DNS wont resolve :(

Expected Behaviour:

Pi-Hole working with DNS resolving

Actual Behaviour:

Pi-hole runs however i can't connect to admin panel on any other device other than the one it was setup on. Also when I put the IP of the device into the DNS section for my device I still have internet connection (even though it says i don't) but DNS's wont resolve :frowning: at least i think that whats happening

Debug Token:

https://tricorder.pi-hole.net/8vlziokm9h

Can you post the browser URL that your trying to connect to ?
Did you configure the router like described below ?

https://docs.pi-hole.net/main/post-install/

The nslookup tool run on a client is your friend.
Runs under Linux, Windows & MacOS and probably few others.
Below 10.0.0.2 is my Pi-hole setup:

C:\>nslookup pi.hole 10.0.0.2
Server:  noads.dehakkelaar.nl
Address:  10.0.0.2

Name:    pi.hole
Address:  10.0.0.2

C:\>nslookup pi.hole
Server:  noads.dehakkelaar.nl
Address:  10.0.0.2

Name:    pi.hole
Address:  10.0.0.2

C:\>nslookup doubleclick.net
Server:  noads.dehakkelaar.nl
Address:  10.0.0.2

Name:    doubleclick.net
Addresses:  ::
          0.0.0.0

Yes I have configured my router like said in the guide, when doing an nslookup it just times out :confused:
(192.168.1.101 is my pi-hole)
image
I've been doing more testing and its now everything isn't connecting with nslookup, but timing out each time i try to load a page ugh

What does below output on Pi-hole (might want to redact some before posting):

pihole status

grep IPV[4,6]_ADDRESS /etc/pihole/setupVars.conf

ip -4 a

sudo iptables -nL

sudo grep -v '^\s*#\|^\s*$' -R /etc/dnsmasq.* | sort | sed 's\:\ \' | column -t

nslookup pi.hole $(hostname -I)

EDIT: ow and can you copy/paste the text output instead of those screenshots pls ?
Easier to read, copy/paste etc for us.
Can enclose the output with the preformatted text button </> after pasting here for improved readability.

[root@localhost ~]# pihole status
  [βœ“] DNS service is running
  [βœ“] Pi-hole blocking is Enabled
[root@localhost ~]# grep IPV[4,6]_ADDRESS /etc/pihole/setupVars.conf
IPV4_ADDRESS=192.168.1.101/24
IPV6_ADDRESS=
[root@localhost ~]# ip -4 a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group defaul                                                                             t qlen 1000
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP gr                                                                             oup default qlen 1000
    inet 192.168.1.101/24 brd 192.168.1.255 scope global noprefixroute enp3s0
       valid_lft forever preferred_lft forever
4: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN                                                                              group default qlen 1000
    inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
       valid_lft forever preferred_lft forever
[root@localhost ~]# sudo iptables -nL
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:53
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:53
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:67
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:67

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            192.168.122.0/24     ctstate RELATED,ESTABLISHED
ACCEPT     all  --  192.168.122.0/24     0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:68
[root@localhost ~]# sudo grep -v '^\s*#\|^\s*$' -R /etc/dnsmasq.* | sort | sed 's\:\ \' | column -t
/etc/dnsmasq.conf              conf-dir=/etc/dnsmasq.d
/etc/dnsmasq.conf.old          conf-dir=/etc/dnsmasq.d
/etc/dnsmasq.d/01-pihole.conf  addn-hosts=/etc/pihole/custom.list
/etc/dnsmasq.d/01-pihole.conf  addn-hosts=/etc/pihole/local.list
/etc/dnsmasq.d/01-pihole.conf  cache-size=10000
/etc/dnsmasq.d/01-pihole.conf  interface=enp3s0
/etc/dnsmasq.d/01-pihole.conf  localise-queries
/etc/dnsmasq.d/01-pihole.conf  local-ttl=2
/etc/dnsmasq.d/01-pihole.conf  log-async
/etc/dnsmasq.d/01-pihole.conf  log-facility=/var/log/pihole.log
/etc/dnsmasq.d/01-pihole.conf  log-queries
/etc/dnsmasq.d/01-pihole.conf  no-resolv
/etc/dnsmasq.d/01-pihole.conf  server=8.8.4.4
/etc/dnsmasq.d/01-pihole.conf  server=8.8.8.8
/etc/dnsmasq.d/01-pihole.conf  server=/use-application-dns.net/
[root@localhost ~]# nslookup pi.hole $(hostname -I)
Server:         192.168.122.1
Address:        192.168.122.1#53

** server can't find pi.hole: NXDOMAIN

Am a bit puzzled as from above, Pi-hole is configured to only answer DNS queries on the enp3s0 interface.

But from above, you seem to get an answer from the IP on the virbr0 interface.
The answer is not the correct one though:

pi@noads:~ $ nslookup pi.hole $(hostname -I)
Server:         10.0.0.2
Address:        10.0.0.2#53

Name:   pi.hole
Address: 10.0.0.2

Am wondering now, do you have some other DNS resolver running on the side ?

sudo netstat -nltup | grep 'Proto\|:53 \|:67 \|:80 \|:471[1-8] '

nslookup -class=chaos -type=txt version.bind 192.168.1.101

nslookup -class=chaos -type=txt version.bind 192.168.122.1

And does below file contain the pi.hole name with proper IP ?

cat /etc/pihole/local.list

If you want Pi-hole to resolve DNS queries on both the enp3s0 and the virbr0 interface, you can change below Pi-hole setting:

image

Also for diagnosing, you could try flush the firewall/iptables rules temporally just to be sure its not dropping network packets:

I an running a fresh install of CentOS

[tom@localhost ~]$ sudo netstat -nltup | grep 'Proto\|:53 \|:67 \|:80 \|:471[1-8] '
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1255/lighttpd       
tcp        0      0 0.0.0.0:53              0.0.0.0:*               LISTEN      1384/pihole-FTL     
tcp        0      0 127.0.0.1:4711          0.0.0.0:*               LISTEN      1384/pihole-FTL     
tcp6       0      0 :::53                   :::*                    LISTEN      1384/pihole-FTL     
tcp6       0      0 ::1:4711                :::*                    LISTEN      1384/pihole-FTL     
udp        0      0 192.168.122.1:53        0.0.0.0:*                           2355/dnsmasq        
udp        0      0 127.0.0.53:53           0.0.0.0:*                           1751/systemd-resolv 
udp        0      0 0.0.0.0:53              0.0.0.0:*                           1384/pihole-FTL     
udp        0      0 0.0.0.0:67              0.0.0.0:*                           2355/dnsmasq        
udp6       0      0 :::53                   :::*                                1384/pihole-FTL   
[tom@localhost ~]$ nslookup -class=chaos -type=txt version.bind 192.168.1.101
Server:		192.168.1.101
Address:	192.168.1.101#53

version.bind	text = "dnsmasq-pi-hole-2.81"
[tom@localhost ~]$ nslookup -class=chaos -type=txt version.bind 192.168.122.1
Server:		192.168.122.1
Address:	192.168.122.1#53

version.bind	text = "dnsmasq-2.79"
[tom@localhost ~]$ cat /etc/pihole/local.list
192.168.1.101 localhost.localdomain
192.168.1.101 pi.hole

Also allowed listening on all interfaces but no luck

Yup, you have two DNS resolvers running.
Pi-hole's own pihole-FTL daemon (thats got the dnsmasq code embeded into its own code) and the dnsmasq daemon listening on different IP's/interafces.

Try disable/stop dnsmasq:

sudo systemctl disable dnsmasq

sudo systemctl stop dnsmasq

Restart pihole-FTL:

sudo systemctl restart pihole-FTL

And try do a lookup agian from one of your clients (can also try run localy on Pi-hole):

nslookup -class=chaos -type=txt version.bind 192.168.1.101

nslookup pi.hole 192.168.1.101

nslookup pi-hole.net 192.168.1.101

Ps. why did you name your system localhost ?
That is a special name already reserved and might cause issues as well:

pi@noads:~ $ cat /etc/hosts
127.0.0.1       localhost
::1             localhost ip6-localhost ip6-loopback
[..]

Still not working, should I reboot the pi-hole?

That's weird I don't remember naming it localhost, any way i can change this? :thinking:

No, we only reboot for a kernel update :wink:
Did the nslookups run succesfull ?

Can change hostname with below:

sudo hostnamectl set-hostname <NEW_HOSTNAME>

And make sure that same name is reflected in below file:

pi@noads:~ $ cat /etc/hosts
127.0.0.1       localhost
::1             localhost ip6-localhost ip6-loopback
ff02::1         ip6-allnodes
ff02::2         ip6-allrouters

127.0.1.1       noads.dehakkelaar.nl  noads

nslookups timed out like earlier :sob:

And when run on Pi-hole ?

On pi-hole:

[root@bucket ~]# nslookup -class=chaos -type=txt version.bind 192.168.1.101
Server:         192.168.1.101
Address:        192.168.1.101#53

version.bind    text = "dnsmasq-pi-hole-2.81"
[root@bucket ~]# nslookup pi.hole 192.168.1.101
Server:         192.168.1.101
Address:        192.168.1.101#53

Name:   pi.hole
Address: 192.168.1.101
[root@bucket ~]# nslookup pi-hole.net 192.168.1.101
Server:         192.168.1.101
Address:        192.168.1.101#53

Non-authoritative answer:
Name:   pi-hole.net
Address: 192.124.249.118

That looks all good now.
Firewall could still drop though:

And some routers got some kind of rebind protection.
Check your router settings for similar!

EDIT: ow and some AV software mangle DNS lookups:

  • Did all the commands for iptables, still nothing
[root@bucket ~]# sudo iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

  • Can't find any sort of rebind protection on my router, also looked through logs with nothing showing (TP-Link Archer VR600)
  • No AV Software installed (Windows DF disabled also)

Whats IP and subnet on the Windows PC ?

netsh interface ipv4 show address

Do you have another client that can run those nslookups ?

C:\Users\Tom>netsh interface ip show address

Configuration for interface "Local Area Connection"
    DHCP enabled:                         Yes
    InterfaceMetric:                      6

Configuration for interface "Ethernet"
    DHCP enabled:                         Yes
    IP Address:                           192.168.1.100
    Subnet Prefix:                        192.168.1.0/24 (mask 255.255.255.0)
    Default Gateway:                      192.168.1.1
    Gateway Metric:                       0
    InterfaceMetric:                      25

Configuration for interface "Ethernet 3"
    DHCP enabled:                         Yes
    InterfaceMetric:                      25

Configuration for interface "Loopback Pseudo-Interface 1"
    DHCP enabled:                         No
    IP Address:                           127.0.0.1
    Subnet Prefix:                        127.0.0.0/8 (mask 255.0.0.0)
    InterfaceMetric:                      75

yep, got my laptop out and ran into nslookup timeouts

IP and subnet mask looks good.
Only thing between Pi-hole and your clients is the router.
Could assign a static IP on that laptop, connect the ethernet cable directly to Pi-hole without the router in between and run the lookups again.

Can you reword this i'm not sure I understand :slight_smile:

-- connect the pi-hole directly to the laptop? the pi-hole is a laptop...so connect my laptop to the other laptop (pi-hole)??