# Second level Blacklist triggered on a schedule

**URL:** <https://discourse.pi-hole.net/t/second-level-blacklist-triggered-on-a-schedule/23715>\
**Category:** Duplicate\
**Created:** [September 18, 2019, 1:45pm UTC](https://discourse.pi-hole.net/t/second-level-blacklist-triggered-on-a-schedule/23715 "2019-09-18T13:45:08Z")\
**Posts on this page:** 18\
**Page:** 1

<div class="post-metadata">

**Author:** ![callumw](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/callumw/32/10002_2.png) [@callumw](https://discourse.pi-hole.net/u/callumw)\
**Post date:** [September 18, 2019, 1:45pm UTC](https://discourse.pi-hole.net/t/second-level-blacklist-triggered-on-a-schedule/23715/1 "2019-09-18T13:45:08Z")

</div>

Hi  
I'm loving the PiHole and there's one feature that I could think of that I think would be generally useful - especially for those with kids.

There are lots of reports of school kid's results suffering because of addiction to Social Media sites or with online gaming.

The ability to have a second set of blacklist rules that can be implemented on a schedule so to make sure all LAN traffic to/from those sites are gracefully blocked.  
I'm sure some routers could do this, but the one we have (VirginMedia Hub3) isn't that smart.

This would help enforce an online curfew where occupants can have full access and at a set time those selected sites will no longer be available.  
e.g. At 9pm they can finish watching their YouTube video, but then that's it until 4pm next day (or midday on weekends)

---

<div class="post-metadata">

**Author:** ![technicalpyro](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/technicalpyro/32/752_2.png) [@technicalpyro](https://discourse.pi-hole.net/u/technicalpyro)\
**Post date:** [September 18, 2019, 2:42pm UTC](https://discourse.pi-hole.net/t/second-level-blacklist-triggered-on-a-schedule/23715/2 "2019-09-18T14:42:27Z")

</div>

As the code sits your best bet would be to run two instances. One for your devices the other for childrens devices

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [September 18, 2019, 2:47pm UTC](https://discourse.pi-hole.net/t/second-level-blacklist-triggered-on-a-schedule/23715/3 "2019-09-18T14:47:31Z")

</div>

> [@callumw](#):
>
> The ability to have a second set of blacklist rules that can be implemented on a schedule so to make sure all LAN traffic to/from those sites are gracefully blocked.

You can write a cron script to add these domains and remove these domains at the desired times, but this will also block those domains for all users on that Pi-Hole. A second Pi-Hole with such a script or a router that has this capability would be your best options.

---

<div class="post-metadata">

**Author:** ![Comedy](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/c/22d042/32.png) [@Comedy](https://discourse.pi-hole.net/u/Comedy)\
**Post date:** [September 18, 2019, 2:49pm UTC](https://discourse.pi-hole.net/t/second-level-blacklist-triggered-on-a-schedule/23715/4 "2019-09-18T14:49:13Z")

</div>

You could do this with crontab using two scripts on two schedules. You'd need to add to crontab as root though

The following running at 9pm:

```auto
#!/bin/bash
mv /etc/pihole/blacklists.txt /etc/pihole/blacklists.day
mv /etc/pihole/blacklists.night /etc/pihole/blacklists.txt
pihole -g

```

The following running at 4pm:

```auto
#!/bin/bash
mv /etc/pihole/blacklists.txt /etc/pihole/blacklists.night
mv /etc/pihole/blacklists.day /etc/pihole/blacklists.txt
pihole -g

```

Not used the pihole command line but I think pihole -g reloads blocks, does it not?

You would have two blacklists now, one after 9pm and one before 9pm. You could either maintain the files yourself from the command line or wait until after 9pm when you are using the night blacklist and then add the social media sites to it.

**edit:** Looks like others replied while I was writing this. Using two pihole instances would be your best best but that is only going to work if you can segregate the devices to filter differently somehow at your router - a different subnet or something. For your case though I think crontab is going to be best.

---

<div class="post-metadata">

**Author:** ![callumw](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/callumw/32/10002_2.png) [@callumw](https://discourse.pi-hole.net/u/callumw)\
**Post date:** [September 18, 2019, 4:31pm UTC](https://discourse.pi-hole.net/t/second-level-blacklist-triggered-on-a-schedule/23715/5 "2019-09-18T16:31:49Z")

</div>

Thanks for the replies.  
I'd worked out a cron method (no need for a second instance), but it would be good to have it available as an option natively within PiHole for general ease of use and upkeep.

My workaround to activate extra filtering from 21:30 to 16:00 weekdays and 08:00 on weekends:  
As root (sudo -i)

```auto
cd /etc/pihole
cp regex.list regex.list.standard
cp regex.list regex.list.extra
```

Edit **regex.list.standard** to have a list of 24/7 blocked domain(s)  
Edit **regex.list.extra** to have only the additional domain(s)

```auto
vi /etc/crontab
30 21 * * * root cat /etc/pihole/regex.list.extra >> /etc/pihole/regex.list && /usr/local/bin/pihole -g > /dev/null 2>1&
0 16 * * 1-5 root cat /etc/pihole/regex.list.standard > /etc/pihole/regex.list && /usr/local/bin/pihole -g > /dev/null 2>1&
0 8 * * 6,7 root cat /etc/pihole/regex.list.standard > /etc/pihole/regex.list && /usr/local/bin/pihole -g > /dev/null 2>1&

```

Example regex.list.standard:

```auto
(^|\.)bing\.com$
```

Example regex.list.extra

```auto
(^|\.)youtube\.com$
(^|\.)facebook\.com$
(^|\.)steam\.com$
(^|\.)steampowered\.com$
(^|\.)steamtastic\.com$
```

EDIT: There is a faster and more graceful way of doing the update with cron than running _pihole -g_:  
Link: [[Second level Blacklist triggered on a schedule - #14 by callumw](https://discourse.pi-hole.net/t/second-level-blacklist-triggered-on-a-schedule/23715/14)]

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [September 18, 2019, 11:29pm UTC](https://discourse.pi-hole.net/t/second-level-blacklist-triggered-on-a-schedule/23715/6 "2019-09-18T23:29:44Z")

</div>

Rebuilding gravity will not re-compile your regex list. For this you will need to restart pihole-FTL or recompile the regex (I don't recall how to do a re-compile though):

`sudo service pihole-FTL restart`

Edit: the recompile command is `echo ">recompile-regex" | nc localhost 4711`

---

<div class="post-metadata">

**Author:** ![mikeyw64](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/m/c4cdca/32.png) [@mikeyw64](https://discourse.pi-hole.net/u/mikeyw64)\
**Post date:** [September 19, 2019, 7:20am UTC](https://discourse.pi-hole.net/t/second-level-blacklist-triggered-on-a-schedule/23715/7 "2019-09-19T07:20:07Z")

</div>

majority of kids will be like "meh, someones trying to block me I'll just change the dns servers on my phone/tablet/laptop"

---

<div class="post-metadata">

**Author:** ![DJ-BrianC](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dj-brianc/32/4222_2.png) [@DJ-BrianC](https://discourse.pi-hole.net/u/DJ-BrianC)\
**Post date:** [September 21, 2019, 3:46am UTC](https://discourse.pi-hole.net/t/second-level-blacklist-triggered-on-a-schedule/23715/8 "2019-09-21T03:46:36Z")

</div>

When my step sons were in the house they were always figuring out how to break the rules. Didn't take me long to figure out how to stop them though. PfSense is a powerful router platform!

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [September 21, 2019, 3:55am UTC](https://discourse.pi-hole.net/t/second-level-blacklist-triggered-on-a-schedule/23715/9 "2019-09-21T03:55:10Z")

</div>

Wait until they figure out they can use their phone cell signal to get to the internet, particularly if they can make a local hotspot.

---

<div class="post-metadata">

**Author:** ![callumw](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/callumw/32/10002_2.png) [@callumw](https://discourse.pi-hole.net/u/callumw)\
**Post date:** [September 21, 2019, 8:53am UTC](https://discourse.pi-hole.net/t/second-level-blacklist-triggered-on-a-schedule/23715/10 "2019-09-21T08:53:09Z")

</div>

Thanks for the additional replies although I think some are missing the point.  
(I don't have kids, I just thought it would be a good feature to have)

Currently I'm using the second blacklist to shut down all the trackers that run on mobile devices.  
e.g FaceBook is disabled on my phone which also has a basic firewall on it, but FB is still (somehow) trying to report back to facebook hq.  
But the missus uses FB, so it needs to be available during the evening.

---

<div class="post-metadata">

**Author:** ![callumw](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/callumw/32/10002_2.png) [@callumw](https://discourse.pi-hole.net/u/callumw)\
**Post date:** [September 21, 2019, 9:23am UTC](https://discourse.pi-hole.net/t/second-level-blacklist-triggered-on-a-schedule/23715/11 "2019-09-21T09:23:49Z")

</div>

> [@jfb](#):
>
> Rebuilding gravity will not re-compile your regex list. For this you will need to restart pihole-FTL or recompile the regex (I don't recall how to do a re-compile though):
> 
> `sudo service pihole-FTL restart`
> 
> Edit: the recompile command is `echo ">recompile-regex" | nc localhost 4711`

Thanks for the reply.  
I think the FTL is compiled after domains are added via the web interface as a full gravity refresh would take too long.

**pihole -g** does work.though.  
At the bottom of the output after the main blocklists it adds our local black/white lists.  
e.g.  
[✓] Consolidating blocklists  
[✓] Extracting domains from blocklists  
[i] Number of domains being pulled in by gravity: _141440_  
[✓] Removing duplicate domains  
[i] Number of unique domains trapped in the Event Horizon: _118082_  
**[i] Number of whitelisted domains: 1**  
**[i] Number of blacklisted domains: 0**  
**[i] Number of regex filters: 2**  
[✓] Parsing domains into hosts format  
[✓] Cleaning up stray matter

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [September 21, 2019, 1:26pm UTC](https://discourse.pi-hole.net/t/second-level-blacklist-triggered-on-a-schedule/23715/12 "2019-09-21T13:26:01Z")

</div>

> [@callumw](#):
>
> **pihole -g** does work.though.  
> At the bottom of the output after the main blocklists it adds our local black/white lists.

In your previous example, you showed five additional regex filters. The output of your gravity update shows only 2 regex filters. The additional filters you added were not re-compiled by a gravity update.

`**[i] Number of blacklisted domains: 0**`

> [@callumw](#):
>
> I think the FTL needs compiling after domains are added via the web interface as a full gravity refresh would take too long.

Recompiling regex and rebuilding gravity are two different things.

---

<div class="post-metadata">

**Author:** ![callumw](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/callumw/32/10002_2.png) [@callumw](https://discourse.pi-hole.net/u/callumw)\
**Post date:** [September 22, 2019, 10:18am UTC](https://discourse.pi-hole.net/t/second-level-blacklist-triggered-on-a-schedule/23715/13 "2019-09-22T10:18:04Z")

</div>

> [@jfb](#):
>
> In your previous example, you showed five additional regex filters. The output of your gravity update shows only 2 regex filters. The additional filters you added were not re-compiled by a gravity update.

My list content, gravity output and cron schedule were examples for the sake of brevity.

All I know is that I change a block or regex file, run _pihole -g_ and stuff stops working when it completes.

I've used PiHole as a network sniffer and my lists have evolved as I see items to add.  
At the time of my previous post, there were only 2 "standard" active regex on the list during the day.  
As of last night there were 50 blocked after 1am (I spent all yesterday morning going through the logs).

My real lists as of this morning are (wc -l):  
_regex.list.standard_ = 4  
_regex.list.extra_ = 16  
_regex.list.bed_ = 30 (a 3rd level blocklist that kicks in at 1 or 2am and locks a lot more down)

Current output: **[i] Number of regex filters: 4**

---

<div class="post-metadata">

**Author:** ![callumw](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/callumw/32/10002_2.png) [@callumw](https://discourse.pi-hole.net/u/callumw)\
**Post date:** [September 22, 2019, 11:13am UTC](https://discourse.pi-hole.net/t/second-level-blacklist-triggered-on-a-schedule/23715/14 "2019-09-22T11:13:41Z")

</div>

Addendum - Although the pilhole-g command does work, it's slow and puts extra strain on the main block list servers.

An alternative (and much faster) way of refreshing the lists can be done by disabling and re-enabling pihole or as @jfb suggested, a _ **pihole-FTL restart** _.

Example pihole restart cron:

```auto
0 7 * * * root pihole disable && cat /etc/pihole/regex.list.standard > /etc/pihole/regex.list && pihole enable
0 23 * * * root pihole disable && cat /etc/pihole/regex.list.extra >> /etc/pihole/regex.list && pihole enable
```

Example FTL restart cron:

```auto
0 7 * * * root cat /etc/pihole/regex.list.standard > /etc/pihole/regex.list && service pihole-FTL restart > /dev/null 2>1&
0 23 * * * root cat /etc/pihole/regex.list.extra >> /etc/pihole/regex.list && service pihole-FTL restart > /dev/null 2>1&
```

---

<div class="post-metadata">

**Author:** ![STaRDoGG](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/stardogg/32/10767_2.png) [@STaRDoGG](https://discourse.pi-hole.net/u/STaRDoGG)\
**Post date:** [April 1, 2020, 1:01pm UTC](https://discourse.pi-hole.net/t/second-level-blacklist-triggered-on-a-schedule/23715/15 "2020-04-01T13:01:21Z")

</div>

I came the the forum to request this exact thing. A native, built-in scheduler that just adds from a second BL to the main BL when it's active, and then removes the 2nd BL items when it's inactive would be most excellent, and much less fuss.

---

<div class="post-metadata">

**Author:** ![Herbertnl](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/h/278dde/32.png) [@Herbertnl](https://discourse.pi-hole.net/u/Herbertnl)\
**Post date:** [June 16, 2020, 3:41pm UTC](https://discourse.pi-hole.net/t/second-level-blacklist-triggered-on-a-schedule/23715/16 "2020-06-16T15:41:07Z")

</div>

Me as well.  
I'm not into cron jobs and other things (but always willing to learn and try)  
My suggestion would be to create additional groups and add devices to the specific groups (i.e.mobile phones, game computers) to the Kids group. This is an exsiting option. But then you would need to add this specific group to the standard blacklist, but the kids group would also need to be added to the self generated RegEx list., but only for a certain period. (as suggested, weekdays 00.00 till 15.00, and 19.00 till 23.59) This means that Kids group is always on standard blocklist + RegEx, and all hours from 15.00 - 19.00 time frame is only standard Blacklist.

Any thoughts on this to add this to Pi-Hole in an easy way? It would help other users (small office) as well to keep Netflix, youtube, facebook etc etc away from their computers during working time...

---

<div class="post-metadata">

**Author:** ![yubiuser](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/yubiuser/32/12100_2.png) [@yubiuser](https://discourse.pi-hole.net/u/yubiuser)\
**Post date:** [June 30, 2020, 1:40pm UTC](https://discourse.pi-hole.net/t/second-level-blacklist-triggered-on-a-schedule/23715/17 "2020-06-30T13:40:54Z")

</div>

Closing this as duplicate in favor of

> [@Timed DNS queries, block DNS based on time](https://discourse.pi-hole.net/t/timed-dns-queries-block-dns-based-on-time/3495):
>
> Hi pi-hole Firstly aplogies if I'm not doing this correctly Title timed DNS queries Block DNS based on time We have broadband which is limited during the day, and unlimited at night We currently block apple update servers all the time Would be helpful to have a special list call it a grey or yellow list Which would block always except for certain times I would propose having a general time setting and allowing domains to be turned on /off on the fly I am a developer so would be happy to…

Votes are released. If you still support the idea please vote over there.

---

<div class="post-metadata">

**Author:** ![yubiuser](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/yubiuser/32/12100_2.png) [@yubiuser](https://discourse.pi-hole.net/u/yubiuser)\
**Post date:** [June 30, 2020, 1:40pm UTC](https://discourse.pi-hole.net/t/second-level-blacklist-triggered-on-a-schedule/23715/18 "2020-06-30T13:40:56Z")

</div>