Initial install looks good but clients fail to resolve DNS

Please follow the below template, it will help us to help you!

Expected Behaviour:

Expected behavior is for Pi-hole to resolve DNS requests.

Pi-hole server is Centos 8 on a Dell Latitude E6420 laptop. Test client is Windows 10. Both hardwired to the same switch.

Actual Behaviour:

No response to DNS requests from the Pi-hole. I can ping it, and the Pi-hole server does successfully resolve DNS requests using the Cloudflare DNS servers. It's like Pi-hole isn't there. The test client works again after pointing DNS back to being provided by the DHCP servers.

I'm manually flipping between manually setting the test clients DNS to the Pi-hole and then back to DHCP provided.

Pi-hole's DHCP server is disabled.

I tried all 3 states of listening under Settings->DNS.

Selinux is in permissive mode.

From the Windows 10 client

PS C:\Users\monah> nslookup google.com
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 192.168.68.11

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
*** Request to UnKnown timed-out

Debug Token:

https://tricorder.pi-hole.net/oma21g8cde

Thank you

Looks like a firewall or network issue. Pi-hole is able to dig itself on all required IP addresses.


*** [ DIAGNOSING ]: Name resolution (IPv4) using a random blocked domain and a known ad-serving domain
[âś“] itau30hrs.com is 0.0.0.0 via localhost (127.0.0.1)
[âś“] itau30hrs.com is 0.0.0.0 via Pi-hole (192.168.68.11)
[âś“] doubleclick.com is 172.217.11.14 via a remote, public DNS server (8.8.8.8)

Edit: Does nslookup pi.hole give any response?

From Pi-hole server doesn't find it.

[root@unix-lt ~]# nslookup pi.hole
Server: 1.1.1.1
Address: 1.1.1.1#53

** server can't find pi.hole: NXDOMAIN

[root@unix-lt ~]#

That nslookup is using 1.1.1.1 and not Pi-hole so NXDOMAIN is expected. You'll only get a response if the client is actually using Pi-hole.

Sorry. My misunderstanding. This one is from a client.

PS C:\Users\monah> nslookup pi.hole
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 192.168.68.11

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
*** Request to UnKnown timed-out

That one doesn't look much better. Are there any queries from clients being shown in the Pi-hole log? Try using the Tail function from the admin webpage or pihole -t.

The only activity has been from the computer running Pi-hole.

[root@unix-lt ~]# pihole -t
[i] Press Ctrl-C to exit
18:13:23: query[A] itau30hrs.com from 127.0.0.1
18:13:23: gravity blocked itau30hrs.com is 0.0.0.0
18:13:23: query[A] itau30hrs.com from 192.168.68.11
18:13:23: gravity blocked itau30hrs.com is 0.0.0.0
18:14:00: query[PTR] 11.68.168.192.in-addr.arpa from 127.0.0.1
18:14:00: /etc/pihole/local.list 192.168.68.11 is unix-lt
19:00:00: query[PTR] 11.68.168.192.in-addr.arpa from 127.0.0.1
19:00:00: /etc/pihole/local.list 192.168.68.11 is unix-lt
20:00:00: query[PTR] 11.68.168.192.in-addr.arpa from 127.0.0.1
20:00:00: /etc/pihole/local.list 192.168.68.11 is unix-lt

I set another client running linux to use the Pi-hole server for DNS and it also times out for "pi.hole" and "google.com". The error was ";; connection timed out; no servers could be reached"

I should have thought of the firewall on the Pi-hole computer before. I'm assuming port 5353 is all that's needed?

[root@unix-lt ~]# firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: eno1
sources:
services: cockpit dhcpv6-client samba ssh
ports: 32400/tcp 32469/tcp 8324/tcp 3005/tcp 32412/udp 32413/udp 32414/udp 32410/udp 1900/udp 5353/udp 80/tcp
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:

I'm

DNS uses TCP/UDP 53.

Hi Dan,

It's working great now. I know the iptables commands are provided, but I only dabble in linux and all the recent CentOS articles used firewall-cmd. It took me a little bit to find a DNS example for firewall-cmd.

firewall-cmd –zone=public –add-port=53/tcp –permanent
firewall-cmd –zone=public –add-port=853/tcp –permanent
firewall-cmd –zone=public –add-port=53/udp –permanent

Thanks for your help!

You just needed to move one paragraph down:

Edit: Please review that link, you may have actually opened port 53 to the world with your commands.

2 Likes

Thank you again. I backed out my dns changes and put in the ones from the web page. I don't know how I missed those on the web page. I was text searching them. It would have saved you a lot of time, but I learned a little.

-Chris

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.