Pi-Hole blocking zero requests despite all traffic going through Pi-Hole and all blocklists enabled

[Buzz4President]

Expected Behaviour:

Pi-Hole blocking requests.

Raspberry Pi 4 Model 4 B 2GB
All system info is attached in screenshots. Both RPi and Pi-Hole are updated to most recent versions.

Actual Behaviour:

Pi-Hole blocking 0 queries. I have set the Pi to DHCP as well. Have over 600 thousand blockers. When I first set this up, it was working fine for a couple of days. Then, it stopped blocking anything. I have attempted both a repair and re-install using pihole reconfigure and this has not helped. I believe I have all of my network traffinc going through the pi-hole, as I can see over 25 thousand requests over the last 24 hours. I've attached as much system info as I can via screenshots. If you need more info, please let me know.

I am a bit of a novice when it comes to this level of technology. Please be patient with me and I will do my best. Thank you in advance for the help.

Debug Token: https://tricorder.pi-hole.net/rxw5it4yhz

[DanSchaper]

Does the query log show any queries and what the result of the queries are? Blocked, forwarded, etc...

Also you have some bad regex entries in your setup, the ones below are not the correct format for what Pi-hole uses. They look like adblockplus format.

   16      2         1  0             @@||www.kqzyfj.com^$important                                                                         2021-06-15 17:19:40  2021-06-15 17:19:40                                                    
   18      2         1  0             @@||www.emjcd.com^$important                                                                          2021-06-15 17:19:40  2021-06-15 17:19:40                                                    
   19      2         1  0             @@||zola.pxf.io^$important                                                                            2021-06-15 17:19:40  2021-06-15 17:19:40                                                    
   20      2         1  0             @@||api.bam-x.com^$important                                                                          2021-06-15 17:19:40  2021-06-15 17:19:40                                                    
   21      2         1  0             @@||fonts.gstatic.com^$important                                                                      2021-06-15 17:19:40  2021-06-15 17:19:40                                                    
   22      2         1  0             @@||api.narrativ.com^$important                                                                       2021-06-15 17:19:40  2021-06-15 17:19:40                                                    
   23      2         1  0             @@||go.skimlinks.com^$important                                                                       2021-06-15 17:19:40  2021-06-15 17:19:40                                                    
   24      2         1  0             @@||www.ojrq.net^$important                                                                           2021-06-15 17:19:40  2021-06-15 17:19:40                                                    
   25      2         1  0             @@||s.pinimg.com^$important                                                                           2021-06-15 17:19:40  2021-06-15 17:19:40  

[Buzz4President]

Hi there.

Thanks for the quick response. I removed all of the bad regex entries you mentioned and it seems to be blocking queries again. I'll keep an eye on it over the next 24 hours to make sure it's back to normal. Great catch!

[DanSchaper]

Great! Glad it was a quick fix!

@jfb or @Bucking_Horn Is there anything in those regex entries that stick out to you that could cause this?

[yubiuser]

Can confirm no blocking after adding those:

chrko@ThinkPad-X230:~$ dig flurry.com

; <<>> DiG 9.11.3-1ubuntu1.15-Ubuntu <<>> flurry.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50771
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1472
;; QUESTION SECTION:
;flurry.com.			IN	A

;; ANSWER SECTION:
flurry.com.		300	IN	A	212.82.100.150
flurry.com.		300	IN	A	98.136.103.23
flurry.com.		300	IN	A	74.6.136.150

;; Query time: 114 msec
;; SERVER: 10.0.1.5#53(10.0.1.5)
;; WHEN: Sat Jun 19 19:46:49 CEST 2021
;; MSG SIZE  rcvd: 87

---

I think it is this part || which matches everything...

[Bucking_Horn]

I concur with yubiuser's analysis.

And in addition, I do not think that those strings are meant to be parsed as regex expressions. Whatever reads them is surely evaluating the important part somehow, which wouldn't make much sense in a generic regex. (Maybe AdBlockPlus -as DanSchaper has suggested- would be able to convert that into meaning when reading it.)

Discarding them seems the right choice.

[DanSchaper]

@yubiuser

I think it is this part || which matches everything...

That's the direction I was heading with my question. Trying to figure out what character strings actually triggered the condition. Thanks for confirming that those entries cause blocking to stop.

Enabling regex debugging might show it, or it may just show that every query is matched by a regex entry.

[Buzz4President]

Hi all,

Since removing the regex entries, everything seems to be fine for the past 24 hours. Just wanted to let everyone know things are good on end user side.

Thanks again for the help here. Let me know if you need anything else from me.