Pi-hole on ethernet not blocking for wireless clients (Orbi router)

Please follow the below template, it will help us to help you!

Expected Behaviour:

Block ads in web browsers using macbook pro, iphone, ipad, etc

Actual Behaviour:

No ads are being blocked via apple devices, queries from these devices don't appear to generate anything in the pihole logs. Windows PC's on the same network appear to work as expected.

Debug Token:

mb0srpzsij

This would be a setup issue on your client devices, not a Pi-Hole issue, I suspect. I have on my home network a Mac Mini, iMac, MacBook Air, 2 x iPads, 3 x iPhones, Apple TV and they all go nicely through Pi-Hole.

Perhaps I can assist you in setting these up.

Have you reset the DNS cache on each of these devices since you installed your Pi-Hole?

Yeah, I've cleared the dns cache on my macbook and iphone, but still seems like nothing happens via the pi-hole.

I don't have your token available yet. But, quickly explain your router and DNS setup. What make/model of router? Who provides DHCP, what are the DNS settings in router if it does? IP address of router and Pi-Hole? Pi-Hole on static IP?

On the MacBook, how did you clear your DNS cache?

On your MacBook system settings > network > advanced > DNS, what DNS server(s) are showing.

Fiber gateway providing dhcp to Edgerouter Lite
Edgerouter Lite providing DHCP to internal network, gateway 10.0.1.1 for this network
Pi-hole set statically to 10.0.1.254
Wifi provided by netgear Orbi in AP mode

Edgerouter has 10.0.1.254 as the dns server for the DHCP scope
Macbook shows 10.0.1.254 as the only DNS server

DNS configuration (for scoped queries)

resolver #1
nameserver[0] : 10.0.1.254
if_index : 5 (en0)
flags : Scoped, Request A records
reach : 0x00020002 (Reachable,Directly Reachable Address)

I'm not understanding this. Are you referring to the WAN IP address here, gained through DHCP to the ISP?

Is IPV6 enabled on your router, and do you have your MacBook in IPV6 - link local only? What IP addresses are shown as assigned on the MacBook?

Google Fiber network box provides a DHCP address to the Edgerouter on eth0 for the WAN port
LAN port is eth1 on the Edgerouter, which is providing DHCP to all my internal stuff
ipv6 is disabled, macbook has it set to link only as well

Macbook has an ip of 10.0.1.18

Is your browser using a proxy by chance? Chrome has a compression feature which routes traffic thru Google's servers. Wondering if some like that is going on for your Apple devices.

Just looking through your query log a bit. What is device 10.0.1.3 - is that your Netgear Orbi?

It's making AAAA queries to Netgear.com which is getting resolved by the Pi-Hole.

   Aug 17 00:00:37 dnsmasq[25653]: 575 10.0.1.3/49887 query[AAAA] www.netgear.com from 10.0.1.3
   Aug 17 00:00:37 dnsmasq[25653]: 575 10.0.1.3/49887 cached www.netgear.com is <CNAME>
   Aug 17 00:00:37 dnsmasq[25653]: 575 10.0.1.3/49887 forwarded www.netgear.com to 149.112.112.112
   Aug 17 00:00:37 dnsmasq[25653]: 575 10.0.1.3/49887 forwarded www.netgear.com to 9.9.9.9
   Aug 17 00:00:37 dnsmasq[25653]: 575 10.0.1.3/49887 reply www.netgear.com is <CNAME>
   Aug 17 00:00:37 dnsmasq[25653]: 575 10.0.1.3/49887 reply d3jdtixm7cvu7y.cloudfront.net is 2600:9000:2042:8a00:14:b314:af80:93a1
   Aug 17 00:00:37 dnsmasq[25653]: 575 10.0.1.3/49887 reply d3jdtixm7cvu7y.cloudfront.net is 2600:9000:2042:7000:14:b314:af80:93a1

yeah, that's the orbi

The Pi is connected via ethernet to where in your network?

pi-hole is connected to a switch attached to the main orbi unit

hmm, interestingly, safari and chrome don't block anything, but the ad blocking works in firefox, but can't pull up google.com, complaining about the ssl cert

Not to the Edgerouter? What else is attached to the Edgerouter on the LAN side (one port is going to the Orbi).

Where are the Windows devices connected and how (wireless or ethernet)?

edgerouter has one empty port that I have setup as a backup console port

one windows box is connected via ethernet, the other is connected via wifi

To the same switch as the Pi-Hole is connected?

Pardon all the questions - I'm trying to make a sketch of your network setup.

right, connected to the same switch as the pi-hole

From your MacBook, can you terminal shell into your Pi? If you have ssh enabled on the pi, it should be

ssh pi@10.0.1.254

I'm ssh'd into the pi