IPv6 AAAA DNS Issue

Help
1

Hi, first time post from a complete PiHole newbie... Installed yesterday on an old Pi but finding ads still getting through. I have a an IP4/IPv6 home network on which the bulk of my web traffic leaves to my ISP [BT] on IPv6.

Expected Behaviour:**

I was expecting all DNS requests to known adware domains whether IPv4 or v6 [so both A & AAAA requests] would be intercepted & blocked.

Actual Behaviour:

I see that AAAA requests made from an IPv4 source are reported in the Query Log as 'OK (forwarded)' rather than 'Pi-holed (blacklist)' . The same adware domain is shown as piholed with IPv4.

Debug Token:

2068f8fsgx

I have taken a Wireshark of a Windows PC nslookup to googleads.g.doubleclick.net. Upstream DNS is set in Pihole to Google (both IPv4 & IPv6).
What I see is (in packet sequence order):

  1. PC IPv4 -> Pihole IPv4 DNS A query
  2. Pihole IPv4 -> PC IPv4 DNS response [IP given for the above googleads being the IPv4 of the pihole, so ad would be blocked)
  3. PC IPv4 -> Pihole IPv4 DNS AAAA query
  4. Pihole IPv6 -> Google IPv6 DNS AAAA query
  5. Pihole IPv4 -> Google IPv4 DNS AAAA query
  6. Google IPv6 -> Pihole IPv6 AAAA query response
  7. Google IPv4 -> Pihole IPv4 AAAA query response
  8. Pihole IPv4 -> PC IPv4 AAAA query response

So clearly the AAAA queries & responses are getting through...

I have created the following: setting analyze_AAAA=yes in /etc/pihole/pihole-FTL.conf but it seems to have no effect on what I am seeing.

Appreciate any assistance anyone can offer!
Thanks,
Chris

2

Does your device's IPv6 address match 2a00:1450:4009:80e::2002?

3

No, that looks to be the IPv6 of the googleads page

C:\Users\Chris>nslookup googleads.g.doubleclick.net 192.168.1.2
Server: raspberrypi
Address: 192.168.1.2

Name: pagead46.l.doubleclick.net
Addresses: 2a00:1450:4009:80d::2002
192.168.1.2
Aliases: googleads.g.doubleclick.net

4

What is the output of head /etc/pihole/gravity.list and head /etc/pihole/black.list

5

pi@raspberrypi:~ $ head /etc/pihole/gravity.list

192.168.1.2 0.0.0.0
2a00:23c4:49a4:8301:794d:5d06:1669:b46c/64 0.0.0.0
192.168.1.2 0000mps.webpreview.dsl.net
2a00:23c4:49a4:8301:794d:5d06:1669:b46c/64 0000mps.webpreview.dsl.net
192.168.1.2 0001.2waky.com
2a00:23c4:49a4:8301:794d:5d06:1669:b46c/64 0001.2waky.com
192.168.1.2 000143owaweboutlookappweb.myfreesites.net
2a00:23c4:49a4:8301:794d:5d06:1669:b46c/64 000143owaweboutlookappweb.myfreesites.net
192.168.1.2 000dom.revenuedirect.com

pi@raspberrypi:~ $ head /etc/pihole/black.list
pi@raspberrypi:~ $

[possibly there was googleads in the blacklist when I sent the debug]

6

Remove the /64 from your IPv6 address in /etc/pihole/setupVars.conf and run pihole -g. It looks like there may be a bug in how we generate gravity.list.

7
1 Like
8

Yes! That seems to have done the trick, the nslookup now returns only IPv4 & IPv6 of the pihole.

Thanks for your help, will resume testing.

Chris

9

Can I run pihole -up to fix the problem?

10

The fix has not been released yet. You will need to follow my previous instructions.

11

But I have /128, do I need to remove that? My public IP starts from 2406

12

Yes, any suffix of the form /*. Sorry if that wasn't clear.

1 Like
13

A post was split to a new topic: FTLDNS AAAA Queries not blocked