Pi-hole working but not blocking all ads - Pihole as DHCP and DNS server

[cassiorozelli]

Please follow the below template, it will help us to help you!

Expected Behaviour:

Block ads blacklisted - Pi-hole set as DHCP and DNS server

Actual Behaviour:

ads are not blocked

Debug Token:

a5buuawayw

[jfb]

This section of your debug log shows that a randomly selected domain from your gravity list is being blocked properly (on both IPv4 and IPv6 although I only pasted the IPv4 result):

*** [ DIAGNOSING ]: Name resolution (IPv4) using a random blocked domain and a known ad-serving domain
[✓] advancedmactools.com is 0.0.0.0 via localhost (127.0.0.1)
[✓] advancedmactools.com is 0.0.0.0 via Pi-hole (192.168.4.4)
[✓] doubleclick.com is 172.217.30.14 via a remote, public DNS server (8.8.8.8)

There are no domains shown in your blacklist or whitelist.

Please provide more detail about the problem you are seeing (screen shots, specific domain being queried, output from logs, etc.). Thanks.

[cassiorozelli]

For example, when I try the Brazilian website www.globo.com , I can see the ads from google on top and middle of the page. Can you please try this website and see if it blocks for your?

Unfortunately I cannot paste screenshots to show.

Thanks in advance

[jfb]

@cassiorozelli

www.globo.com

I did not see the ads. The DNSThingy browser extension for Chrome shows that this page tried to load the following domains:

www.globo.com
s.glbimg.com
s3.glbimg.com
sb.scorecardresearch.com
cocoon.globo.com
tags.globo.com
s2.glbimg.com
g1.globo.com
vitrines.globo.com
c.api.globo.com
tag.navdmp.com
cdn.krxd.net
tags.tiqcdn.com
cd.navdmp.com
usergate.globo.com
api.globo.com
horizon.globo.com
ajax.googleapis.com

The front page looks like this:

[jfb]

How do I determine what domain an ad is coming from?

Block ads or fix broken sites This FAQ is written in the context of finding out how to block an ad that isn't blocked automatically, but the same steps can be used to troubleshoot issues with sites that don't function properly. An example is that sometimes certain payment gateways try to collect metrics on the sale, but these domains are blocked by Pi-hole, so the payment cannot be processed. Also, some links send you through several referrers and if one of them is blocked, you may land on a …

[cassiorozelli]

jfb, thanks for your reply.

How can I paste a screenshot? Why is it being displayed for me and not to you?

Is there any tweak to be done?

Best Regrds

[jfb]

There should not be a tweak needed. I use a screen capture tool, capture to my clipboard, and then paste into a post. You can also capture to a file, then upload the file. My particular browser seems to like to paste the capture twice: I just delete the second.

[cassiorozelli]

Got it.

As per screenshot, there's the difference between ours. Any idea to share?
Thanks

[jfb]

@cassiorozelli

Block ads blacklisted

Just to clarify the terminology, here is a brief explanation of block lists, blacklists, whitelists and wildcard/regex.

The block lists are publicly maintained lists of domains to which you subscribe. The file /etc/pihole/adlists.list is your list of subscriptions. Note that this file consists of web addresses, not domains. The maintainers of these block lists update them as they see fit, and gravity is updated every Sunday morning around 3 am (at a random time so all the Pi-Hole users don't slam the servers at once).

When Pi-Hole updates gravity, it goes to the internet, reads each of these lists (if they have changed), puts them all together, removes duplicates and creates a gravity list which is a list of domains, one per line - /etc/pihole/gravity.list

Your local whitelist file (/etc/pihole/whitelist.txt) is subtracted from the gravity list - if you have whitelisted it, it won't be in gravity.

Your local blacklist file (/etc/pihole/blacklist.txt) is a list of domains that you want blocked regardless of whether they appear in the gravity list.

Your regex list is the new form of wildcards, as of V4 Pi-Hole. This is a file of regular expressions (regex), a powerful search format used in Unix. The regex list is here: /etc/pihole/regex.list.

From your debug log, you subscribe to the seven blacklists that are offered on initial Pi-Hole install, and have no local whitelist or blacklist entries. You have 3 regex filters.

[jfb]

@cassiorozelli

there’s the difference between ours. Any idea to share?

Use the tools in the thread referenced above to look in your query log, pihole.log, etc and determine where the advertisement is coming from. When you first do this, it can be tedious until you get the hang of it.

I prefer to tail the pihole.log in a separate window while I load the web page. Then I can see in real time all of the DNS queries and their replies.

When I reload that globo web page, here is what pops up in my pihole.log:

Oct 30 11:42:11 dnsmasq[8301]: query[A] www.google-analytics.com from 192.168.0.135
Oct 30 11:42:11 dnsmasq[8301]: /etc/pihole/gravity.list www.google-analytics.com is 0.0.0.0
Oct 30 11:42:11 dnsmasq[8301]: query[A] tag.navdmp.com from 192.168.0.135
Oct 30 11:42:11 dnsmasq[8301]: /etc/pihole/gravity.list tag.navdmp.com is 0.0.0.0
Oct 30 11:42:11 dnsmasq[8301]: query[A] cdn.krxd.net from 192.168.0.135
Oct 30 11:42:11 dnsmasq[8301]: /etc/pihole/gravity.list cdn.krxd.net is 0.0.0.0
Oct 30 11:42:12 dnsmasq[8301]: query[A] sb.scorecardresearch.com from 192.168.0.135
Oct 30 11:42:12 dnsmasq[8301]: /etc/pihole/gravity.list sb.scorecardresearch.com is 0.0.0.0
Oct 30 11:42:12 dnsmasq[8301]: query[A] imasdk.googleapis.com from 192.168.0.135
Oct 30 11:42:12 dnsmasq[8301]: /etc/pihole/gravity.list imasdk.googleapis.com is 0.0.0.0
Oct 30 11:42:12 dnsmasq[8301]: query[A] api.globovideos.com from 192.168.0.135
Oct 30 11:42:12 dnsmasq[8301]: forwarded api.globovideos.com to 127.0.0.1
Oct 30 11:42:12 dnsmasq[8301]: query[A] s.videos.globo.com from 192.168.0.135
Oct 30 11:42:12 dnsmasq[8301]: forwarded s.videos.globo.com to 127.0.0.1
Oct 30 11:42:13 dnsmasq[8301]: reply api.globovideos.com is 186.192.81.16
Oct 30 11:42:13 dnsmasq[8301]: reply s.videos.globo.com is <CNAME>
Oct 30 11:42:13 dnsmasq[8301]: reply s.glbimg.com is 186.192.91.5
Oct 30 11:42:13 dnsmasq[8301]: query[A] nqs.nice264.com from 192.168.0.135
Oct 30 11:42:13 dnsmasq[8301]: /etc/pihole/gravity.list nqs.nice264.com is 0.0.0.0
Oct 30 11:42:13 dnsmasq[8301]: query[A] api.sentry.globoi.com from 192.168.0.135
Oct 30 11:42:13 dnsmasq[8301]: forwarded api.sentry.globoi.com to 127.0.0.1
Oct 30 11:42:13 dnsmasq[8301]: reply api.sentry.globoi.com is 201.7.182.184