Pi-Hole not working with Apple devices

Help
1

Unfortunately I can only confirm the previous posts. PiHole with wifi or VPN runs on all devices without problems and unwanted content is successfully blocked... Except on Apple devices... On apple devices not a single page can be called outside the local network. A white empty page is all you get to see. I also deactivated the assignment of ipv6 addresses on the router because the first posts pointed out a problem in this area. But also here no improvement. In the Querry log or in the terminal I don't see any hints that anything is blocked.

@ThinkPad can you possibly explain in more detail which settings you changed where so you could do it?

My setup is the following :

Pi 3+ with PiHole PIVPN and DNSCrypt

Router refers via DNS entry to the raspberry, raspberry forwards to DNSCrypt and DNSCrypt outside. No iptables rules are set up.

2

I move this to a new thread, as the older thread was resolved.

Please upload a debug log and post your token. If you have a screen capture of what you are seeing on your Apple device(s), please post that as well.

3

Hey jfb. Thanks for moving.

The debug token is : 7twv8wtum0

Unfortunately I cannot provide a screenshot at the moment because it is a problem with the setup of a friend. As soon as you want to load a page, the loading bar stops at about 10%, nothing more is visible. We also tried different browsers, but each with the same result.

4

What Apple devices were affected? Just one, or more than one?

5

An iPhone X is certainly affected, another iPhone 7 is in the network, but has not yet been extensively tested.

6

Is this your Pi-Hole and the friend can't connect to it?

7

The Raspberry is in the network of the named friend. I can access the Raspberry via VPN to read logs or to create a debug token like in this case. I also have full root access to the Raspberry and the friends router, so I can post config files here if you wish.

8

A few things noted in the debug log

*** [ DIAGNOSING ]: Networking
[✓] IPv4 address(es) bound to the eth0 interface:
   192.168.178.20/24 does not match the IP found in /etc/pihole/setupVars.conf (https://discourse.pi-hole.net/t/use-ipv6-ula-addresses-for-pi-hole/2127)

[✓] IPv6 address(es) bound to the eth0 interface:
   2a02:1205:503a:6070:73eb:3e74:f1a0:b804 does not match the IP found in /etc/pihole/setupVars.conf (https://discourse.pi-hole.net/t/use-ipv6-ula-addresses-for-pi-hole/2127)
   fe80::4346:950e:a9e:8d9e does not match the IP found in /etc/pihole/setupVars.conf (https://discourse.pi-hole.net/t/use-ipv6-ula-addresses-for-pi-hole/2127)

In this section, the Pi-Hole IP in line 3 should be the external IP of the Pi-Hole, not the NULL IP (0.0.0.0).

*** [ DIAGNOSING ]: Name resolution (IPv4) using a random blocked domain and a known ad-serving domain
[✓] mozcloud.net is 0.0.0.0 via localhost (127.0.0.1)
[✓] mozcloud.net is 0.0.0.0 via Pi-hole (0.0.0.0)
[✓] doubleclick.com is 172.217.168.46 via a remote, public DNS server (8.8.8.8)

In this section, your Pi-Hole is also shown as IP 0.0.0.0. This should be the public IP of the Pi device (the static IP assigned from the router).

    -rw-r--r-- 1 root root 126 Oct 14 20:33 /etc/pihole/local.list
       0.0.0.0 PiHole
       0000:0000:0000:0000:0000:0000:0000:0000 PiHole
       0.0.0.0 pi.hole
       0000:0000:0000:0000:0000:0000:0000:0000 pi.hole

What upstream DNS server is Pi-Hole using?

9

I used the following instructions to redirect the PiHole to DNSCrypt (unfortunately still in the dns-crypt version 1.)

/etc/dnsmasq.d/02-dnscrypt.conf:

# Add other name servers here, with domain specs if they are for
# non-public domains.
server=127.0.0.2#41
server=127.0.0.3#41

/etc/systemd/system/dnscrypt-proxy@cs-ch.socket:

[Unit]
Description=dnscrypt-proxy cs-ch listening socket

[Socket]
ListenStream=127.0.0.2:41
ListenDatagram=127.0.0.2:41

[Install]
WantedBy=sockets.target

After a closer look I see that DNS-Crypt can no longer connect to the servers properly. I will probably deactivate this. I still find it strange that it seems to work on all other devices except the iphone(s).

Oct 15 00:18:41 PiHole dnscrypt-proxy[557]: Mon Oct 15 00:18:41 2018 [INFO] Refetching server certificates
Oct 15 00:18:56 PiHole dnscrypt-proxy[557]: Mon Oct 15 00:18:56 2018 [ERROR] Unable to retrieve server certificates

At the beginning I had problems with the loading time for different pages. When I changed the settings to NULL-IP the pages loaded much faster. Where would this have to be configured correctly?

10

If I were you, I would stop using DNSCrypt, uninstall it, and have Pi-Hole go directly to a third party upstream DNS server (Cloudflare, Quad 9, etc.). That will make troubleshooting problems easier.

Then, once all the devices can work with Pi-Hole, add DNSCrypt 2.0) back into the setup and see if everything still works.

What is your primary purpose for using DNSCrypt? There might be another solution that can meet your needs.

11

There is no specific reason why i use dnscrypt. i came across it by chance and read that it effectively protects against man-in-the-middle attacks. That's why I wanted to try this, which worked wonderfully in the beginning. There is no real need for.

Then I can simply add the DNS servers (of the ISP) to setupVars.conf to bypass DNS crypt?

12

You can change DNS servers in that file or through the Web GUI interface (settings > DNS).

13

Unbound will do the same thing. It is set up to be a local resolver, and it completely bypasses the third party DNS providers. It has authentication as well, to prevent MIM attacks. Very easy to setup using this guide. You might want to try this after you get all the devices working on Pi-Hole again.

https://docs.pi-hole.net/guides/unbound/

1 Like
14

I will try it on a test system as soon anything else is working.

i created another debug log with the following token: o0p2414zm8. The IP address errors you mentioned are now at least gone. If this setup will work on the mentioned iphone I can't answer right away because we have 1 o'clock in the morning and my friend is sleeping now.

but I'll certainly get back to you as soon as I know more. Unless you have something else to change? I like to thank you for your patience and your help.

15

These have changed (improved):

*** [ DIAGNOSING ]: Networking
[✓] IPv4 address(es) bound to the eth0 interface:
   192.168.178.20/24 matches the IP found in /etc/pihole/setupVars.conf

*** [ DIAGNOSING ]: Name resolution (IPv4) using a random blocked domain and a known ad-serving domain
[✓] tosimplify.net is 0.0.0.0 via localhost (127.0.0.1)
[✓] tosimplify.net is 0.0.0.0 via Pi-hole (192.168.178.20)
[✓] doubleclick.com is 172.217.168.46 via a remote, public DNS server (8.8.8.8)

This has not

   -rw-r--r-- 1 root root 126 Oct 14 20:33 /etc/pihole/local.list
       0.0.0.0 PiHole
       0000:0000:0000:0000:0000:0000:0000:0000 PiHole
       0.0.0.0 pi.hole
       0000:0000:0000:0000:0000:0000:0000:0000 pi.hole
16

to clarify this. also enter the local ipv4/v6 address of the raspberry in local.list?

17

Done. Now the output is this:

-rw-r--r-- 1 root root 116 Oct 15 01:18 /etc/pihole/local.list
   192.168.178.20 PiHole
   fe80::4346:950e:a9e:8d9e/64 PiHole
   192.168.178.20 pi.hole
   fe80::4346:950e:a9e:8d9e/64 pi.hole
18

hmm now i have the problem that generally no more pages can be resolved, so there is currently no possibility to upload the debug log (but still can login via VPN). Should I paste the complete output here or only a certain part of it?

19

Try to this to repair.

sudo nano /etc/resolv.conf

Change 127.0.0.1 to 1.1.1.1, save and exit

pihole -r

and select repair

20

Thank you. The resolve is now working again.

the current token is f2jfnv4h2m. If you have nothing to add I will reply as soon as I have heard from my friend.

1 Like