# Problem with FTL and dnsmasq after pihole -up (Ubuntu 16.04.5 LTS)

**URL:** <https://discourse.pi-hole.net/t/problem-with-ftl-and-dnsmasq-after-pihole-up-ubuntu-16-04-5-lts/11756>\
**Category:** Help\
**Tags:** v4-0, ubuntu\
**Created:** [August 11, 2018, 2:22pm UTC](https://discourse.pi-hole.net/t/problem-with-ftl-and-dnsmasq-after-pihole-up-ubuntu-16-04-5-lts/11756 "2018-08-11T14:22:32Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![Wood578Guy](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/w/848f3c/32.png) [@Wood578Guy](https://discourse.pi-hole.net/u/Wood578Guy)\
**Post date:** [August 11, 2018, 2:22pm UTC](https://discourse.pi-hole.net/t/problem-with-ftl-and-dnsmasq-after-pihole-up-ubuntu-16-04-5-lts/11756/1 "2018-08-11T14:22:32Z")

</div>

#### Please follow the below template, it will help us to help you!

## Expected Behaviour:

Pihole works normally after update, able to resolve DNS addresses.

## Actual Behaviour:

After running pihole -up, it will not resolve DNS addresses. I can't tell if there's an issue with dnsmasq or FTL. The web GUI reads Lost Connection to API in the 4 differently colored status boxes.

I had to manually update /etc/resolv.conf to change 127.0.0.1 to a different DNS just so I could get the debug to upload since apparently dnsmasq isn't working.

One other thing to note -- i'm running pi-hole in an LXC container on an Intel NUC, it's been working great for 2+ years, this is the first issue I've had.

## Debug Token:

8cxcemecwx

Other maybe helpful information:

root@pi-hole:~# cat /etc/os-release  
NAME="Ubuntu"  
VERSION="16.04.5 LTS (Xenial Xerus)"  
ID=ubuntu  
ID\_LIKE=debian  
PRETTY\_NAME="Ubuntu 16.04.5 LTS"  
VERSION\_ID="16.04"  
HOME\_URL="[http://www.ubuntu.com/](http://www.ubuntu.com/)"  
SUPPORT\_URL="[http://help.ubuntu.com/](http://help.ubuntu.com/)"  
BUG\_REPORT\_URL="[http://bugs.launchpad.net/ubuntu/](http://bugs.launchpad.net/ubuntu/)"  
VERSION\_CODENAME=xenial  
UBUNTU\_CODENAME=xenial

root@pi-hole:~# service dnsmasq status  
● dnsmasq.service - dnsmasq - A lightweight DHCP and caching DNS server  
Loaded: loaded (/lib/systemd/system/dnsmasq.service; disabled; vendor preset: enabled)  
Drop-In: /run/systemd/generator/dnsmasq.service.d  
└─50-dnsmasq-$named.conf, 50-insserv.conf-$named.conf  
Active: inactive (dead)

root@pi-hole:~# systemctl status pihole-FTL.service  
● pihole-FTL.service - LSB: pihole-FTL daemon  
Loaded: loaded (/etc/init.d/pihole-FTL; bad; vendor preset: enabled)  
Active: active (exited) since Sat 2018-08-11 10:00:36 EDT; 10min ago  
Docs: man:systemd-sysv-generator(8)

Aug 11 10:00:36 pi-hole pihole-FTL[1672]: chown: cannot access '/etc/pihole/dhcp.leases': No such file or directory  
Aug 11 10:00:36 pi-hole pihole-FTL[1672]: Failed to set capabilities on file `/usr/bin/pihole-FTL' (Invalid argument  
Aug 11 10:00:36 pi-hole pihole-FTL[1672]: The value of the capability argument is not permitted for a file. Or the f  
Aug 11 10:00:36 pi-hole su[1696]: Successful su for pihole by root  
Aug 11 10:00:36 pi-hole su[1696]: + ??? root:pihole  
Aug 11 10:00:36 pi-hole su[1696]: pam\_unix(su:session): session opened for user pihole by (uid=0)  
Aug 11 10:00:36 pi-hole pihole-FTL[1672]: dnsmasq: failed to create listening socket for port 53: Permission denied  
Aug 11 10:00:36 pi-hole systemd[1]: Started LSB: pihole-FTL daemon.  
Aug 11 10:00:45 pi-hole systemd[1]: Started LSB: pihole-FTL daemon.  
Aug 11 10:01:37 pi-hole systemd[1]: Started LSB: pihole-FTL daemon.

root@pi-hole:~# pihole status  
[✗] DNS service is NOT running

root@pi-hole:~# dnsmasq --version  
Dnsmasq version 2.75 Copyright (c) 2000-2015 Simon Kelley  
Compile time options: IPv6 GNU-getopt DBus i18n IDN DHCP DHCPv6 no-Lua TFTP conntrack ipset auth DNSSEC loop-detect inotify

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [August 11, 2018, 4:05pm UTC](https://discourse.pi-hole.net/t/problem-with-ftl-and-dnsmasq-after-pihole-up-ubuntu-16-04-5-lts/11756/3 "2018-08-11T16:05:25Z")

</div>

Your debug log shows you at V4 for everything, so you are updated.

Note that with V4 and FTLDNS, dnsmasq is no longer run as a process, since pihole-FTL does this function. This link has additional info: [DNS resolver - Pi-hole documentation](https://docs.pi-hole.net/ftldns/dns-resolver/)

Your debug log shows lightttpd and pihole-FTL daemons active, but nothing using ports 80 and 53 respectively, which those should be using.

Run the following to restart FTL and see if this improves things:

`sudo service pihole-FTL restart`

---

<div class="post-metadata">

**Author:** ![Wood578Guy](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/w/848f3c/32.png) [@Wood578Guy](https://discourse.pi-hole.net/u/Wood578Guy)\
**Post date:** [August 11, 2018, 4:13pm UTC](https://discourse.pi-hole.net/t/problem-with-ftl-and-dnsmasq-after-pihole-up-ubuntu-16-04-5-lts/11756/5 "2018-08-11T16:13:39Z")

</div>

I get the same error: not sure why it says active (exited).

root@pi-hole2:~# service pihole-FTL restart

root@pi-hole2:~# systemctl status pihole-FTL  
● pihole-FTL.service - LSB: pihole-FTL daemon  
Loaded: loaded (/etc/init.d/pihole-FTL; bad; vendor preset: enabled)  
Active: active (exited) since Sat 2018-08-11 16:12:53 UTC; 2s ago  
Docs: man:systemd-sysv-generator(8)  
Process: 2983 ExecStop=/etc/init.d/pihole-FTL stop (code=exited, status=0/SUCCESS)  
Process: 2987 ExecStart=/etc/init.d/pihole-FTL start (code=exited, status=0/SUCCESS)

Aug 11 16:12:53 pi-hole2 systemd[1]: Starting LSB: pihole-FTL daemon...  
Aug 11 16:12:53 pi-hole2 pihole-FTL[2987]: Not running  
Aug 11 16:12:53 pi-hole2 pihole-FTL[2987]: chown: cannot access '/etc/pihole/dhcp.leases': No such file or directory  
Aug 11 16:12:53 pi-hole2 pihole-FTL[2987]: Failed to set capabilities on file `/usr/bin/pihole-FTL' (Invalid argumen  
Aug 11 16:12:53 pi-hole2 pihole-FTL[2987]: The value of the capability argument is not permitted for a file. Or the  
Aug 11 16:12:53 pi-hole2 su[3011]: Successful su for pihole by root  
Aug 11 16:12:53 pi-hole2 su[3011]: + ??? root:pihole  
Aug 11 16:12:53 pi-hole2 su[3011]: pam\_unix(su:session): session opened for user pihole by (uid=0)  
Aug 11 16:12:53 pi-hole2 pihole-FTL[2987]: dnsmasq: failed to create listening socket for port 53: Permission denied  
Aug 11 16:12:53 pi-hole2 systemd[1]: Started LSB: pihole-FTL daemon.

---

<div class="post-metadata">

**Author:** ![Mcat12](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mcat12/32/20_2.png) [@Mcat12](https://discourse.pi-hole.net/u/Mcat12)\
**Post date:** [August 11, 2018, 7:33pm UTC](https://discourse.pi-hole.net/t/problem-with-ftl-and-dnsmasq-after-pihole-up-ubuntu-16-04-5-lts/11756/7 "2018-08-11T19:33:25Z")

</div>

This issue seems to match this other topic: [DNS unable to start and FTL offline v 4.0](https://discourse.pi-hole.net/t/dns-unable-to-start-and-ftl-offline-v-4-0/11762)

---

<div class="post-metadata">

**Author:** ![Wood578Guy](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/w/848f3c/32.png) [@Wood578Guy](https://discourse.pi-hole.net/u/Wood578Guy)\
**Post date:** [August 12, 2018, 1:59pm UTC](https://discourse.pi-hole.net/t/problem-with-ftl-and-dnsmasq-after-pihole-up-ubuntu-16-04-5-lts/11756/8 "2018-08-12T13:59:49Z")

</div>

@Mcat12 - agreed this seems similiar. I wonder if I'm running into this since I'm running pi-hole inside an LXD container on an Ubuntu 16.04 server on an Intel NUC.

Can you help me understand what changes I need to perform the following? I think this will help my issue.

> modify the startup scripts of pihole-FTL to ensure the daemon is started as root.

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [August 12, 2018, 2:19pm UTC](https://discourse.pi-hole.net/t/problem-with-ftl-and-dnsmasq-after-pihole-up-ubuntu-16-04-5-lts/11756/9 "2018-08-12T14:19:53Z")

</div>

> [@Wood578Guy](#):
>
> Can you help me understand what changes I need to perform the following?

In your `/etc/init.d/pihole-FTL` you can find a line

```auto
su -s /bin/sh -c "/usr/bin/pihole-FTL" "$FTLUSER"

```

replace it by

```auto
/usr/bin/pihole-FTL

```

---

<div class="post-metadata">

**Author:** ![Wood578Guy](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/w/848f3c/32.png) [@Wood578Guy](https://discourse.pi-hole.net/u/Wood578Guy)\
**Post date:** [August 12, 2018, 6:24pm UTC](https://discourse.pi-hole.net/t/problem-with-ftl-and-dnsmasq-after-pihole-up-ubuntu-16-04-5-lts/11756/10 "2018-08-12T18:24:48Z")

</div>

Yep! That fixed it immediately.

Are there any security concerns operating in this mode?

I presume it'll get wiped out again if I run

`pihole -up`

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [August 12, 2018, 10:44pm UTC](https://discourse.pi-hole.net/t/problem-with-ftl-and-dnsmasq-after-pihole-up-ubuntu-16-04-5-lts/11756/11 "2018-08-12T22:44:16Z")

</div>

> [@Wood578Guy](#):
>
> Are there any security concerns operating in this mode?

No, not really. `dnsmasq` is always started as `root` we just preferred to start `pihole-FTL` under an unprivileged user such as `pihole`. It's kind of a security model in the sense of "if there is a bug in the code, it can cause less harm under a non-`root` user".

---

<div class="post-metadata">

**Author:** ![duceduc](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/duceduc/32/55_2.png) [@duceduc](https://discourse.pi-hole.net/u/duceduc)\
**Post date:** [August 18, 2018, 11:15am UTC](https://discourse.pi-hole.net/t/problem-with-ftl-and-dnsmasq-after-pihole-up-ubuntu-16-04-5-lts/11756/12 "2018-08-18T11:15:57Z")

</div>

This seems like the problem I am facing. Can you show me exactly how this line suppose to look in its entirely after the edit? Thanks.

In your /etc/init.d/pihole-FTL you can find a line

```
su -s /bin/sh -c "/usr/bin/pihole-FTL" "$FTLUSER"

```

replace it by

```
/usr/bin/pihole-FTL

```

---

<div class="post-metadata">

**Author:** ![Wood578Guy](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/w/848f3c/32.png) [@Wood578Guy](https://discourse.pi-hole.net/u/Wood578Guy)\
**Post date:** [August 18, 2018, 11:41am UTC](https://discourse.pi-hole.net/t/problem-with-ftl-and-dnsmasq-after-pihole-up-ubuntu-16-04-5-lts/11756/13 "2018-08-18T11:41:09Z")

</div>

It's as simple as you think it is -- the whole line gets replaced.

Afterwards that line should only read:

```
/usr/bin/pihole-FTL

```

---

<div class="post-metadata">

**Author:** ![duceduc](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/duceduc/32/55_2.png) [@duceduc](https://discourse.pi-hole.net/u/duceduc)\
**Post date:** [August 18, 2018, 10:12pm UTC](https://discourse.pi-hole.net/t/problem-with-ftl-and-dnsmasq-after-pihole-up-ubuntu-16-04-5-lts/11756/14 "2018-08-18T22:12:42Z")

</div>

Ah. That was simple enough indeed. However, it didn't help with my issue. I did created a thread about it.

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [September 8, 2018, 10:12pm UTC](https://discourse.pi-hole.net/t/problem-with-ftl-and-dnsmasq-after-pihole-up-ubuntu-16-04-5-lts/11756/15 "2018-09-08T22:12:43Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.