Pi-Hole installation problems (router blocked DNS via firewall)

Help
1

Please follow the below template, it will help us to help you!

Expected Behaviour:

On a fresh install of raspbian lite onto a Pi 3B, pi-hole would install and dns would resolve

Actual Behaviour:

Pi-hole fails to download and install FTL and others during install. Once timed out, my Pi fails to resolve dns even after adding 8.8.8.8 and 1.1.1.1 to /etc/resolv.conf

Debug Token:

Debug token failed to upload due to aforementioned reason

3

Tried changing the name server to 1.1.1.1 (Cloudflare) and I still get the same result

4

Please run the following command for me this will spit out A LOT of text but you can upload it to pastebin or directly here and it should help us determine what is going on

curl -sSL https://install.pi-hole.net | bash -vx

5

Unfortunately the install of pi-hole broke all dns function and curl cannot resolve the host install.pi-hole.net even after I change the dns in /etc/resolv.conf

6

Pleas try the following steps

  1. Change the dns in your router to a public one
  2. sudo nano /etc/resolv.conf
  3. remove EVERYTHING in there except for nameserver 9.9.9.9
  4. sudo rm -rf /etc/.pihole
  5. sudo rm -rf /etc/pihole
  6. curl -sSL https://install.pi-hole.net | bash -vx

I know you may have already tried some of this but please bear with us we want this to work just as much as you do

1 Like
7

Step 6 could not resolve the domain name.

I cannot ping google.com, but get this when I ping 8.8.8.8

PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.

64 bytes from 8.8.8.8: icmp_seq=1 ttl=122 time=12.2 ms

64 bytes from 8.8.8.8: icmp_seq=2 ttl=122 time=11.9 ms

64 bytes from 8.8.8.8: icmp_seq=3 ttl=122 time=11.8 ms

64 bytes from 8.8.8.8: icmp_seq=4 ttl=122 time=11.8 ms

64 bytes from 8.8.8.8: icmp_seq=5 ttl=122 time=12.3 ms

64 bytes from 8.8.8.8: icmp_seq=6 ttl=122 time=11.8 ms

64 bytes from 8.8.8.8: icmp_seq=7 ttl=122 time=11.8 ms

64 bytes from 8.8.8.8: icmp_seq=8 ttl=122 time=11.9 ms

64 bytes from 8.8.8.8: icmp_seq=9 ttl=122 time=12.3 ms

64 bytes from 8.8.8.8: icmp_seq=10 ttl=122 time=12.0 ms

My /etc/resolv.conf looks like

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 1.1.1.1
8

What was the full output of step 6?

9 
curl: (6) Could not resolve host: install.pi-hole.net
10

What does the output from dig install.pi-hole.net @1.1.1.1 look like?

11 
;; reply from unexpected source: 192.168.0.1#53, expected 1.1.1.1#53
;; reply from unexpected source: 192.168.0.1#53, expected 1.1.1.1#53
;; reply from unexpected source: 192.168.0.1#53, expected 1.1.1.1#53

; <<>> DiG 9.10.3-P4-Raspbian <<>> install.pi-hole.net @1.1.1.1
;; global options: +cmd
;; connection timed out; no servers could be reached

Looks like my modem/router is doing something when I install pi-hole?

12

You have a firewall rule or some kind of routing that is intercepting traffic on port 53 and redirecting it to 192.168.0.1. It may be rebind protection from your router but that usually is used to in the opposite way, to prevent a local DNS server from responding. This setup is preventing remote DNS servers from responding.

13

Thanks! Found the firewall rules (thanks ISP for setting up a firewall :slightly_frowning_face: Do I need both traffic in and out or just out?

14

Just need traffic outbound to external port 53. Do not open inbound port 53 as that will allow other users to access your Pi-hole installation and that is a bad thing.

1 Like
15

Thanks @DanSchaper, @jfb, @technicalpyro, @anon55913113 for all the help! That resolved my issues entirely! Now to get that dumb ISP device into a working bridge mode :slight_smile:

16

Glad to hear its working. Most of the trouble setting things up does end up with working on the router to figure out the exact magic configuration.

1 Like
17

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.