Pi-hole slow DNS queries when browsing

Expected Behaviour:

I've setup and configured Pi-hole on a ODROID C4. This device also functions VPN gateway / proxy for my network. This guide pretty much sums up my setup however I've the following differences:

  • Using wireguard + Mullvad instead of NordVPN
  • Using a ODROID C4 instead of a RPi 4

The VPN gateway is working fine and all my devices are using this device as gateway. Pi-hole is running the latest version and conditional forwarding is turned off in the configuration. I'm using cloudflared as DNS server (127.0.0.1:5053), however I've tried without running this as well to no difference.

The wireguard configuration contains a DNS Server entry which points to the local machine since I want ALL DNS queries to be resolved by the Pi-hole.

Actual Behaviour:

My problem is that browsing certain websites is extremely slow. It doesn't happen all the time, but frequently enough that it's noticeable. Sometimes it can take up to almost 30 seconds to load a web page. Things I tried to resolve the issue:

  • Disable IPv6
  • Using the iptables rules from here
  • Disable conditional forwarding
  • Change the IPV4_ADDRESS and IPV6_ADDRESS in the setupVars.conf to 0.0.0.0 / 0000:0000:0000(etc..)

I tried different browsers (Google, Brave, Firefox) and the results are similar. If I configure cloudflare DNS (1.1.1.1, 1.0.0.1) manually on my network interface I never experience the slowness. The ODROID C4 load is at the bare minimum so I doubt it is a resource issue. See below an example of loading a page from amazon.de where it took 29.19s to load the page:

The weird thing is that if I use "dig" to measure performance there's no significant delay noticeable:

dig a amazon.de @10.13.37.20 -p 53 | grep time
;; Query time: 83 msec

dig a amazon.de @10.13.37.20 -p 53 | grep time
;; Query time: 2 msec

dig a amazon.de @10.13.37.20 -p 53 | grep time
;; Query time: 2 msec

dig a amazon.de @8.8.8.8 -p 53 | grep time
;; Query time: 24 msec

dig a amazon.de @8.8.8.8 -p 53 | grep time
;; Query time: 19 msec

dig a amazon.de @8.8.8.8 -p 53 | grep time
;; Query time: 19 msec

I'm pretty sure something is wrong with my setup rather then my browser or device since it is happening throughout my entire network (iPhone, Apple TV, Windows devices & MacOS devices)

Debug Token:

I've generated and uploaded the debug logs. I went through it myself and couldn't find directly any obvious errors that would lead to this issue. One thing I'm thinking about is that perhaps I should configure the gateway as 127.0.0.1 instead of the RFC1918 internal IP, since the device where Pi-hole is installed on is functioning as gateway for the network.

The debug token is: https://tricorder.pi-hole.net/91j9w2xpu9

To help further troubleshooting I'm posting my iptables rules below:
sudo iptables -L

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            
REJECT     tcp  --  anywhere             anywhere             tcp dpt:https reject-with tcp-reset
REJECT     udp  --  anywhere             anywhere             udp dpt:80 reject-with icmp-port-unreachable
REJECT     udp  --  anywhere             anywhere             udp dpt:443 reject-with icmp-port-unreachable

Chain FORWARD (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

sudo ip6tables -L

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all      anywhere             anywhere            
ACCEPT     all      anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all      anywhere             anywhere            
REJECT     tcp      anywhere             anywhere             tcp dpt:https reject-with tcp-reset
REJECT     udp      anywhere             anywhere             udp dpt:80 reject-with icmp6-port-unreachable
REJECT     udp      anywhere             anywhere             udp dpt:443 reject-with icmp6-port-unreachable

Chain FORWARD (policy DROP)
target     prot opt source               destination         
ACCEPT     all      anywhere             anywhere            
ACCEPT     all      anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all      anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Interesting...

Continued searching on the web and here on discourse and found the following:

I applied the "fix" by setting BLOCKINGMODE=NODATA in /etc/pihole/pihole-FTL.conf (more details about BLOCKINGMODE here: https://docs.pi-hole.net/ftldns/blockingmode/).

From the discourse and github I understand this seems to be a MacOS bug however I experienced the slowdowns on non MacOS devices as well. After I set the BLOCKINGMODE=NODATA I don't experience the slowdowns anymore. I will continue monitoring my network but this seems to be the fix!

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.