I have a raspberry that has been running on pi-hole for about 2 years. The other day I decided to watch Netflix on the US version. I decided to pour an OpenVPN on the pi provided, where it also runs pi-hole, and use it as a VPN router for TV.
Well, some problems have arisen since this phase. Some sites load me super hard or not at all. How do I know it's a DNS problem? I put in the pi-hole Google's DNS and everything works perfectly.
Since I'm not very good at IPTables and I intuitively set these forward rules from that guy's website, I don't realize what's wrong, so the opinion of a master on networking would be useful.
adds rules allowing you to use ssh through the firewall. However, there are no other rules that limit anything in the firewall so they are just not doing anything.
amends comments to the packets which are never used anywhere else by the firewall.
So only the central command block is doing anything at all.
So which DNS server do you use when Google works perfectly fine? Do you use a DoT setup? If so, I'd see the problem on this side.
Try a dig query to this server to check how long it needs to reply:
dig whatever.com @ip.of.your.used.server - p portofyourusedserver
Quoting the relevant parts to make discussion easier:
What we can say from this: 192.168.88.104 is certainly slower than 8.8.8.8
First case: It is severely slower.
Second case: Not so dramatic.
Let's focus on your first test: Assume Netflix loads various resources from different subdomains (I don't know if they do it, but I guess so). Say 20 external resources. This would make on the order of 8 seconds time until all DNS is resolved (simplification assuming they are serial, which they are typically not). Google would still be less than one second.
Here you would clearly see the difference.
In the second case not so much.
I see the guide recommends using cloudflared. This may just be awfully slow over the VPN you chose. Does this slowness remain if you disable the VPN or point it to different countries? If so, you may just have to get rid of it and do something else.
The Pi-hole team always recommends to become your own DNS upstream which is very simple using their excellent guide. By this, you become completely independent from any upstream provider (such as Cloudflare) and nobody gets your browsing habits. I'm sure Cloudflare records and sells it the same way Google does...
Sorry for the eventual confusion, but on my local laptop, I don't use VPN. The VPN is used only for TV. All other devices use the default DNS configuration provided by pi-hole.
Then, the problem with Netflix is on regular devices. It takes 30-40 seconds to load. My internet speed is about 300MB/s.
When I'm not using pi-hole as a DNS server, the website is loaded in < 1000ms. That's why I initially asked if it's a conflict from the iptables configuration.
don't you mean you exchange your cloudflare by Google inside Pi-hole? Why would you say put in the pi-hole otherwise?
So
also happens when you select Google as upstream inside Pi-hole ?
Maybe this doesn't work or I don't understand it. Does it mean that all traffic from the Pi running Pi-hole is routed through the VPN? Or something different?
I use (or I want to use) the VPN only for the TV, not for all devices
3.1. On the TV I have set the IP of the pi-hole as router IP instead of my real Mikrotik router
On the other devices (on TV it's all ok) served by the Mikrotik router and Pi-hole, like laptop, phone - this DNS issue is happening
I dug more and I found that
That IP solves to my VPN provider IP instead of Netflix A records.
Another example:
silviu@Silvius-MacBook-Pro ~ % dig cdn.cookielaw.org @192.168.88.104
; <<>> DiG 9.10.6 <<>> cdn.cookielaw.org @192.168.88.104
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37940
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;cdn.cookielaw.org. IN A
;; ANSWER SECTION:
cdn.cookielaw.org. 2 IN A 0.0.0.0
;; Query time: 4 msec
;; SERVER: 192.168.88.104#53(192.168.88.104)
;; WHEN: Mon Feb 08 17:21:13 EET 2021
;; MSG SIZE rcvd: 51
The record here is not resolved by all.
Now, I don't know why this is happening. Is it because of that iptables rules? If yes, why happen only to Netflix and other random websites, not to all?
No. This is the answer directly upplied from the DoH service you are using cloudflare. The firewall rules of iptables have no capabilities to modify DNS records in any way. They can either permit or block them. Well, they could also re-route them but that cannot happen with DoH as a rerouted reply would be discarded (certificate mismatch).
Do you get the same reading when using Google as DNS server inside Pi-hole (change it on the settings tab of the web interface).
