Pi-hole blocking internet access for whole network

Help
18

in the debug log that I made, I found the following:

*** [ DIAGNOSING ]: Pi-hole-FTL full status
   ● pihole-FTL.service - LSB: pihole-FTL daemon
     Loaded: loaded (/etc/init.d/pihole-FTL; generated)
     Active: active (exited) since Mon 2020-12-28 18:42:08 CET; 8min ago
       Docs: man:systemd-sysv-generator(8)
    Process: 317071 ExecStart=/etc/init.d/pihole-FTL start (code=exited, status=0/SUCCESS)

dec 28 18:42:07 Waveserver systemd[1]: Starting LSB: pihole-FTL daemon...
dec 28 18:42:08 Waveserver pihole-FTL[317071]: Not running
dec 28 18:42:08 Waveserver su[317092]: (to pihole) root on none
dec 28 18:42:08 Waveserver su[317092]: pam_unix(su:session): session opened for user pihole by (uid=0)
dec 28 18:42:08 Waveserver su[317092]: pam_unix(su:session): session closed for user pihole
dec 28 18:42:08 Waveserver systemd[1]: Started LSB: pihole-FTL daemon.

Is this the problem? It says "(exited)" and "Not running".

And thanks jfb for helping. I'm going to do the nslookup thing today or tomorrow. Again thanks for helping.

EDIT: which port should I allow in my firewall? And should I allow it incoming, outgoing or both?

19

active (exited) because it's a forking process.

Not Running means that it wasn't running when asked to start so it's safe to start and not restart. Which the init script then proceeded to do. Hence Started LSB: pihole-FTL daemon.

Edit: And we know it's running since the output JFB posted shows that it's up and answering queries as it should.

20

You don't want to open any ports in your router, if that's the firewall you are referring to. No ports need to be (or should be) opened in your router for Pi-hole to operate. In particular, port 53 should NOT be open on your router, or this will expose your Pi-hole to the internet and you will have an open resolver.

Port 53 traffic is for DNS, and this needs to be open within your LAN to allow devices to communicate with each other on the LAN. This is how DNS queries get to Pi-hole from other network clients. If you have a firewall running that is stopping port 53 traffic within your LAN, this could cause the problem you see.

1 Like
21

So I allowed port 53 on my server running pihole... And it seems to be working. In ufw (on my pihole) I allowed port 53 in and out. Then I manually set the dns server on my phone to the pihole (and dns2,3 to 0.0.0.0) and googled a bit. It worked and on the dashboard it showed my ip address and requests from my phone. So it seems to be working now. And for fjb, see the following (this is after changing the firewall settings):

Nslookup pi.hole

Server: 8.8.8.8
Address: 8.8.8.8#53

** server can't find pi.hole: NXDOMAIN

Nslookup pi.hole 192.168.2.15

Server: 192.168.2.15
Address: 192.168.2.15#53

Name: pi.hole
Address: 192.168.2.15

22

This client is not using Pi-hole for DNS. It is using Google DNS.

23

This is a good result.
Now try proceed with below to finalize:

https://docs.pi-hole.net/main/post-install/

And disconnect/reconnect a test device from network so the changes propagate.
And test again on the test client with:

nslookup pi.hole

24

When I setup my phone to use pihole, my phone works. It uses pihole and it has access to the internet. When I do the nslookup commands, i get the same result as that I posted a few comments before.

But when I setup the pihole in the router, it blocks access to the internet. And it still gives the same results from nslookup.

I get these results from every setup (only phone, connected to pihole and access to the internet; the whole network, not access to the internet):

25

Do you mean for Pi-hole to be 192.168.2.15 or 192.168.2.1?

Edit: Or did you leave off the last 5 on the quote?

26

Piholes ip adress is 192.168.2.15
Gateways adress is 192.168.2.1

27

Didn't quote properly

28

If that's what you see on all the clients then Pi-hole is working on all the clients. Only Pi-hole knows what pi.hole is and can turn that in to an IP address.

If things fail when putting 192.168.2.15 as the DNS in the router then you need to look to see why the router is not using it. Could be something like a firewall, could be something like Rebind Protection, could be a whole lot. I don't think you've ever said what the router is?

29

Router model: Arcadyan VGV7519

I have never had this problem. So what should I change in the router settings. This only happened after updating to the newest version of pihole...

30

Have you setup the router DHCP service like described in that doc I posted earlier ?
If not and configured the WAN/Internet DNS settings to point to Pi-hole, you might experience some kind of router security feature like rebind protection that DanSchaper mentioned earlier:

The end goal is to have a response similar as below on a client:

C:\>nslookup pi.hole
Server:  ph5
Address:  10.0.0.4

Name:    pi.hole
Address:  10.0.0.4

C:\>nslookup flurry.com
Server:  ph5
Address:  10.0.0.4

Name:    flurry.com
Addresses:  ::
          0.0.0.0

EDIT: Dont run nslookup in a Termux session on Android!
Termux always default uses Google's public DNS service at 8.8.8.8 if not specify a DNS server.
For Android you can install the "Network Info" app that up till now reliably shows DNS servers configured.

31

I... was using termux on my phone. I didn't know termux uses 8.8.8.8 instead of the used dns.

I couldn't find any setting in my router that had to do with disabling rebind protection.

I will try the nslookup thing on my computer (win10).

Should I try after that, to uninstall pihole and install an older version? As this problem only came forward after updating... Using the second newest version should work perfectly as it only stopped working after updating the the newest version.

32

No. It is highly likely the problem is not related to the Pi-hole version.

33

On my windows 10 pc, with the (only) dns server setup as 192.168.2.15 as seen below using ipconfig /all.
image

========================================
The first command and output:

image

These outputs match so that's good.

==============================================
The second command and output:

image

These also match so that's also good.

Both commands were done only with my pc using pihole. These commands were not done using pihole as dns server in the router settings.
Do you also want the nslookup outputs when pihole is setup as dns server in the router settings (the outputs now are when only my pc is connected to pihole) or is this enough?

34

Yes, because this appears to be the configuration that is causing problems.

35

Following commands and ouputs were while pihole was setup in the routers settings as dns server and the only server (others were 0.0.0.0).

image

36

Strangely enough, it is working now. I have pihole setup as the only dns server in the router settings and I have internet access. I did nothing. Just changed the dns server from standard to pihole, and it isn't blocking now... I haven't changed anything in any settings. Since the problem started, I haven't changed any settings in the router or pihole. All I have been doing was switching between 1.1.1.1 and 192.168.2.15 in the router dns settings, for when you guys had questions or asked to do something. Everytime I changed to 192.168.2.15, internet access was blocked. Now I change it, and it isn't blocked. A great mystery why it is working now...

37

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.