Pi-Hole not blocking all on iPhone

[Firemanjoe]

So, setting up the DHCP server on my pi was a new approach for me as I was having issues with my router handling it.

My question is that if I go onto the Pi-Hole Ad-Test page with both my phone and my MBP, I'm getting different results. Even after I have rebooted my phone. My phone is only blocking some of the ads; while my MBP is blocking others or almost all of them. Shouldn't I have the same results?

Where can I start troubleshooting this? My phone is showing connected on the DHCP Server lease list; however, I've been noticing less than expected performance while I'm connected on my phone via VPN to my network to help me block ads...

Thanks again for the awesome service!

[jfb]

On the MBP, check that your IPV6 settings are link-local. Then flush the DNS cache - from Mac OS terminal put in the following command:

sudo killall -HUP mDNSResponder; sleep 2; echo macOS DNS Cache Reset | say

Also, please run a debug log and upload it, and post the token here. Thanks.

[Firemanjoe]

I'll run those in a moment... but I'm actually getting better results on my MBP and not my phone... make sense? I am seeing a different IPv6 on my phone and non on my MBP... could that be part of the problem?

Also, my IPv6 are currently off on my MBP... should I turn them on and see what the results are?

[jfb]

No. Leave the MBP alone and work on phone. IOS or Android?

[Firemanjoe]

IOS - Debug - w4149fkdk8

[jfb]

Do the same on the IOS phone. Ensure it has the DNS of your Pi-Hole listed and nothing else.

To clear DNS cache on IOS device, just put into airplane mode for about 10 seconds. When you turn airplane mode off, caches are cleared.

[Firemanjoe]

I'm not very familiar working with IPv6, so how do I check? when I look at my DNS config on my phone, I have it set to automatic and I'm getting my .4 IPv4, but the IPv6 appears to be different then my router...

I've put it into AP mode and back active....

[jfb]

If you don't see an IPV6 address on your iPhone, it doesn't have one assigned. I have IPV6 turned off on my network, and here's my network settings page on the phone:

If you have an IPV6 address, it came from the router and it won't match the address of the router. IPV6 is different than IPV4 in a lot of respects.

[Firemanjoe]

Yes, I have 5 IPV6 addresses on my network. I do see that it came from my router as well... as you mentioned. I could always turn off the IPV6 Support on my router... not sure if that would be beneficial or not....

[jfb]

Go ahead and do that for now. You also have your Pi-Hole DCHP set for IPV6 addresses.

I noted in your debug log that you are running a whole lot of upstream DNS providers for your Pi-Hole. Why so many?

    PIHOLE_DNS_1=8.8.8.8
    PIHOLE_DNS_2=8.8.4.4
    PIHOLE_DNS_3=2001:4860:4860:0:0:0:0:8888
    PIHOLE_DNS_4=2001:4860:4860:0:0:0:0:8844
    PIHOLE_DNS_5=208.67.222.222
    PIHOLE_DNS_6=208.67.220.220
    PIHOLE_DNS_7=2620:0:ccc::2
    PIHOLE_DNS_8=2620:0:ccd::2
    PIHOLE_DNS_9=84.200.69.80
    PIHOLE_DNS_10=84.200.70.40
    PIHOLE_DNS_11=2001:1608:10:25:0:0:1c04:b12f
    PIHOLE_DNS_12=2001:1608:10:25:0:0:9249:d69b
    PIHOLE_DNS_13=9.9.9.9
    PIHOLE_DNS_14=149.112.112.112
    PIHOLE_DNS_15=2620:fe::fe
    PIHOLE_DNS_16=1.1.1.1
    PIHOLE_DNS_17=1.0.0.1
    PIHOLE_DNS_18=2606:4700:4700::1111
    PIHOLE_DNS_19=2606:4700:4700::1001

[Firemanjoe]

Ok, I've turned off the IPV6 support on the router and disabled it on pi-hole as well.

As for the upstream DNS providers, probably because I don't have a clear understanding of what they do or how I should have it set up to maximize my "safety".

[jfb]

Upstream DNS providers don't have any relation to your safety. They are simply a resository of DNS addresses that Pi-Hole goes to if it needs an address.

The way it works - client requests DNS address from PiHole. PiHole checks its block list (they are aggregated lists of domains that are blocked), it's black lists, and it's white list. if the domain is on a block list or a black list, Pi-Hole relies with NULL (which is 0.0.0.0) and the browser won't be able to get to the blocked domain. If the DNS request was for something on a whitelist or not blocked, if Pi-Hole has the answer in cache it sends it back. Only if none of these conditions apply does Pi-Hole go to one of the upstream servers to get the real IP address.

You only need a few of these. I recommend using the Cloudflare stuff (fast, doesn't log, etc.). Get rid of the rest, there is no improvement using all of them.

Here is a good discussion on the commonly used third party DNS options: GitHub - pi-hole/pi-hole: A black hole for Internet advertisements

[Firemanjoe]

Ok, I'll do that! Also, I've checked the ads being blocked on the pi-hole test page and I'm getting the same results now! YAY!!

Edit: Also, thanks for the link! I'm going to read up on that tomorrow - cause it's way past my bedtime! I appreciate the help and I think that this has solved my problem, but I need to learn more about IPV6 and how to configure it to work properly.

[jfb]

Excellent! Glad to help and come back to this thread if you have continuing problems with your Pi-Hole blocking on your devices.

[Firemanjoe]

I will!

Just a quick question before I go... I know that we've run out of IPV4's addresses which is why the IPV6 is out there, but if I leave it turned off, I shouldn't technically run into any issues as 99.999999% of sites out there are still running both correct?

[jfb]

No. We haven't run out of IPV4 addresses quite yet, since almost every home network is on the same private IP ranges (so they get re-used over and over at various houses and don't interfere with each other because they are behind routers).

There is an occasional IPV6-only site out there and at some point you may want to revisit IPV6, but for now you have your Pi-Hole running and blocking ads on your devices.

I and some of the developers don't run IPV6 at all and we don't have problems with that setup.

[Firemanjoe]

Awesome!

Thanks again for all the help!

[Firemanjoe]

I’ve noticed that ads aren’t being blocked on my iPhone while I’m on VPN. How can I track down the culprit or is this a different problem?