Hello everyone. Installed pi-hole for the first time. Running very well on a RPi 4. Very cool SW
Three beginner's questions if I may:
a) An huge amount of the queries (approx 50K over a total of 70k) are generated by a long term torrent client seeding Linux distro images. Is there a way to ask pi-hole not to show the queries to those 4-5 domains as they swamp the "real" traffic?
b) After a couple days running with approx. 380k domains on the blocklist I see 5.8% of blocked queries. Is this "normal"?
c) As the RPi4 does not have IPv6 configured, PiHole did not allow me to configure it but still I see a 40% of AAAA queries. What does this mean? Who's resolving those?
Thank you very much.
Cheers from Italy. Keep safe, keep sane
Settings > API/Web interface Enter any clients of domains you want to remove from top 10 lists and query logs.
That's completely dependent on what block lists you have installed and how many "bad" items devices on your network are trying to lookup. https://firebog.net/ is a good source of additional block lists.
Those are AAAA queries via IPv4. Your upstream provider will try to resolve them. You can ignore them as they are normal. You don't suddenly have IPv6 running.
No. Pi-hole logs all traffic equally, based on privacy settings.
There is an option to remove domains or clients from the "top" lists, but that does not extend to overall statistics or the query log.
It depends. Each network (with different clients, browsing habits and blocklists) is different. In your specific case, given that 50 out of 70 queries are not blocked, that puts the maximum block rate (assuming every other DNS request was blocked, which will not be the case) at about 28%. You likely won't approach that.
Take a look at the top domains and see what is not being blocked. If there are any domains that you don't recognize right off, then Google those domains and see what they do.
Typically, throwing more blocklists in your Pi-hole won't change the block rate much, since your clients and browsing habits will be the same.