Cloudflared can't use Dns over Https

[stavrosmachinima]

Pihole doesn't forward my queries to upstream Cloudflared DNS server.

Details about my system:
I am using Pihole on a raspberry pi 4. I am also running an upstream DNS Cloudflared server in port 5053 in order to use the Encryption over Https(DOH).

The problem is that the status of my queries are OK (answered by localhost#5053) and NOT OK (forwarded to localhost#5053).

https://1.1.1.1/help tells me I am not using Cloudflared and not DOH either.

In the third picture the following error appears:

failed to connect to an HTTPS backend "https://1.1.1.1/dns-query" error="failed to perform an HTTPS request: Post "https://1.1.1.1/dns-query\": context deadline exceed> (Client.Timeout exceeded while awaiting headers)"

Also to note is that for query "fedoraproject.org" my client is 192.168.1.68 but in the query log it lists my router client 192.168.1.1.

Does anybody know how to resolve this? Do you think this is a network issue?

[chrislph]

@stavrosmachinima

The problem is that the status of my queries are OK (answered by localhost#5053) and NOT OK (forwarded to localhost#5053).

That's normal. From Pi-hole's perspective it is getting its answers from its upstream server(s) which in your case is localhost#5053.

Can you create a debug log and post the token URL here please? That will help shed some light on how it's all set up. You can use either pihole -d in a terminal, or Tools > Generate debug log in the web interface.

[Bucking_Horn]

@stavrosmachinima

ERR failed to connect to an HTTPS backend "https://1.1.1.1/dns-query" error="failed to perform an HTTPS request: Post "[https://1.1.1.1/dns-query\](https://1.1.1.1/dns-query%5C)": context deadline exceed> (Client.Timeout exceeded while awaiting headers)"

That's cloudflared's ERR message.
A precursory search in their forums turns up some hits, e.g. https://community.cloudflare.com/t/cloudflared-access-login-works-but-returns-timeout-error/412033

You should consider to also consult Cloudflare's community for support.

[stavrosmachinima]

Debug log created. Url is here:

https://tricorder.pi-hole.net/4czFNHcD/

[jfb]

@stavrosmachinima

Pihole doesn't forward my queries to upstream Cloudflared DNS server.

@stavrosmachinima

my queries are OK (answered by localhost#5053) and NOT OK (forwarded to localhost#5053).

Your debug log shows that it does forward your queries to Cloudflared, and the Cloudflared software is correctly answering the queries:

   Aug 31 19:18:18 dnsmasq[2359]: query[A] tricorder.pi-hole.net from 192.168.1.1
   Aug 31 19:18:18 dnsmasq[2359]: forwarded tricorder.pi-hole.net to 127.0.0.1#5053
   Aug 31 19:18:18 dnsmasq[2359]: reply tricorder.pi-hole.net is <CNAME>
   Aug 31 19:18:18 dnsmasq[2359]: reply docker-2-ny1.pi-hole.net is 164.90.255.4

@stavrosmachinima

https://1.1.1.1/help tells me I am not using Cloudflared and not DOH either.

This website is not known to produce accurate results in your situation.

Your clients are using Pi-hole, which in turn is using Cloudflared, which in turn forwards the queries to a Cloudflare server. The test you are running shows only the first part, not the final destination.

[jfb]

@stavrosmachinima

Also to note is that for query "fedoraproject.org" my client is 192.168.1.68 but in the query log it lists my router client 192.168.1.1.

Why do I only see my router's IP address instead of individual devices in the Top Clients section and Query Log?

A nice feature of Pi-hole is that you can see which network devices are sending out the most DNS queries. For every device that is using Pi-hole as their DNS server, you can also see which DNS queries each one has made. [image] But depending on a few things, you may only see a single host in your Top Clients section, which is not as useful. [image] This isn't detrimental to the performance of your Pi-hole; it just provides you with less insight into what's happening on your network. So w…