Pi-hole webadmin - 403 Forbidden

[KaV3R]

The issue I am facing:
I installed Pi-hole with this: curl -sSL https://install.pi-hole.net | bash
And after I installed I can't open the default url, I mean I can, but only shows this:

I make this for a nginx conf to try mybe the default domain is the problem, but nope.
Here is my nginx.conf now:

server {
    server_name pihole.catflux.hu;

    root /var/www/html/admin;
    index index.html index.php;

    location / {
        try_files $uri $uri/ =404;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;  # Állítsd be a megfelelő PHP verziót
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~* \.(js|css|png|jpg|jpeg|gif|ico|woff|woff2|ttf|svg)$ {
        expires max;
        log_not_found off;
    }

    access_log /var/log/nginx/pihole_access.log;
    error_log /var/log/nginx/pihole_error.log;

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/pihole.catflux.hu/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/pihole.catflux.hu/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}
server {
    if ($host = pihole.catflux.hu) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen 80;
    server_name pihole.catflux.hu;
    return 404; # managed by Certbot


}

Details about my system:

What I have changed since installing Pi-hole: nothing.

Can somebody help me how I can open Pi-hole webadmin, please?

[deHakkelaar]

You dont need nginx for serving the webGUI.
Pi-hole dropped the lighttpd and php dependencies with version 6 in favor for a web daemon (civetweb) embedded in the pihole-FTL binary:

$ pstree -pst $(pidof -s pihole-FTL)
systemd(1)───pihole-FTL(481)─┬─{civetweb-master}(22462)
                             ├─{civetweb-timer}(22461)
                             ├─{civetweb-worker}(22463)
                             ├─{civetweb-worker}(22464)
                             ├─{civetweb-worker}(22465)
                             ├─{civetweb-worker}(22466)
                             ├─{database}(22457)
                             ├─{dns-client}(22459)
                             ├─{housekeeper}(22458)
                             ├─{ntp-client}(22456)
                             ├─{ntp-server4}(22467)
                             ├─{ntp-server6}(22468)
                             └─{timer}(22460)

$ sudo ss -nltp sport = 80
State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
LISTEN 0      200          0.0.0.0:80        0.0.0.0:*    users:(("pihole-FTL",pid=481,fd=34))
LISTEN 0      200             [::]:80           [::]:*    users:(("pihole-FTL",pid=481,fd=35))

EDIT: Plus some parts are LUA now instead of PHP.
Not sure if you can serve LUA via nginx and how.

$ cat /var/www/html/admin/index.lp
[..]
mg.include('scripts/lua/header_authenticated.lp','r')

[rdwebdesign]

Your nignx config is trying to run PHP files, but Pi-hole v6 doesn't use PHP.

nginx can't execute the new web interface pages, written in Lua.

You need to use the new embedded web server to run the new web interface. You can use nginx as a reverse proxy, if needed.

[KaV3R]

I dont even have lighttpd o,y

[rdwebdesign]

@KaV3R

I dont even have lighttpd

Pi-hole v6 doesn't need lighttpd or nginx.

You need port 80 free for pihole-FTL (the new web server).

[KaV3R]

Then why is mine at 53? and still can't reach it

[deHakkelaar]

That last screenshot is for DNS:

$ grep $'\t53\/' /etc/services
domain          53/tcp                          # Domain Name Server
domain          53/udp

The one before that is for web:

$ grep $'\t80\/' /etc/services
http            80/tcp          www             # WorldWideWeb HTTP

And pihole-FTL does both plus some more:

$ sudo ss -nltup | grep 'Netid\|pihole-FTL'
Netid State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
udp   UNCONN 0      0            0.0.0.0:53        0.0.0.0:*    users:(("pihole-FTL",pid=410,fd=20))
udp   UNCONN 0      0            0.0.0.0:123       0.0.0.0:*    users:(("pihole-FTL",pid=410,fd=40))
udp   UNCONN 0      0               [::]:53           [::]:*    users:(("pihole-FTL",pid=410,fd=22))
udp   UNCONN 0      0               [::]:123          [::]:*    users:(("pihole-FTL",pid=410,fd=41))
tcp   LISTEN 0      200          0.0.0.0:443       0.0.0.0:*    users:(("pihole-FTL",pid=410,fd=37))
tcp   LISTEN 0      200          0.0.0.0:80        0.0.0.0:*    users:(("pihole-FTL",pid=410,fd=35))
tcp   LISTEN 0      32           0.0.0.0:53        0.0.0.0:*    users:(("pihole-FTL",pid=410,fd=21))
tcp   LISTEN 0      200             [::]:443          [::]:*    users:(("pihole-FTL",pid=410,fd=38))
tcp   LISTEN 0      200             [::]:80           [::]:*    users:(("pihole-FTL",pid=410,fd=36))
tcp   LISTEN 0      32              [::]:53           [::]:*    users:(("pihole-FTL",pid=410,fd=23))

If you really depend on nginx for some reason, I think below is your best bet:

@rdwebdesign

You can use nginx as a reverse proxy, if needed.

[KaV3R]

I missing two of =(idk) them I guess

[deHakkelaar]

From the last screenshot, you can see pihole-FTL is listening on port 443:

$ grep $'\t443\/' /etc/services
https           443/tcp                         # http protocol over TLS/SSL
https           443/udp                         # HTTP/3

So you should be able to access the webGUI via below link:

https://<PIHOLE_IP>/admin/

Or if your client is using Pi-hole for DNS:

https://pi.hole/admin/

OOTB its a self signed cert so you'd have to accept the cert offered even though the browser says its unsafe.
From there you can change the ports pihole-FTL needs to listen to for HTTP and or HTTPS.

Below one will also show the ports configured for web:

$ sudo pihole-FTL --config webserver.port
80,[::]:80,443s,[::]:443s

[KaV3R]

If I want to open these links this showing up every time:

https://192.168.0.248/admin/

And this is not working at all https://pi.hole/admin/

[KaV3R]

Now I can open Pi-hole

I changed some values at /etc/pihole/pihole.toml and now working.

Here is mine if someone has the same issue in future:

pihole.zip (18.4 KB)