Expected Behaviour:
Pi-Hole working with DNS resolving
Actual Behaviour:
Pi-hole runs however i can't connect to admin panel on any other device other than the one it was setup on. Also when I put the IP of the device into the DNS section for my device I still have internet connection (even though it says i don't) but DNS's wont resolve at least i think that whats happening
Debug Token:
https://tricorder.pi-hole.net/8vlziokm9h
Can you post the browser URL that your trying to connect to ?
Did you configure the router like described below ?
https://docs.pi-hole.net/main/post-install/
The nslookup
tool run on a client is your friend.
Runs under Linux, Windows & MacOS and probably few others.
Below 10.0.0.2
is my Pi-hole setup:
C:\>nslookup pi.hole 10.0.0.2
Server: noads.dehakkelaar.nl
Address: 10.0.0.2
Name: pi.hole
Address: 10.0.0.2
C:\>nslookup pi.hole
Server: noads.dehakkelaar.nl
Address: 10.0.0.2
Name: pi.hole
Address: 10.0.0.2
C:\>nslookup doubleclick.net
Server: noads.dehakkelaar.nl
Address: 10.0.0.2
Name: doubleclick.net
Addresses: ::
0.0.0.0
Yes I have configured my router like said in the guide, when doing an nslookup it just times out
(192.168.1.101 is my pi-hole)
I've been doing more testing and its now everything isn't connecting with nslookup, but timing out each time i try to load a page ugh
What does below output on Pi-hole (might want to redact some before posting):
pihole status
grep IPV[4,6]_ADDRESS /etc/pihole/setupVars.conf
ip -4 a
sudo iptables -nL
sudo grep -v '^\s*#\|^\s*$' -R /etc/dnsmasq.* | sort | sed 's\:\ \' | column -t
nslookup pi.hole $(hostname -I)
EDIT: ow and can you copy/paste the text output instead of those screenshots pls ?
Easier to read, copy/paste etc for us.
Can enclose the output with the preformatted text button </>
after pasting here for improved readability.
[root@localhost ~]# pihole status
[β] DNS service is running
[β] Pi-hole blocking is Enabled
[root@localhost ~]# grep IPV[4,6]_ADDRESS /etc/pihole/setupVars.conf
IPV4_ADDRESS=192.168.1.101/24
IPV6_ADDRESS=
[root@localhost ~]# ip -4 a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group defaul t qlen 1000
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP gr oup default qlen 1000
inet 192.168.1.101/24 brd 192.168.1.255 scope global noprefixroute enp3s0
valid_lft forever preferred_lft forever
4: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
valid_lft forever preferred_lft forever
[root@localhost ~]# sudo iptables -nL
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:67
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:67
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 192.168.122.0/24 ctstate RELATED,ESTABLISHED
ACCEPT all -- 192.168.122.0/24 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:68
[root@localhost ~]# sudo grep -v '^\s*#\|^\s*$' -R /etc/dnsmasq.* | sort | sed 's\:\ \' | column -t
/etc/dnsmasq.conf conf-dir=/etc/dnsmasq.d
/etc/dnsmasq.conf.old conf-dir=/etc/dnsmasq.d
/etc/dnsmasq.d/01-pihole.conf addn-hosts=/etc/pihole/custom.list
/etc/dnsmasq.d/01-pihole.conf addn-hosts=/etc/pihole/local.list
/etc/dnsmasq.d/01-pihole.conf cache-size=10000
/etc/dnsmasq.d/01-pihole.conf interface=enp3s0
/etc/dnsmasq.d/01-pihole.conf localise-queries
/etc/dnsmasq.d/01-pihole.conf local-ttl=2
/etc/dnsmasq.d/01-pihole.conf log-async
/etc/dnsmasq.d/01-pihole.conf log-facility=/var/log/pihole.log
/etc/dnsmasq.d/01-pihole.conf log-queries
/etc/dnsmasq.d/01-pihole.conf no-resolv
/etc/dnsmasq.d/01-pihole.conf server=8.8.4.4
/etc/dnsmasq.d/01-pihole.conf server=8.8.8.8
/etc/dnsmasq.d/01-pihole.conf server=/use-application-dns.net/
[root@localhost ~]# nslookup pi.hole $(hostname -I)
Server: 192.168.122.1
Address: 192.168.122.1#53
** server can't find pi.hole: NXDOMAIN
Am a bit puzzled as from above, Pi-hole is configured to only answer DNS queries on the enp3s0
interface.
But from above, you seem to get an answer from the IP on the virbr0
interface.
The answer is not the correct one though:
pi@noads:~ $ nslookup pi.hole $(hostname -I)
Server: 10.0.0.2
Address: 10.0.0.2#53
Name: pi.hole
Address: 10.0.0.2
Am wondering now, do you have some other DNS resolver running on the side ?
sudo netstat -nltup | grep 'Proto\|:53 \|:67 \|:80 \|:471[1-8] '
nslookup -class=chaos -type=txt version.bind 192.168.1.101
nslookup -class=chaos -type=txt version.bind 192.168.122.1
And does below file contain the pi.hole
name with proper IP ?
cat /etc/pihole/local.list
If you want Pi-hole to resolve DNS queries on both the enp3s0
and the virbr0
interface, you can change below Pi-hole setting:
Also for diagnosing, you could try flush the firewall/iptables rules temporally just to be sure its not dropping network packets:
Below ones seems to do the trick:
sudo iptables -F
sudo iptables -X
sudo iptables -t nat -F
sudo iptables -t nat -X
sudo iptables -t nat -L -n -v
sudo iptables -t mangle -F
sudo iptables -t mangle -X
sudo iptables -P INPUT ACCEPT
sudo iptables -P OUTPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
Check afterwards with:
pi@noads:~ $ sudo iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source β¦
I an running a fresh install of CentOS
[tom@localhost ~]$ sudo netstat -nltup | grep 'Proto\|:53 \|:67 \|:80 \|:471[1-8] '
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 1255/lighttpd
tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN 1384/pihole-FTL
tcp 0 0 127.0.0.1:4711 0.0.0.0:* LISTEN 1384/pihole-FTL
tcp6 0 0 :::53 :::* LISTEN 1384/pihole-FTL
tcp6 0 0 ::1:4711 :::* LISTEN 1384/pihole-FTL
udp 0 0 192.168.122.1:53 0.0.0.0:* 2355/dnsmasq
udp 0 0 127.0.0.53:53 0.0.0.0:* 1751/systemd-resolv
udp 0 0 0.0.0.0:53 0.0.0.0:* 1384/pihole-FTL
udp 0 0 0.0.0.0:67 0.0.0.0:* 2355/dnsmasq
udp6 0 0 :::53 :::* 1384/pihole-FTL
[tom@localhost ~]$ nslookup -class=chaos -type=txt version.bind 192.168.1.101
Server: 192.168.1.101
Address: 192.168.1.101#53
version.bind text = "dnsmasq-pi-hole-2.81"
[tom@localhost ~]$ nslookup -class=chaos -type=txt version.bind 192.168.122.1
Server: 192.168.122.1
Address: 192.168.122.1#53
version.bind text = "dnsmasq-2.79"
[tom@localhost ~]$ cat /etc/pihole/local.list
192.168.1.101 localhost.localdomain
192.168.1.101 pi.hole
Also allowed listening on all interfaces but no luck
Yup, you have two DNS resolvers running.
Pi-hole's own pihole-FTL
daemon (thats got the dnsmasq
code embeded into its own code) and the dnsmasq
daemon listening on different IP's/interafces.
Try disable/stop dnsmasq
:
sudo systemctl disable dnsmasq
sudo systemctl stop dnsmasq
Restart pihole-FTL
:
sudo systemctl restart pihole-FTL
And try do a lookup agian from one of your clients (can also try run localy on Pi-hole):
nslookup -class=chaos -type=txt version.bind 192.168.1.101
nslookup pi.hole 192.168.1.101
nslookup pi-hole.net 192.168.1.101
RustedBuckett:
[tom@localhost ~]$
Ps. why did you name your system localhost
?
That is a special name already reserved and might cause issues as well:
pi@noads:~ $ cat /etc/hosts
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
[..]
Still not working, should I reboot the pi-hole?
That's weird I don't remember naming it localhost, any way i can change this?
No, we only reboot for a kernel update
Did the nslookups
run succesfull ?
Can change hostname with below:
sudo hostnamectl set-hostname <NEW_HOSTNAME>
And make sure that same name is reflected in below file:
pi@noads:~ $ cat /etc/hosts
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
127.0.1.1 noads.dehakkelaar.nl noads
nslookups
timed out like earlier
And when run on Pi-hole ?
deHakkelaar:
And try do a lookup agian from one of your clients (can also try run localy on Pi-hole):
nslookup -class=chaos -type=txt version.bind 192.168.1.101
nslookup pi.hole 192.168.1.101
nslookup pi-hole.net 192.168.1.101
On pi-hole:
[root@bucket ~]# nslookup -class=chaos -type=txt version.bind 192.168.1.101
Server: 192.168.1.101
Address: 192.168.1.101#53
version.bind text = "dnsmasq-pi-hole-2.81"
[root@bucket ~]# nslookup pi.hole 192.168.1.101
Server: 192.168.1.101
Address: 192.168.1.101#53
Name: pi.hole
Address: 192.168.1.101
[root@bucket ~]# nslookup pi-hole.net 192.168.1.101
Server: 192.168.1.101
Address: 192.168.1.101#53
Non-authoritative answer:
Name: pi-hole.net
Address: 192.124.249.118
That looks all good now.
Firewall could still drop though:
Below ones seems to do the trick:
sudo iptables -F
sudo iptables -X
sudo iptables -t nat -F
sudo iptables -t nat -X
sudo iptables -t nat -L -n -v
sudo iptables -t mangle -F
sudo iptables -t mangle -X
sudo iptables -P INPUT ACCEPT
sudo iptables -P OUTPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
Check afterwards with:
pi@noads:~ $ sudo iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source β¦
And some routers got some kind of rebind protection.
Check your router settings for similar!
What is DNS rebind protection?
If your router has an option called DNS rebind protection enabled, you may run into issues when trying to use Pi-hole as your DNS server. The reasons for this are quite technical, but to summarize what this option does in one sentence:
DNS rebind protection does not allow DNS queries to be answered with a local IP address.
Why does this interfere with Pi-hole?
DNS rebind is meant to be a countermeasure to an attack on your network . So in many cases, it's acβ¦
EDIT: ow and some AV software mangle DNS lookups:
That Windows machine you are using wouldn't run a virus scanner like AVAST?
AVAST offers a feature called RealSite that will inject additional DNS queries to a "trusted" DNS server (run by AVAST) in case something goes wrong with normal DNS resolution, see Hilfe: Windows lΓΆst Hostname auch ohne PiHole auf? - #26 by Chris80 (though German, it also contains a short solution description in English).
Did all the commands for iptables, still nothing
[root@bucket ~]# sudo iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Can't find any sort of rebind protection on my router, also looked through logs with nothing showing (TP-Link Archer VR600)
No AV Software installed (Windows DF disabled also)
Whats IP and subnet on the Windows PC ?
netsh interface ipv4 show address
Do you have another client that can run those nslookups
?
C:\Users\Tom>netsh interface ip show address
Configuration for interface "Local Area Connection"
DHCP enabled: Yes
InterfaceMetric: 6
Configuration for interface "Ethernet"
DHCP enabled: Yes
IP Address: 192.168.1.100
Subnet Prefix: 192.168.1.0/24 (mask 255.255.255.0)
Default Gateway: 192.168.1.1
Gateway Metric: 0
InterfaceMetric: 25
Configuration for interface "Ethernet 3"
DHCP enabled: Yes
InterfaceMetric: 25
Configuration for interface "Loopback Pseudo-Interface 1"
DHCP enabled: No
IP Address: 127.0.0.1
Subnet Prefix: 127.0.0.0/8 (mask 255.0.0.0)
InterfaceMetric: 75
yep, got my laptop out and ran into nslookup
timeouts
IP and subnet mask looks good.
Only thing between Pi-hole and your clients is the router.
Could assign a static IP on that laptop, connect the ethernet cable directly to Pi-hole without the router in between and run the lookups again.
Can you reword this i'm not sure I understand
-- connect the pi-hole directly to the laptop? the pi-hole is a laptop...so connect my laptop to the other laptop (pi-hole)??