Pi-hole cluster, disparate stats and hosts lists between devices

[0x00100100]

Details: headless pihole cluster, primary on rpi pizero 2 W, secondary on rpi pizero 1 W, gravity-synced. Cloudflare for Families ipv4/6 upstream with DNSSEC enabled listening on eth0. No ipv4/6 DNS leaks, per a few websites. No other services running on either pizero.

The primary pihole is good. I recently reflashed primary with latest rasp pi os and reinstalled pihole. Not because of any os or pihole issues, but because I had tried to install and configure Openvpn after pi-hole while most tutorials describe installing Openvpn first. Idk what happened, I could connect remotely and use pihole, but it was not hiding my home ip. Trying to fix that I misconfigured routing tables with the help of ChatGPT and broke everything. We were both too stupid to fix them, and it became apparent the quickest fix was a complete reinstall then teleporter to upload settings. Anyway, I digress...

The secondary pihole may be acting up. It has significantly less traffic but also significantly less percentage of ads blocked lately. They are synced, as noted, almost 3M domains. I have checked the settings on both piholes and I think they are the same. It is working and blocking. But while primary pihole is blocking 15-25%, the secondary has been only 1-10% over the last 24 hours. Is this expected since all devices are pointing to primary pihole as their primary dns? Should I invert them on a few devices for more manual load-balancing?

Abouts hosts file: I have duplicated the /etc/hosts files on both piholes. Current method, I copy/paste or manually enter on each via console ssh sessions. I have checked that custom.lists are both blank or renamed on both because it seems that hosts file is preferred, and I don't think there are any other entries in dnsmasq.d interfering with hosts file. So... ipv6 is enabled on both. I know, not needed but our requests seem pretty evenly distributed between ip4/6. But this is where it gets weird for me again, even though host entries seem to be same on both, only the secondary pihole shows ipv6 addresses without host names in dashboard stats. Why would the primary dashboard have nice neat client stats all mapped to the hosts file while the secondary is a mess with a mix of 4/6 addreses?

Considering both of my "issues", disparate % ads blocked and host mapping, on what used to be a tighter pair of piholes... is it normal behaviour, stupid human error, or should I reinstall, maybe on new sd card? Maybe its fine...?

Should I upload logs?

Is there a tutorial on configuring OpenVPN AFTER pi-hole is installed? I need the vpn active for remote access. But I don't want to break my pihole again in the process.

Thanks in advance.

edit: I saw in another post to run:
nslookup flurry.com 192.168.0.30
nslookup flurry.com 192.168.0.40

I don't know what that does, or what it means, but all requests time out.

[jfb]

@0x00100100

Is this expected

Yes. Given multiple DNS servers, clients are free to use any of them. Apple devices (in my experience) tend to stick to the first server listed, but other OS's tend to wander.

@0x00100100

Should I invert them on a few devices for more manual load-balancing?

There is no need to do this. Either Pi-hole can handle the entire load. Let the clients use whichever they prefer.

[Bucking_Horn]

@0x00100100

But while primary pihole is blocking 15-25%, the secondary has been only 1-10% over the last 24 hours.

This seems perfectly normal.
Percentage blocked by itself is purely a statistical piece of information on the amount of blocked queries during the last (at most) 24 hours - it is not an indication of how effectively your Pi-hole is operating.

@0x00100100

Is there a tutorial on configuring OpenVPN AFTER pi-hole is installed?

Have a look at Guides | VPN from https://docs.pi-hole.net.

@0x00100100

I saw in another post to run:
nslookup flurry.com 192.168.0.30
nslookup flurry.com 192.168.0.40

I don't know what that does, or what it means, but all requests time out.

That would be expected, unless your two Pi-holes accidentally would happen to live at the same 192.168.0.30 and 192.168.0.40 IP addresses.

[0x00100100]

Thanks for you replies. I am an idiot, I ran nslookup to MY pihole ip's and all resolved.

An iPhone hammering the primary dns would explain the difference in % blocked if, as mentioned by Mod jfb, apple devices really prefer the primary dns.

I will re-read the VPN tutorials for like the tenth time... but as I noted, they describe OpenVPN install then Pi-hole, and they bounce around between cloud and local installs, and it is really confusing to try to follow along, if pi-hole is already installed. Some of us started simple and want to add functionality to an existing setup without breaking stuff. Simple and official tutorials on configuration of OpenVPN (and UFW) *post pi-hole install would be really helpful.

[Bucking_Horn]

More recent Pi-hole's default listening mode should cover the machine's local interfaces, including the tunnel ones. It shouldn't matter if you installed Pi-hole first.
If required, just run pihole -r with Reconfigure for the tunnel network interface.

[deHakkelaar]

FYI, below is client distribution (preference) for a mixture of Android's, Ipads, Linux clients and a single Windows gaming machine:

Setting up two pihole instances, one as secondary local DNS

And: pi@ph5a:~ $ nc localhost 4711 <<< '>stats >quit' [..] dns_queries_today 6943 pi@ph5b:~ $ nc localhost 4711 <<< '>stats >quit' [..] dns_queries_today 2217 EDIT: And the second node (b) is a Pi 1B+ compared to node 1 (a) which is an older Pi 1B (without the +).