Pihole works after restarting dns but stops blocking ads after a few minutes

#1

Please follow the below template, it will help us to help you!

Expected Behaviour:

pihole blocks ads on clients

Actual Behaviour:

Pihole works after restarting dns but stops blocking ads after a few minutes

Debug Token:

1tdurbl232

##Debug Output:
e[3Je[He[2JThis process collects information from your Pi-hole, and optionally uploads it to a unique and random directory on tricorder.pi-hole.net.

The intent of this script is to allow users to self-diagnose their installations. This is accomplished by running tests against our software and providing the user with links to FAQ articles when a problem is detected. Since we are a small team and Pi-hole has been growing steadily, it is our hope that this will help us spend more time on development.

NOTE: All log files auto-delete after 48 hours and ONLY the Pi-hole developers can access your data via the given token. We have taken these extra steps to secure your data and will work to further reduce any personal information gathered.

*** [ INITIALIZING ]
[i] 2017-12-27:19:06:25 debug log has been initiated.

*** [ INITIALIZING ] Sourcing setup variables
[i] Sourcing /etc/pihole/setupVars.conf…

*** [ DIAGNOSING ]: Core version
[i] Core: v3.2.1 (How do I update Pi-hole?)
[i] Branch: master
[i] Commit: v3.2.1-0-ge602008

*** [ DIAGNOSING ]: Web version
[i] Web: v3.2.1 (How do I update Pi-hole?)
[i] Branch: master
[i] Commit: v3.2.1-0-g31dddd8

*** [ DIAGNOSING ]: FTL version
[✓] FTL: v2.13

*** [ DIAGNOSING ]: dnsmasq version
[i] 2.76

*** [ DIAGNOSING ]: lighttpd version
[i] 1.4.45

*** [ DIAGNOSING ]: php version
[i] 7.0.19

*** [ DIAGNOSING ]: Operating system
[✓] Raspbian GNU/Linux 9 (stretch)

*** [ DIAGNOSING ]: SELinux
[i] SELinux not detected

*** [ DIAGNOSING ]: Processor

*** [ DIAGNOSING ]: Networking
[✓] IPv4 address(es) bound to the eth0 interface:
ip address/24 matches the IP found in /etc/pihole/setupVars.conf

[✓] IPv6 address(es) bound to the eth0 interface:
fe80::3806:3cee:b056:dc89 does not match the IP found in /etc/pihole/setupVars.conf (Use IPv6 ULA addresses for Pi-hole)

^ Please note that you may have more than one IP address listed.
As long as one of them is green, and it matches what is in /etc/pihole/setupVars.conf, there is no need for concern.

The link to the FAQ is for an issue that sometimes occurs when the IPv6 address changes, which is why we check for it.

[i] Default IPv4 gateway: 192.168.1.1

  • Pinging 192.168.1.1…
    [✓] Gateway responded.

*** [ DIAGNOSING ]: Ports in use
[22] is in use by sshd
[53] is in use by dnsmasq
[80] is in use by lighttpd
[4711] is in use by pihole-FTL

*** [ DIAGNOSING ]: Name resolution (IPv4) using a random blocked domain and a known ad-serving domain
[✓] www.barbiemobi.cn is ip address via localhost (127.0.0.1)
[✓] www.barbiemobi.cn is ip address via Pi-hole (ip address)
[✓] doubleclick.com is 216.58.219.238 via a remote, public DNS server (8.8.8.8)

*** [ DIAGNOSING ]: Pi-hole processes
[✓] dnsmasq daemon is active
[✓] lighttpd daemon is active
[✓] pihole-FTL daemon is active

*** [ DIAGNOSING ]: Setup variables
PIHOLE_INTERFACE=eth0
IPV4_ADDRESS=ip address/24
IPV6_ADDRESS=
PIHOLE_DNS_1=208.67.222.222
PIHOLE_DNS_2=208.67.220.220
QUERY_LOGGING=true
INSTALL_WEB=true
LIGHTTPD_ENABLED=1

*** [ DIAGNOSING ]: Dashboard and block page
[✓] X-Pi-hole: A black hole for Internet advertisements.
[✓] X-Pi-hole: The Pi-hole Web interface is working!

*** [ DIAGNOSING ]: Gravity list
-rw-r–r-- 1 root root 3720197 Dec 27 18:34 /etc/pihole/gravity.list
-----head of gravity.list------
ip address 0.0.0.0
ip address 0000mps.webpreview.dsl.net
ip address 0001.2waky.com
ip address 000dom.revenuedirect.com

-----tail of gravity.list------
ip address zzsyw.com
ip address zztxdown.com
ip address zzz.clickbank.net
ip address zz.zeroredirect1.com

*** [ DIAGNOSING ]: contents of /etc/pihole

-rw-r–r-- 1 root root 633 Dec 18 18:16 /etc/pihole/adlists.list
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://mirror1.malwaredomains.com/files/justdomains
http://sysctl.org/cameleon/hosts
https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist
https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt
https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt
https://hosts-file.net/ad_servers.txt

-rw-r–r-- 1 root root 79 Dec 27 19:05 /etc/pihole/blacklist.txt
dc.ads.linkedin.com
www.facebook.com
adservex.media.net
sharethrough.adnxs.com

-rw-r–r-- 1 root root 44 Dec 27 18:34 /etc/pihole/local.list
ip address raspberrypi
ip address pi.hole

-rw-r–r-- 1 root root 234 Dec 27 18:34 /etc/pihole/logrotate
/var/log/pihole.log {
su root root
daily
copytruncate
rotate 5
compress
delaycompress
notifempty
nomail
}
/var/log/pihole-FTL.log {
su root root
weekly
copytruncate
rotate 3
compress
delaycompress
notifempty
nomail
}

-rw-r–r-- 1 root root 117 Dec 26 18:46 /etc/pihole/whitelist.txt
raw.githubusercontent.com
mirror1.malwaredomains.com
sysctl.org
zeustracker.abuse.ch
s3.amazonaws.com
hosts-file.net

*** [ DIAGNOSING ]: contents of /etc/dnsmasq.d

-rw-r–r-- 1 root root 1516 Dec 27 18:34 /etc/dnsmasq.d/01-pihole.conf
addn-hosts=/etc/pihole/gravity.list
addn-hosts=/etc/pihole/black.list
addn-hosts=/etc/pihole/local.list
localise-queries
no-resolv
cache-size=10000
log-queries
log-facility=/var/log/pihole.log
local-ttl=2
log-async
server=208.67.222.222
server=208.67.220.220
interface=eth0

*** [ DIAGNOSING ]: contents of /etc/lighttpd

-rw-r–r-- 1 root root 3027 Dec 27 18:34 /etc/lighttpd/lighttpd.conf
server.modules = (
“mod_access”,
“mod_accesslog”,
“mod_auth”,
“mod_expire”,
“mod_compress”,
“mod_redirect”,
“mod_setenv”,
“mod_rewrite”
)
server.document-root = "/var/www/html"
server.error-handler-404 = "pihole/index.php"
server.upload-dirs = ( “/var/cache/lighttpd/uploads” )
server.errorlog = "/var/log/lighttpd/error.log"
server.pid-file = "/var/run/lighttpd.pid"
server.username = "www-data"
server.groupname = "www-data"
server.port = 80
accesslog.filename = "/var/log/lighttpd/access.log"
accesslog.format = "%{%s}t|%V|%r|%s|%b"
index-file.names = ( “index.php”, “index.html”, “index.lighttpd.html” )
url.access-deny = ( “~”, “.inc”, “.md”, “.yml”, “.ini” )
static-file.exclude-extensions = ( “.php”, “.pl”, “.fcgi” )
compress.cache-dir = "/var/cache/lighttpd/compress/"
compress.filetype = ( “application/javascript”, “text/css”, “text/html”, “text/plain” )
include_shell "/usr/share/lighttpd/use-ipv6.pl " + server.port
include_shell "/usr/share/lighttpd/create-mime.assign.pl"
include_shell “find /etc/lighttpd/conf-enabled -name ‘*.conf’ -a ! -name ‘letsencrypt.conf’ -printf ‘include “%p”
’ 2>/dev/null”
$HTTP[“url”] =~ “^/admin/” {

   setenv.add-response-header = (
       "X-Pi-hole" => "The Pi-hole Web interface is working!",
       "X-Frame-Options" => "DENY"
   )
   $HTTP["url"] =~ ".ttf$" {
       
       setenv.add-response-header = ( "Access-Control-Allow-Origin" => "*" )
   }

}
$HTTP[“url”] =~ “^/admin/.(.*)” {
url.access-deny = ("")
}
include_shell “cat external.conf 2>/dev/null”

*** [ DIAGNOSING ]: contents of /etc/cron.d

-rw-r–r-- 1 root root 1630 Dec 27 18:34 /etc/cron.d/pihole
47 4 * * 7 root PATH="$PATH:/usr/local/bin/" pihole updateGravity
00 00 * * * root PATH="$PATH:/usr/local/bin/" pihole flush once quiet
@reboot root /usr/sbin/logrotate /etc/pihole/logrotate
*/10 * * * * root PATH="$PATH:/usr/local/bin/" pihole updatechecker local
55 17 * * * root PATH="$PATH:/usr/local/bin/" pihole updatechecker remote
@reboot root PATH="$PATH:/usr/local/bin/" pihole updatechecker remote reboot

*** [ DIAGNOSING ]: contents of /var/log/lighttpd

-rw-r–r-- 1 www-data www-data 4520 Dec 27 19:05 /var/log/lighttpd/error.log
2017-12-24 06:25:04: (server.c.1534) logfiles cycled UID = 0 PID = 5971
2017-12-26 18:46:09: (server.c.1828) server stopped by UID = 0 PID = 1
2017-12-26 18:46:10: (log.c.217) server started
2017-12-26 18:55:37: (server.c.1828) server stopped by UID = 0 PID = 1
2017-12-26 18:55:57: (log.c.217) server started
2017-12-27 17:57:55: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Warning: file(http://127.0.0.1/admin/scripts/pi-hole/php/queryads.php?domain=infoc2.duba.net&bp): failed to open stream: HTTP request failed! in /var/www/html/pihole/index.php on line 136
2017-12-27 17:57:55: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Warning: array_filter() expects parameter 1 to be array, string given in /var/www/html/pihole/index.php on line 137
2017-12-27 17:57:55: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Warning: array_values() expects parameter 1 to be array, null given in /var/www/html/pihole/index.php on line 137
2017-12-27 17:58:20: (server.c.1828) server stopped by UID = 0 PID = 1
2017-12-27 17:58:21: (log.c.217) server started
2017-12-27 17:59:31: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Warning: file(http://127.0.0.1/admin/scripts/pi-hole/php/queryads.php?domain=infoc2.duba.net&bp): failed to open stream: HTTP request failed! in /var/www/html/pihole/index.php on line 136
2017-12-27 17:59:31: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Warning: array_filter() expects parameter 1 to be array, string given in /var/www/html/pihole/index.php on line 137
2017-12-27 17:59:31: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Warning: array_values() expects parameter 1 to be array, null given in /var/www/html/pihole/index.php on line 137
2017-12-27 18:24:59: (server.c.1828) server stopped by UID = 0 PID = 1
2017-12-27 18:27:31: (log.c.217) server started
2017-12-27 18:31:35: (server.c.1828) server stopped by UID = 0 PID = 1
2017-12-27 18:34:22: (log.c.217) server started
2017-12-27 18:47:20: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Warning: preg_split(): Delimiter must not be alphanumeric or backslash in /var/www/html/admin/scripts/pi-hole/php/auth.php on line 122
2017-12-27 18:47:20: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Warning: Invalid argument supplied for foreach() in /var/www/html/admin/scripts/pi-hole/php/auth.php on line 123
2017-12-27 18:47:37: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Warning: preg_split(): Delimiter must not be alphanumeric or backslash in /var/www/html/admin/scripts/pi-hole/php/auth.php on line 122
2017-12-27 18:47:37: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Warning: Invalid argument supplied for foreach() in /var/www/html/admin/scripts/pi-hole/php/auth.php on line 123
2017-12-27 18:48:08: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Warning: preg_split(): Delimiter must not be alphanumeric or backslash in /var/www/html/admin/scripts/pi-hole/php/auth.php on line 122
2017-12-27 18:48:08: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Warning: Invalid argument supplied for foreach() in /var/www/html/admin/scripts/pi-hole/php/auth.php on line 123
2017-12-27 19:05:26: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Warning: preg_split(): Delimiter must not be alphanumeric or backslash in /var/www/html/admin/scripts/pi-hole/php/auth.php on line 122
2017-12-27 19:05:26: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Warning: Invalid argument supplied for foreach() in /var/www/html/admin/scripts/pi-hole/php/auth.php on line 123

*** [ DIAGNOSING ]: contents of /var/log

-rw-r–r-- 1 pihole pihole 15869 Dec 27 19:05 /var/log/pihole-FTL.log
[2017-12-27 00:00:02.298] Gravity list entries: 106669
[2017-12-27 00:00:02.298] No blacklist present
[2017-12-27 00:00:02.298] No wildcard blocking list present
[2017-12-27 00:00:02.298] Reading from /var/log/pihole.log.1 (rw-r–r--)
[2017-12-27 00:00:02.298] Notice: Increasing queries struct size from 0 to 10000 (320.25 KB)
[2017-12-27 00:00:02.298] Notice: Increasing overTime struct size from 0 to 100 (324.25 KB)
[2017-12-27 00:00:02.298] Notice: Increasing forwarded struct size from 0 to 4 (324.32 KB)
[2017-12-27 00:00:02.347] New forward server: 8.8.4.4 google-public-dns-b.google.com (0/4)
[2017-12-27 00:00:02.348] Notice: Increasing domains struct size from 0 to 1000 (344.36 KB)
[2017-12-27 00:00:02.348] Notice: Increasing clients struct size from 0 to 10 (344.53 KB)
[2017-12-27 00:00:02.348] New client: 127.0.0.1 localhost (0/10)
[2017-12-27 00:00:02.399] New forward server: 8.8.8.8 google-public-dns-a.google.com (1/4)
[2017-12-27 00:00:02.435] Notice: Increasing overTime struct size from 100 to 200 (349.63 KB)
[2017-12-27 00:00:02.469] New client: 10.8.0.2 (1/10)
[2017-12-27 00:00:02.535] New client: 10.8.0.3 (2/10)
[2017-12-27 00:00:02.565] New client: ip address raspberrypi (3/10)
[2017-12-27 00:00:02.593] Reading from /var/log/pihole.log (rw-r–r--)
[2017-12-27 17:19:50.262] NOTICE: Received signal SIGHUP - re-reading gravity files
[2017-12-27 17:19:50.472] Gravity list entries: 106669
[2017-12-27 17:19:50.473] No blacklist present
[2017-12-27 17:19:50.473] No wildcard blocking list present
[2017-12-27 17:31:19.563] New client: 10.8.0.4 (4/10)
[2017-12-27 17:58:23.005] FATAL: FTL received SIGTERM from PID/UID 15792/0, scheduled to exit gracefully
[2017-12-27 17:58:23.006] Shutting down…
[2017-12-27 17:58:23.006]

*** [ DIAGNOSING ]: Pi-hole log
-rw-r–r-- 1 dnsmasq root 557045 Dec 27 19:06 /var/log/pihole.log
-----head of pihole.log------
Dec 27 00:00:02 dnsmasq[935]: query[PTR] 4.4.8.8.in-addr.arpa from 127.0.0.1
Dec 27 00:00:02 dnsmasq[935]: forwarded 4.4.8.8.in-addr.arpa to 8.8.4.4
Dec 27 00:00:02 dnsmasq[935]: forwarded 4.4.8.8.in-addr.arpa to 8.8.8.8
Dec 27 00:00:02 dnsmasq[935]: reply 8.8.4.4 is google-public-dns-b.google.com
Dec 27 00:00:02 dnsmasq[935]: query[PTR] 8.8.8.8.in-addr.arpa from 127.0.0.1
Dec 27 00:00:02 dnsmasq[935]: forwarded 8.8.8.8.in-addr.arpa to 8.8.4.4
Dec 27 00:00:02 dnsmasq[935]: reply 8.8.8.8 is google-public-dns-a.google.com
Dec 27 00:00:02 dnsmasq[935]: query[PTR] 2.0.8.10.in-addr.arpa from 127.0.0.1
Dec 27 00:00:02 dnsmasq[935]: forwarded 2.0.8.10.in-addr.arpa to 8.8.4.4
Dec 27 00:00:02 dnsmasq[935]: query[PTR] 3.0.8.10.in-addr.arpa from 127.0.0.1
Dec 27 00:00:02 dnsmasq[935]: forwarded 3.0.8.10.in-addr.arpa to 8.8.4.4
Dec 27 00:00:02 dnsmasq[935]: query[PTR] 8.1.168.192.in-addr.arpa from 127.0.0.1
Dec 27 00:00:02 dnsmasq[935]: /etc/pihole/local.list ip address is raspberrypi
Dec 27 00:00:02 dnsmasq[935]: query[PTR] 2.0.8.10.in-addr.arpa from 127.0.0.1
Dec 27 00:00:02 dnsmasq[935]: forwarded 2.0.8.10.in-addr.arpa to 8.8.4.4
Dec 27 00:00:02 dnsmasq[935]: query[PTR] 3.0.8.10.in-addr.arpa from 127.0.0.1
Dec 27 00:00:02 dnsmasq[935]: forwarded 3.0.8.10.in-addr.arpa to 8.8.4.4
Dec 27 00:00:02 dnsmasq[935]: query[PTR] 8.1.168.192.in-addr.arpa from 127.0.0.1
Dec 27 00:00:02 dnsmasq[935]: /etc/pihole/local.list ip address is raspberrypi
Dec 27 00:59:00 dnsmasq[935]: query[PTR] 2.0.8.10.in-addr.arpa from 127.0.0.1



[✓] ** FINISHED DEBUGGING! **

* The debug log can be uploaded to tricorder.pi-hole.net for sharing with developers only.
* For more information, see: https://pi-hole.net/2016/11/07/crack-our-medical-tricorder-win-a-raspberry-pi-3/
* If available, we'll use openssl to upload the log, otherwise it will fall back to netcat.

* Using openssl for transmission.


[✓] Your debug token is: 1tdurbl232



  • Provide the token above to the Pi-hole team for assistance at
  • https://discourse.pi-hole.net
  • Your log will self-destruct on our server after 48 hours.
  • A local copy of the debug log can be found at: /var/log/pihole_debug-sanitized.log
0 Likes

#2

I originally set pihole up with google dns but I thought that was why ads were coming through. I reconfigured pi hole to use opendns but that still did not work

0 Likes

#3

Your debug log looks fine. Are your clients only using Pi-hole? Check via ipconfig on Windows.

0 Likes

#4

I use Linux Mint but I’m having the same results on my android phone and tablet too. I also have dnscrypt and pivpn on my pi. I used this tutorial to set everything up: https://itchy.nl/raspberry-pi-3-with-openvpn-pihole-dnscrypt

0 Likes

#5

Check the DNS servers your clients are using.

0 Likes

#6

I’m using adguard-dns. Do I need to use the resolver address for my router settings?

0 Likes

#7

image

0 Likes

#8

What are the contents of /etc/resolv.conf?

0 Likes

#9

Generated by resolvconf
nameserver 127.0.0.1

0 Likes

#10

oO

This is your clientside resolv.conf? In this case, your machine resolves adresses itself (127.0.0.1), no pihole involved. How do you forward DNS to

, then?

Or is it correct that the adguard servers are configured in your router (or whatever you use as dhcp server)? In this case, your dhcp server should only deliver the pihole’s ip (IPv4 as well as IPv6, do not forget to use ULAs) as DNS to clients; the pihole then may ask your router (or adguard). Well, that depends on what router you use…
As a temporary workaround you could try setting the pihole as resolver manually in your resolv.conf - but a true (and valid for all devices) solution would IMHO require the corrosponding configuration of DHCP…

0 Likes