Dockerised Pihole breaks normal internet use

Actual Behaviour:

Currently I am seeing that any device in my network will experience a really slow load of a website or sometimes even be unable to load a site or service which breaks the expected user experience.
I suspect this has something to do with the blocking behaviour which is discussed here: Why do some sites take forever to load when using Pi-hole? (for versions < v4.0) - #33 by stevejenkins

However I was unsuccessful in configuring the premade docker container in such a way that enabling those mentioned rules would have any effect. I just used a terminal connection into the container, set up iptables and iptables-persistent and wrote out those rules and they seemed to have done nothing to alleviate the issue.

Examples:

  • Half the time simply googling something in the browser address bar will set the loading in motion for anywhere from 15s to a few minutes until Google's search page either loads or times out.
  • Sites like Reddit, Stack Overflow, Medium, Hacker News, Atlassian services and many others are slow to load or break on load.
  • Streaming services such as YouTube (even with s.youtube.com whitelisted), Channel 4, Disney+, Netflix, Discovery+ and others experience weird behaviour where ad rolls could play once, start loading content of the show and error out and load a new roll of ads and then play content normally. Sometimes they just won't play ads OR content at all.
  • Youtube sometimes wont load history or wont play content even with YouTube premium sub.

A lot of other sites and services my family uses become inaccessible or break. That is to say, I can somehow see this failure pattern, reboot the container and for a very brief time see a remission in failures and then it is back to being awful.

Expected Behaviour:

I would expect DNS blocks on ad domains to somehow notify the calling client with some form of reset/block consistently enough such that it does not sit there waiting to time out and make it seem like the home network is FUBAR.

Setup at home:

TalkTalk ISP, Sagemcom FAST 5364 AC1200 (the only one online resembling mine, but could be a diff model iteration).

  • Router is set to handle DHCP as per defaults
  • Router uses my rig as DNS at address 192.168.1.10 (static IP)
  • My rig runs docker and pihole container with the following yaml config for compose:
services:
  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "80:80/tcp"
    environment:
      TZ: 'Europe/London'
      WEBPASSWORD: '<REDACTED>'
    volumes:
      - './etc-pihole:/etc/pihole'
      - './etc-dnsmasq.d:/etc/dnsmasq.d'
    cap_add:
      - NET_ADMIN
      - NET_RAW
    restart: unless-stopped
    network_mode: 'bridge' # (Host does not make it accessible via web at all)
  • With the current set up - any device connected to my wifi or via wire should by default use pihole with 0 setup being needed.
  • DNS servers in use for upstream (only ipv4 since no device I know of in my network uses ipv6 and my router does not have ipv6 settings exposed in any menu):
    • OpenDNS (ECS, DNSSEC)
    • Quad9 (filtered, DNSSEC)
    • Quad9 (unfiltered, no DNSSEC)
    • Cloudflare (DNSSEC)

Now before you say "that's a lot of DNS to use" -- I used them all individually at first, and when nothing helped, I enabled them all at once as a group and the speed/slowdowns did not get worse or better..

Happy to provide more info..

Debug Token:

https://tricorder.pi-hole.net/QYH8z7nX/

Note that that thread is specfically for a very old version of Pi-hole (4.0 or earlier). We issued V5 in May 2020, more than three years ago.

This is not a reasonable expectation. When Pi-hole blocks a domain it returns the NULL IP to the client (0.0.0.0), which tells the client that there is nothing at that domain name. The client will then skip it and move on to the next domain request. We use the NULL reply as the default as discussed here:

https://docs.pi-hole.net/ftldns/blockingmode/

Nothing in your debug log indicates a problem, but your single adlist was not accessible during the most recent gravity update, which typically indicates a network connectivity problem:

-rw-r--r-- 1 root root 97 Sep 19 16:39 /etc/resolv.conf
   nameserver 192.168.65.7

*** [ DIAGNOSING ]: Pi-hole diagnosis messages
   count   last timestamp       type                  message                                                       blob1                 blob2                 blob3                 blob4                 blob5               
   ------  -------------------  --------------------  ------------------------------------------------------------  --------------------  --------------------  --------------------  --------------------  --------------------
   1       2023-09-19 16:39:46  ADLIST                https://raw.githubusercontent.com/StevenBlack/hosts/master/h  1                                                                                                           
                                                      osts                                                                                                                                                                      

  [2023-09-19 16:39:46.184 275/T300] ADLIST WARNING: Adlist with ID 1 (https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts) was inaccessible during last gravity run

Have you verified that this is the case?

From a client that you believe should be connected to the Pi-Hole for DNS, from the command prompt or terminal on that client (and not via ssh or Putty to the Pi), what is the output of

nslookup pi.hole

nslookup flurry.com

nslookup flurry.com 172.17.0.2

That's a strange one since it happens sporadically, not constantly, and even though the adlist was not accessible, I was able to reach some sites at the time plus also consider that gravity had the previous list in it anyway. This to me is less of a focus since I never actually dropped internet connectivity, I have however lost the ability to resolve domain names strangely enough from everything I had witnessed..

I ran nslookups on various addresses based on pihole help threads and also used dig as well and to be frank sometimes they returned an error and sometimes it resolved as you would expect. It's inconsistent. That is the issue, really.

The thing is, when I remove the pihole host IP (my main machine) from my router as the DNS server, my entire house can use the internet without a single issue, dropped connection, slowly resolving site or any other weirdness. I have confirmed this via just not using pihole since Saturday morning.

Conversely, the moment I change the router's setting to use my pc as the DNS ( since this is where the dockerised pihole lives), I can almost immediately see some apple devices (no they do not use private relay) start seeing pages load slower on safari, some streaming services on those pages also begin failing. Seeing as we all have apple devices like iphones or ipads, it is easy enough to verify they are using pihole by simply going to the wifi settings > info > configure dns > (automatic) < 192.168.1.10.

The only wired device in the house is my pc, and that of course also goes through pihole.

So right now I am confused as to why what seems like the most basic setup of my favourite software is essentially breaking my internet connectivity out of nowhere.

To add to this - I have also tried to let pihole use my ISP's upstream servers again which did not seem to help at all from testing. And as mentioned in the original post - around 3-4 months ago this was never a problem and had never occurred. And to add - nothing changed in the house, the router, or anywhere else. In fact, I have gone as far as reinstalling my windows on the pc when I upgraded my CPU in august, I also then reset the router to factory default and set up pihole once more hoping stuff will shake out, but none of it ever did.. I am quite confused at the moment. The only thing I had done is consistently upgrade to the latest pihole image as one became available.

Two questions:

  1. Are you running docker on Linux or Docker Desktop (Windows or MacOS)?

  2. from the command prompt on your PC, please run these commands and post the output:

    nslookup pi.hole
    
    nslookup flurry.com
    
    nslookup flurry.com 192.168.1.10
    
    nslookup flurry.com 172.17.0.2
    

1: Docker on windows but using WSL2 backend.

2:

nslookup pi.hole:
    # First attempt:
    PS C:\Users\tom> nslookup pi.hole
    Server:  UnKnown
    Address:  192.168.1.10

    DNS request timed out.
        timeout was 2 seconds.
    DNS request timed out.
        timeout was 2 seconds.
    Name:    pi.hole
    Address:  0.0.0.0

    # Second attempt:
    PS C:\Users\tom> nslookup pi.hole
    Server:  UnKnown
    Address:  192.168.1.10

    Name:    pi.hole
    Address:  0.0.0.0

nslookup flurry.com
    # Both attempts:
    PS C:\Users\tom> nslookup flurry.com
    Server:  UnKnown
    Address:  192.168.1.10

    DNS request timed out.
        timeout was 2 seconds.
    DNS request timed out.
        timeout was 2 seconds.
    Name:    flurry.com
    Addresses:  ::
            0.0.0.0


nslookup flurry.com 192.168.1.10
    # Both attempts:
    PS C:\Users\tom> nslookup flurry.com 192.168.1.10
    Server:  UnKnown
    Address:  192.168.1.10

    DNS request timed out.
        timeout was 2 seconds.
    DNS request timed out.
        timeout was 2 seconds.
    Name:    flurry.com
    Addresses:  ::
            0.0.0.0

nslookup flurry.com 172.17.0.2
    # Both attempts:
    PS C:\Users\tom> nslookup flurry.com 172.17.0.2
    DNS request timed out.
        timeout was 2 seconds.
    Server:  UnKnown
    Address:  172.17.0.2

    DNS request timed out.
        timeout was 2 seconds.
    DNS request timed out.
        timeout was 2 seconds.
    DNS request timed out.
        timeout was 2 seconds.
    DNS request timed out.
        timeout was 2 seconds.
    *** Request to UnKnown timed-out

During this time I could navigate to https://music.apple.com/us/browse however it hung on "resolving host.." for about a minute. While spotify, github and artstation would not even open, simply resulting in Edge saying: " www.artstation.com ’s server IP address could not be found."

Then when I reloaded those pages again after waiting a bit they slowly resolved. It took a while for them to load.

No matter how much I retried your commands, I could not get the resolutions on anything but the pihole host.

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.