Pihole doesn't block ads on one phone but blocks on another phone

gil80 · October 13, 2020, 5:21am

Expected Behaviour:

To block ads on a specific app that I've personally blacklisted by using ADam:ONE on my PC.
The ads are being blocked on my Android 10 phone and iPhone 8 (iOS14.1) for that specific news app.

Actual Behaviour:

On another Android 10 phone (Realme 6), for the same app, these ads are not being blocked and the phone's IP address (192.168.1.40) doesn't even appear on the query logs of Pihole.
This phone is using the same wifi network as my other mobile devices.

I've downloaded an Android app to find out which DNS settings does the phone use, and it DOES use the Pihole's IP address as a DNS.
My router has the IPv6 disabled.

I restarted Pihole and the DNS resolver and restarted the phone and cleared the App's cache to no avail.

I use Pihole's DHCP server. My router's DHCP is disabled.

My custom DNS setting in Pihole is 127.0.0.1#5053 which is Cloudflared service.
The cloudflared.yml file is making use of IPv4 only and is using 1.1.1.2 and 1.0.0.2

These are my manually entered blacklist:

pi@raspberry:~ $ pihole -b -l
Displaying blacklist:
  1: totalmedia2.ynet.co.il (enabled, last modified Tue, 13 Oct 2020 13:32:24 +1100)
  2: cdn.taboola.com (enabled, last modified Tue, 13 Oct 2020 13:32:34 +1100)
  3: cdn.exelator.com (enabled, last modified Tue, 13 Oct 2020 13:32:49 +1100)
  4: c2.taboola.com (enabled, last modified Tue, 13 Oct 2020 13:32:51 +1100)
  5: yield-manager.browsiprod.com (enabled, last modified Tue, 13 Oct 2020 13:33:23 +1100)
  6: ad.doubleclick.net (enabled, last modified Tue, 13 Oct 2020 13:36:23 +1100)
  7: stats.g.doubleclick.net (enabled, last modified Tue, 13 Oct 2020 13:36:23 +1100)
  8: cdn.firstimpression.io (enabled, last modified Tue, 13 Oct 2020 13:36:23 +1100)
  9: experience.tinypass.com (enabled, last modified Tue, 13 Oct 2020 13:36:24 +1100)
  10: s0.2mdn.net (enabled, last modified Tue, 13 Oct 2020 13:36:24 +1100)
  11: adservice.google.com (enabled, last modified Tue, 13 Oct 2020 13:36:24 +1100)
  12: sb.scorecardresearch.com (enabled, last modified Tue, 13 Oct 2020 13:36:24 +1100)
  13: cdn.tinypass.com (enabled, last modified Tue, 13 Oct 2020 13:36:24 +1100)
  14: widget.perfectmarket.com (enabled, last modified Tue, 13 Oct 2020 13:36:24 +1100)
  15: nr-events.taboola.com (enabled, last modified Tue, 13 Oct 2020 13:36:24 +1100)
  16: trc.taboola.com (enabled, last modified Tue, 13 Oct 2020 13:36:24 +1100)
  17: trc-events.taboola.com (enabled, last modified Tue, 13 Oct 2020 13:36:24 +1100)
  18: mydmp.exelator.com (enabled, last modified Tue, 13 Oct 2020 13:36:24 +1100)
  19: onsite-tag-logs.apps.nielsen.com (enabled, last modified Tue, 13 Oct 2020 13:36:24 +1100)
  20: bam.nr-data.net (enabled, last modified Tue, 13 Oct 2020 13:36:24 +1100)

Why this phone doesn't get the ads blocked?
The app name is Ynet. The website of the app is www.ynet.co.il

Thanks!

Debug Token:

https://tricorder.pi-hole.net/43troj6jpi

HvdW · October 13, 2020, 9:50am

Which browser are you using.
Chrome has a tendency to bypass your DNS requests and find it's own way.
Firefox is more obedient.

Try this.
When connected trough your home network and ads are not blocked then activate the Wireguard app on your phone.
Reload the page and ads will be gone. (that is to say, in most cases)

gil80 · October 13, 2020, 9:55am

I'm not using a browser. I'm using a native android app.

that app on my Android phone and my iphone 8 has the ads blocked.
But on my other android phone (realme 6) the apps go through.

What I'm trying to understand is why Pihole doesn't block the ads to the Realme 6 phone.

HvdW · October 13, 2020, 9:59am

Still, activate Wireguard on that Realm phone.
In that situation it doesn't route the normal way but from your phone through the wireguard VPN tunnel to PiHole.

gil80 · October 13, 2020, 11:25am

Installed PiVPN and Wireguard.
Added the client and activate it on the android phone.
No ads are blocked.
This is very strange.

Any help on this matter is much appreciated!

jfb · October 13, 2020, 12:01pm

Try entering an unused IP from your LAN range in DNS 2 on the phone.

gil80 · October 13, 2020, 3:36pm

Ok. I will try that tomorrow.
What's the purpose behind this?

jfb · October 13, 2020, 7:35pm

To fill up that spot and prevent the device from using Google as a second DNS. It's not clear that Google does this, but filling the spot is a step to try.

HvdW · October 13, 2020, 9:01pm

Take your time, switch back to zero, uninstall PiHole and PiVPN
pivpn -u and pihole uninstall
Reboot your raspberry
Read this page GitHub - pi-hole/pi-hole: A black hole for Internet advertisements
install pihole
point your routers DNS tothe ip address of your raspberry
do a pivpn -a -p to get rid of the admin dasboard password
See if it works. Watch ip.of.your.raspberrypi/admin

Then install pivpn with standard options
Do the portforwarding on your router or it won't work
When pivpn doesn't act as expected read this page FAQ · pivpn/pivpn Wiki · GitHub

PS
When something does not work as expected I always step back and reset, read information and restart.
In most cases everything works perfect in a second attempt.
Maybe because I have overseen something or whatever.
Searching what causes trouble in software setup takes mostly more time then restart from the beginning.

gil80 · October 13, 2020, 11:14pm

I agree. I will try this.
I'm just surprised that pihole works for all my other devices, except this one. Seems that there's something else going on.
I think if it was an issue with the installation, then I'd get that problem with my other devices as well.

jfb · October 14, 2020, 12:16am

This isn't a Pi-hole issue, it's a client issue.

gil80 · October 14, 2020, 2:46am

The 2nd DNS was 8.8.8.8 by default.
I had to set the phone to use static IP so I can edit that field.
I changed it to 192.168.1.100 and it didn't help.
I changed it to 192.168.1.2 (pihole's IP), and it didn't help either.

I'm quite lost. The phone doesn't even come up on the logs. As if it has a stealth mode.

What would you suggest to debug this?
Could the phone have some hardcoded way to get ads?

gil80 · October 14, 2020, 12:36pm

If we ignore the facts that this is a client issue, what's more concerning is that the client doesn't appear on the pihole logs.
I've done endless checks on the DNS and IP address and made sure secondary DNS is set to 192.168.1.2 and IPv6 is disabled on the router.
I restarted the phone, router, pihole... nothing seems to get this phone on the logs.

jfb · October 14, 2020, 12:48pm

If the client is not using Pi-hole for DNS, this is the expected result.

There isn't a Pi-hole solution to the phone problem. I would visit a forum for that phone and OS.

gil80 · October 14, 2020, 1:08pm

I've searched for similar issues, but nothing came up. I'll go to some forums.
The pihole DHCP picks the phone and I even assigned a static IP to it.
But nothing on the logs when I open sites with ads.

Bucking_Horn · October 14, 2020, 9:50pm

I recall having read something about some manufacturer's smartphone models falling back to hardcoded DNS servers if they deem existing user provided DNS settings as invalid.

Your phone seems to exhibit such behaviour.

I suspect you'll find this confirmed if you take a look at the DNS servers reported by sites like www.dnsleaktest.com: They won't list any of your configured upstreams.

To mitigate this, you could try to block outgoing DNS (port 53) for that device on your router, or even better, redirect that to Pi-hole if your router allows.

HvdW · October 14, 2020, 11:13pm

Are you using Chrome?
That one does fall back on hardcoded DNS servers
How is it when you use Firefox or Opera?

You can try to change Chrome's behaviour: wit ADB

gil80 · October 14, 2020, 11:29pm

Do you mean something like this? Where the internal IP address is the phone's IP and the external is the Pihole IP?

gil80 · October 14, 2020, 11:33pm

Actually, it's a native app that I'm using on that dodgy android phone.
On my phone, even if I use chrome app, ads are being blocked.
On my PC I use chrome as well and they are being blocked.
I would switch to Firefox if they had all the chrome extension I'm using.

Bucking_Horn · October 15, 2020, 8:04am

Maybe, I don't know your router.

If BOTH for Protocol translates to TCP + UDP, that's fine.
Likely, Internal Port should be blank.
You'd have to figure by your router whether Internal IP Address or Source IP would be the correct choice.

You should also make sure you've researched how your router would apply those settings (e.g.to your whole network or just a single device).