# In-app ads are blocked if connected via VPN, not via wlan

**URL:** <https://discourse.pi-hole.net/t/in-app-ads-are-blocked-if-connected-via-vpn-not-via-wlan/10897>\
**Category:** Help\
**Created:** [July 14, 2018, 5:49pm UTC](https://discourse.pi-hole.net/t/in-app-ads-are-blocked-if-connected-via-vpn-not-via-wlan/10897 "2018-07-14T17:49:20Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![s36474352](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/5f8ce5/32.png) [@s36474352](https://discourse.pi-hole.net/u/s36474352)\
**Post date:** [July 14, 2018, 5:49pm UTC](https://discourse.pi-hole.net/t/in-app-ads-are-blocked-if-connected-via-vpn-not-via-wlan/10897/1 "2018-07-14T17:49:20Z")

</div>

Hi, i've set up an Orange Pi Zero Plus with OpenVPN + Pi-hole following [this](https://docs.pi-hole.net/guides/vpn/overview/) guide. I've skipped the "Firewall configuration" section since i'm running the board behind a firewalled router and "Only route DNS via VPN" because i want to use the VPN as normal.  
192.168.100.104 is the static internal IP of my board.  
10.8.0.2 is the DHCP assigned IP address of my phone when connected to my home network via OpenVPN.  
I'm 100% sure my phone uses the Pi-hole board as DNS resolver. Thanks in advance

## Expected Behaviour:

In-app ads (from games riddled with ads like [Helix Jump](https://play.google.com/store/apps/details?id=com.h8games.helixjump)) should be blocked both if i'm connected to my network via OpenVPN and if i'm connected via local WLAN

## Actual Behaviour:

In-app ads [are blocked only if i'm connected with OpenVPN](https://0bin.net/paste/5j9xBbBTpvSYtMJ7#zAyvdifJN3Ipjpr+afaXublU9qqEMqfsh2HFAOMRKFv). When i'm at home and connected via WLAN in-app ads are normally loaded and pihole -t doesn't show queries from my phone. When i exit from the game and try to load infested websites, ads are blocked as expected.

## Debug Token:

k2u53wowdj

---

<div class="post-metadata">

**Author:** ![Mcat12](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mcat12/32/20_2.png) [@Mcat12](https://discourse.pi-hole.net/u/Mcat12)\
**Post date:** [July 14, 2018, 6:54pm UTC](https://discourse.pi-hole.net/t/in-app-ads-are-blocked-if-connected-via-vpn-not-via-wlan/10897/2 "2018-07-14T18:54:51Z")

</div>

If you can't see the queries in the log, then the device isn't sending the queries to Pi-hole, or dnsmasq is not listening, however the latter case is not an issue because dnsmasq is told to listen on all interfaces. Perhaps the apps are using local versions of ads for some reason? Do you see ads if you turn off internet connectivity?

---

<div class="post-metadata">

**Author:** ![s36474352](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/5f8ce5/32.png) [@s36474352](https://discourse.pi-hole.net/u/s36474352)\
**Post date:** [July 14, 2018, 9:36pm UTC](https://discourse.pi-hole.net/t/in-app-ads-are-blocked-if-connected-via-vpn-not-via-wlan/10897/3 "2018-07-14T21:36:43Z")

</div>

Indeed dnsmasq is listening on all interfaces and working, as it blocks other types of ads. I've fired up WireShark on my pc and i couldn't see any traffic on port 53 coming from/to my Android phone. I've triple checked the WiFi settings on said phone:

- Network Info II shows that the current DNS server is indeed my Pi-hole board
- Running `getent | grep 'net\.dns'` from a terminal emulator on the phone returns correct DNS server address
- When i disable WiFi i can load a-ads.com without problems, when on WiFi connection the page is blocked as expected and a Pi-hole information page comes up.
- Also, when on WiFi i can access [http://pi.hole](http://pi.hole) while i can not access it if i'm on 3G mobile data connection.

I've then rooted my phone and installed a packet sniffer to intercept all requests from/to my phone and interestingly enough, no DNS requests are made in an attempt to load ads, so your theory of caching would be correct. I still can't explain why requests are sent and blocked as expected when connecting via OpenVPN. Clearly the problem isn't in Pi-hole, so if you want to close this issue or mark it as solved please do. But i'd still like to investigate on why in-app ads manage to escape DNS requests while on WiFi

---

<div class="post-metadata">

**Author:** ![Mcat12](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mcat12/32/20_2.png) [@Mcat12](https://discourse.pi-hole.net/u/Mcat12)\
**Post date:** [July 14, 2018, 9:58pm UTC](https://discourse.pi-hole.net/t/in-app-ads-are-blocked-if-connected-via-vpn-not-via-wlan/10897/4 "2018-07-14T21:58:42Z")

</div>

Do you see requests made when using OpenVPN, where you don't see them on normal Wifi?

---

<div class="post-metadata">

**Author:** ![s36474352](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/5f8ce5/32.png) [@s36474352](https://discourse.pi-hole.net/u/s36474352)\
**Post date:** [July 14, 2018, 11:20pm UTC](https://discourse.pi-hole.net/t/in-app-ads-are-blocked-if-connected-via-vpn-not-via-wlan/10897/5 "2018-07-14T23:20:42Z")

</div>

From a `pihole -t` perspective, yes. Starting with the game Helix Jump killed (swiped from recents) and with mobile 3G connection, i open Helix Jump and ads load and display normally. Don't see anything on `pihole -t` logs (of course).

I kill Helix Jump, enable WiFi and check with Network Info II that wlan parameters are correct, then i launch Helix Jump and again ads load normally. Nothing on `pihole -t` (strange).

I kill Helix Jump once again, but before reopening it i connect to the VPN. In the game no ad is loaded, and i can see attempts to reach ads domains successfully blocked from `pihole -t` (see 0bin attachment in OP).

The last test is with VPN on but using mobile data. Same behavior as WiFi + VPN, the ads are blocked as expected.

---

<div class="post-metadata">

**Author:** ![Mcat12](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mcat12/32/20_2.png) [@Mcat12](https://discourse.pi-hole.net/u/Mcat12)\
**Post date:** [July 15, 2018, 2:39am UTC](https://discourse.pi-hole.net/t/in-app-ads-are-blocked-if-connected-via-vpn-not-via-wlan/10897/6 "2018-07-15T02:39:51Z")

</div>

It might be that the DNS entries are cached.

---

<div class="post-metadata">

**Author:** ![s36474352](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/5f8ce5/32.png) [@s36474352](https://discourse.pi-hole.net/u/s36474352)\
**Post date:** [July 15, 2018, 11:19am UTC](https://discourse.pi-hole.net/t/in-app-ads-are-blocked-if-connected-via-vpn-not-via-wlan/10897/7 "2018-07-15T11:19:22Z")

</div>

I've uninstalled the game, cleaned the system cache and reinstalled it: the ads still appear and no request is logged on Pi-hole. Clearly it's not caching ads, but rather retrieving them in other ways.

I've downloaded an app wich does traceroute and dig: this app also managed to escape Pi-hole and i could traceroute domains that were supposed to be blocked. I though maybe it used a hardcoded server to dig/traceroute instead of the local resolvers, so i downloaded another [dig app](https://play.google.com/store/apps/details?id=com.turbobytes.dig) which shows the server you're querying and lets you choose from a predefined list of servers available on the device. Then it clicked: the pre-selected server to query was fe80::1%wlan0 instead of 192.168.100.104.  
So probably Android has some failover mechanism that switched to DHCPv6 DNS servers which on my router were the ISP-assigned defaults! I then proceeded to change the DHCPv6 DNS servers to static addresses and set the IPv6 equivalent of my Pi-hole board and then it worked.

Could this be wiki-worth information?

---

<div class="post-metadata">

**Author:** ![Mcat12](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mcat12/32/20_2.png) [@Mcat12](https://discourse.pi-hole.net/u/Mcat12)\
**Post date:** [July 15, 2018, 4:54pm UTC](https://discourse.pi-hole.net/t/in-app-ads-are-blocked-if-connected-via-vpn-not-via-wlan/10897/8 "2018-07-15T16:54:11Z")

</div>

This is handled on installation, where the installer tells you to use the IPv4 and IPv6 addresses for DNS.

---

<div class="post-metadata">

**Author:** ![s36474352](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/5f8ce5/32.png) [@s36474352](https://discourse.pi-hole.net/u/s36474352)\
**Post date:** [July 15, 2018, 7:43pm UTC](https://discourse.pi-hole.net/t/in-app-ads-are-blocked-if-connected-via-vpn-not-via-wlan/10897/9 "2018-07-15T19:43:22Z")

</div>

Oh ok, i might overlooked that. So, if my ISP doesn't provide ipv6 internet access, but on the modem/router they have given me ipv6 is enabled LAN-side, and can't be disabled, should i reconfigure Pi-hole to block also ipv6 requests? Sorry but ipv6 still has me confused.

---

<div class="post-metadata">

**Author:** ![Mcat12](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mcat12/32/20_2.png) [@Mcat12](https://discourse.pi-hole.net/u/Mcat12)\
**Post date:** [July 15, 2018, 8:47pm UTC](https://discourse.pi-hole.net/t/in-app-ads-are-blocked-if-connected-via-vpn-not-via-wlan/10897/10 "2018-07-15T20:47:31Z")

</div>

If you don't have IPv6 internet access, then this FAQ is relevant:

> [@Why do blacklisted domains show IPv4 as "Pi-holed" but not IPv6 in the query log?](https://discourse.pi-hole.net/t/why-do-blacklisted-domains-show-ipv4-as-pi-holed-but-not-ipv6-in-the-query-log/3652):
>
> This behavior can be fixed by setting AAAA\_QUERY\_ANALYSIS=no in /etc/pihole/pihole-FTL.conf (you need to [create this file if it doesn't exist](https://github.com/pi-hole/FTL#ftls-config-file)). If you still see blacklisted IPv6 domains show as forwarded in your query log but don't have IPv6 enabled, you may see a false positive like the image below, where the IPv4 version of the domain is blocked, but not the IPv6 version. root@pihole:~ $ cat /etc/pihole/gravity.list | grep edge.quantserve.com 192.168.1.126 edge.quantserve.com [image] I…

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [August 5, 2018, 8:47pm UTC](https://discourse.pi-hole.net/t/in-app-ads-are-blocked-if-connected-via-vpn-not-via-wlan/10897/11 "2018-08-05T20:47:40Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.