IPv6 local hostname resolve to wrong address

Expected Behaviour:

hostname of the Pi Hole machine should resolve to its actual address.

2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 88:ae:1d:a4:cd:b5 brd ff:ff:ff:ff:ff:ff
    inet 192.168.100.2/24 brd 192.168.100.255 scope global noprefixroute enp1s0
       valid_lft forever preferred_lft forever
    inet6 2001:1284:f013:c06c::4/128 scope global dynamic noprefixroute 
       valid_lft 85423sec preferred_lft 85423sec
    inet6 2001:1284:f013:c06c:fcd5:d4dd:735f:a68d/64 scope global dynamic mngtmpaddr noprefixroute 
       valid_lft 86008sec preferred_lft 86008sec
    inet6 fe80::dbc4:eb5e:e594:7e46/64 scope link 
       valid_lft forever preferred_lft forever

Actual Behaviour:

It resolves to a wrong IPv6 addr:

fellipec@aspireone:~$ nslookup
> server 192.168.100.2
Default server: 192.168.100.2
Address: 192.168.100.2#53
> aspireone.local
Server:		192.168.100.2
Address:	192.168.100.2#53

Name:	aspireone.local
Address: 192.168.100.2
Name:	aspireone.local
Address: 2001:1284:f016:f757::1c7
Name:	aspireone.local
Address: 2001:1284:f013:5e0e::1c7
Name:	aspireone.local
Address: 2001:1284:f016:ff4b::1c7
Name:	aspireone.local
Address: 2001:1284:f013:5df1::1c7
Name:	aspireone.local
Address: 2001:1284:f016:fcbf::1c7
Name:	aspireone.local
Address: 2001:1284:f013:5457::1c7

This are some config files

fellipec@aspireone:/etc/pihole$ cat local.list
192.168.100.2 aspireone
2001:1284:f013:c06c:fcd5:d4dd:735f:a68d aspireone
192.168.100.2 pi.hole
2001:1284:f013:c06c:fcd5:d4dd:735f:a68d pi.hole
fellipec@aspireone:/etc/pihole$ cat custom.list 
192.168.100.1 router.local
192.168.100.2 aspireone.local
fellipec@aspireone:/etc/pihole$ cat /etc/hosts
127.0.0.1	localhost
127.0.1.1	aspireone

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
fellipec@aspireone:/etc/pihole$ 

Debug Token:

Your debug token is: https://tricorder.pi-hole.net/nduynkl0e8

That's a most peculiar nslookup result.

The six IPv6 addresses display a constant interface identifier of 0000:0000:0000:01c7 , while each prefix is different, which would hint at DHCPv6 assignments rather than SLAAC. (I've separated those parts for better readability):

2001:1284:f016:f757 ::1c7
2001:1284:f016:ff4b ::1c7
2001:1284:f016:fcbf ::1c7
2001:1284:f013:5e0e ::1c7
2001:1284:f013:5df1 ::1c7
2001:1284:f013:5457 ::1c7

Furthermore, these prefixes are from the public address space (2000::/3). As such, those IPv6 prefixes would be assigned by your ISP to your router, which in turn advertises or distributes it within your network.

It wouldn't yet explain the output, but can you confirm any one of those prefixes as a prefix known and used by your router in the past?

How often does your ISP assign you a new IPv6 prefix?

I am further puzzled by the absence of any of your current IPv6 addresses in that nslookup.

Let's try to re-verify that:
What's the output of:

dig @192.168.100.2 aspireone.local

Also, let's get the IPv6 addresses for all your Pi-hole machine's interfaces:

ip -6 address show

It is not yet clear where Pi-hole sources this DNS information from.

When running the above dig in a quiet moment, open a second session and watch pihole.log output.

tail -f /var/log/pihole.log

(or use Tools | Tail pihole.log )

Yes I found it very weird too. Anyways, after posting this, I got curious to read the output of the Pi Hole debug, in hope to find some clue.

First I found a link inside the logs about ULA ipv6 address. So I open my router config and found that config, and turned it from disable to automatic.

Them I keep going through Pi Hole config and found all that weird addresses in the DHCP leases table. A bit of searching and I found how to clear that leases. This solved the problem.

Now it looks fine:

Server:         192.168.100.2
Address:        192.168.100.2#53

Name:   aspireone.local
Address: 192.168.100.2
> pi.hole
Server:         192.168.100.2
Address:        192.168.100.2#53

Name:   pi.hole
Address: 192.168.100.2
Name:   pi.hole
Address: fdec:4d47:b3ab:b100:f746:bc86:40d9:81f9
> exit

fellipec@aspireone:~$ ip -6 address show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 2001:1284:f016:6a68:cf5c:dd0b:ceb9:6026/64 scope global dynamic mngtmpaddr noprefixroute
       valid_lft 86113sec preferred_lft 86113sec
    inet6 2001:1284:f013:e6c8:d960:a8b1:3be:c2fd/64 scope global dynamic mngtmpaddr noprefixroute
       valid_lft 81662sec preferred_lft 81662sec
    inet6 fdec:4d47:b3ab:b100:f746:bc86:40d9:81f9/64 scope global dynamic mngtmpaddr noprefixroute
       valid_lft 6913sec preferred_lft 3313sec
    inet6 fe80::dbc4:eb5e:e594:7e46/64 scope link
       valid_lft forever preferred_lft forever

Unfortunatelly IPv6 is still a confusing topic to me. Thanks a lot for your help.

Feel free to come back and search our forums for help on IPv6, or open a new topic if you don't find a matching answer.

One additional piece of advice, if only marginally:
You are using local as your -well- local domain, or search suffix.

Alas, local is the default domain used by the mDNS protocol as implemented e.g. by Apple's Bonjour or Linux' avahi. Mixing DNS records with mDNS names on a network, especially with different capabilities clients, may result in unexpected behaviour and potentially misleading results from networking tools, e.g. ping knows about both DNS and mDNS, while nslookup and dig are strictly DNS.

I'd recommend changing that local domain name.
Pi-hole uses lan as a default, e.g..

1 Like

Thanks for the tip about the local domain. Ah the old habits of late 90's