Pi-hole with Fortinet 30E not blocking ads

Please follow the below template, it will help us to help you!

Expected Behaviour:

Should block ads for all devices

Actual Behaviour:

Fortinet sends queries but no ads blocked

Debug Token:

https://tricorder.pi-hole.net/md8d0nm1hl

This used to work, but I went to do the security upgrade and I totally forgot the login info for the pi-hole, so I just reinstalled it. now it doesn't seem to block anything. The only blocks were when I did the nslookup test to the pihole IP itself. Other than that, it doesn't seem to block anything.

What security upgrade was this?

Your Pi-hole is configured at IP 192.168.1.253. What DNS settings are in the router?

The flaw (CVE-2020-8816) affects Pi-hole version 4.3.2 and earlier.

So I have my fortinet set to use 192.168.1.253 as primary DNS and fortiguard DNS as secondary. It also shows dynamically discovered DNS from Spectrum.

I did a log reset this morning, so those 2361 query were just from this morning. the 6 blocked were from doing the nslookup to the IP of the pihole. I believe that the Fortinet is sending the query over to the pihole, but the pihole is not blocking anything.

Your debug log shows that Pi-hole is blocking as designed. Tailing the Pi-hole log is the sure way to see in real time the traffic arriving at Pi-hole, and whether any of it is being blocked.

Live tail the Pi-hole log from either a terminal window or the GUI, then from a connected client, run these commands from client terminal or the client command prompt (and not via ssh session to the Pi). Post the outputs of the commands here, and also report if you saw any activity in the Pi-hole log tail.

nslookup pi.hole

nslookup flurry.com

nslookup pi.hole 192.168.1.253

nslookup flurry.com 192.168.1.253

Here is the output.tail.txt (1.7 KB)
Here is what a web page that has ads looks like.. they shouldn't be there if it's blocking. Also, the block count doesn't go up. It only goes up if I do the nslookup using the domain.com 192.168.1.253 version.

Providing additional DNS server IPs apart from Pi-hole's own will allow clients to bypass Pi-hole.

Make sure that Pi-hole is your only DNS server.

Looks like it's working now. What I did was set the Fortiguard DNS as the custom DNS in Pi-Hole. I then went into WAN interface and fouind a selector for override internal DNS and turned that off. After I did that, I did a ipconfig /flushdns then a /release thien a /renew and I only see the 192.168.1.253 as my DNS server. Guessing when I did the update to the Fortinet before, it must have turned that override DNS on.. so weird..

Thank so much for your help.

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.