to test later.
Nslookup work better not so many timeouts.

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.