You should put your routers IP address in that spot "<ASUS_ROUTER_IP_ADDRESS>" when running the nmap command.
It will show you the DNS server(s) pushed via DHCP.
Depends if your router dishes out two DNS servers to its clients.
This will cause ads to leak through like mentioned in the other thread.
try putting 192.168.1.252 into both fields i.e. in alternative as well as the preferred server
You should put your routers IP address in that spot “ <ASUS_ROUTER_IP_ADDRESS> ” when running the nmap command.> Blockquote
I have entered it like:
<192.168.1.252>
<ASUS_ROUTER_IP_ADDRESS>
<ASUS_ROUTER_192.168.1.252>
<192.168.1.1>
<ASUS_ROUTER_192.168.1.1>
I have disabled the DCHP on the router, doesn't work.
Example with 10.0.0.2 doing DHCP on my network:
xbian@avr ~ $ sudo nmap -sU -p67 --script dhcp-discover 10.0.0.2
Starting Nmap 7.40 ( https://nmap.org ) at 2019-02-21 06:31 CET
Nmap scan report for noads.dehakkelaar.nl (10.0.0.2)
Host is up (0.00066s latency).
PORT STATE SERVICE
67/udp open dhcps
| dhcp-discover:
| DHCP Message Type: DHCPACK
| Server Identifier: 10.0.0.2
| Subnet Mask: 255.255.255.0
| Broadcast Address: 10.0.0.255
| Domain Name Server: 10.0.0.2
| Domain Name: dehakkelaar.nl
| Hostname: avr
|_ Router: 10.0.0.1
MAC Address: B8:27:EB:EE:1B:BD (Raspberry Pi Foundation)
Nmap done: 1 IP address (1 host up) scanned in 4.20 secondsIs 192.168.1.1 your Asus router ?
If so, try below:
sudo nmap -sU -p67 --script dhcp-discover 192.168.1.1
It worked!
Basically I have two DNS's. I don't remember putting my router ip as my dns in either the pi or the router.
If a client gets two or more DNS servers assigned that are not Pi-holed, you can imagine this breaking the ad blocking when the clients query the other DNS occasionally.
Me and the user from the other thread were not able to get ride of that second DNS IP coming from the Asus router.
Thats why we disabled the DHCP service on the router and activated Pi-hole's own DHCP service as a replacement:
EDIT: Dont forget to renew DHCP leases on the clients when switching DHCP!
Leases get renewed when disconnecting and reconnecting clients from network or reboot them.
Might also want to clear browser cache and if know how, clear OS DNS cache too.
Your screenshot looks like a Windows PC.
To clear OS DNS cache from a Windows command prompt:
ipconfig /flushdns
I switched the DCHP from the router to the pi-hole via, turning off the router's dchp and activating the pi-hole's dchp. I then cleared cache (ccleaner and going into brave and clearing stuff there) and flushed the dns. I later rebooted the router (I did this in the router 192.168.1.1).
I have noticed that the dchp renew on the router is set to about 3.6 years (I am still learning new stuff here) vs the pi-hole is set to 1 day. I didn't touch anything there.
Is there anything I missed or something else I need to do next, https://beta.speedtest.net/ still shows ads when brave ad blocker is turned off.
I dont spot a single ad on that site.
What DNS server(s) are displayed when running below one in a command prompt on that Windows client ?
ipconfig /all
And whats outcome from below one on the Windows client:
nslookup pi.hole
And below one on Pi-hole:
echo '>stats' | nc localhost 4711
Did you try having 192.168.1.252 in both "preferred" as well as "alternative" dns server fields?
My Asus firmware only allows to enter one external DNS server.
So thats no go.
Are you sure? This was taken from the above:
Thats the WAN part of the router.
The DHCP part, the one handing out the DNS servers to the clients, only has one DNS field:
I did change it later
DHCP Enabled. . . . . . . . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.1.133(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
Server: raspberrypi
Address: 192.168.1.252
Name: pi.hole
Address: 192.168.1.252
It's currently 192.168.1.252
This bit shows your Windows client still got its IP details via DHCP from the router.
Are you sure the routers DHCP service is disabled ?
What is results now on Pi-hole for below one ?
sudo nmap -sU -p67 --script dhcp-discover 192.168.1.1
And maybe reboot the Windows box to be sure it renews its DHCP lease ?
The nslookup output looks good.
If you run below one targeting a naughty domain on the Pi-hole blocklist, you'll notice the IP address gets redirected to 0.0.0.0 instead of the real actual IP address for that domain:
nslookup doubleclick.com
But you missed posting DNS servers from the ipconfig /all output on the Windows box ?
And what bout below one ?
-Then this is what I got in the prompt in the pi:
pi@raspberrypi:~ $ sudo nmap -sU -p67 --script dhcp-discover 192.168.1.1
Starting Nmap 7.40 ( https://nmap.org ) at 2019-02-22 12:33 PST
Nmap scan report for 192.168.1.1
Host is up (0.00062s latency).
PORT STATE SERVICE
67/udp closed dhcps
MAC Address: 18:31:BF:05:F4:30 (Unknown)
Nmap done: 1 IP address (1 host up) scanned in 3.98 seconds
** server can't find doubleck.com: NXDOMAIN
I did the ipconfig /all in windows and rebooted it, I am still seeing ads on https://www.speedtest.net/
I'll go ahead and do it again after posting this.
Then finally:
pi@raspberrypi:~ $ echo '>stats' | nc localhost 4711
domains_being_blocked 112523
dns_queries_today 19164
ads_blocked_today 6181
ads_percentage_today 32.253181
unique_domains 4531
queries_forwarded 7718
queries_cached 5265
clients_ever_seen 20
unique_clients 13
dns_queries_all_types 19164
reply_NODATA 113
reply_NXDOMAIN 1956
reply_CNAME 4262
reply_IP 10787
privacy_level 0
status enabled
---EOM---
