Suddenly cannot connect to Pihole from Android (Private DNS)

Help Community Help
1

The issue I am facing:

I have set up pihole on my VPS and would like to use it as my Private DNS on Android, so that all my DNS queries would go to my VPS server. I opened port 853 on my VPS and configured my nginx to redirect it to 53, so I have the following:

incoming DNS request to port 853 -> pi-hole on port 53 -> unbound on port 5335.

This has been working for years with no problems and yesterday it suddenly stopped working. Here is what I checked:

  1. Check whether the new update messed it up - no, check older versions of pi-hole = same issue

  2. Checked whether phone's updates messed it up - no, tried it on 3 different phones = same issue

  3. Checked router - did not find anything unusual

  4. Provider is not blocking port 853

  5. Domain name is ok, valid. I can access pi-hole admin panel via any web browser.

  6. Same happens on both wifi (tried on different routers) and mobile network

Any public resolvers like 1.1.1.1 or Adguard work fine without any issues but when I enter hostname of my DNS I always get couldn't connect error and Internet stops.

My ultimate goal is to have pi-hole blocking ads etc + resolving all domain names using my own server without relying on 1.1.1.1, Google, etc.

Any help would be highly appreciated.

Details about my system:

System is ubuntu 20 / Debian 10

What I have changed since installing Pi-hole:

I have only updated pi-hole to the latest version yesterday.

2

Many thanks everyone, the problem is solved!

3

What did you do to solve the problem?

4

What did you do? I have the exact same issue, please help!

5

For anyone else having this issue: this has nothing to do with Pihole, it's mainly a Letsencrypt and Android issue.

The default Letsencrypt certificate chain looks like this:
yourdomain.example < R3 < ISRG Root X1 < DST Root CA X3

Recently that last certificate (DST Root) has recently expired, however as most modern devices also trust the ISRG Root, serving a certificate chain with an expired certificate after a trusted one should not be an issue.

If you only access this server from relatively-modern devices, you can use Let's Encrypt's alternate chain which doesn't include the expired DST Root.

To do this, you will need to upgrade certbot to at least version 1.12.0 , and then add the command line option --preferred-chain "ISRG Root X1" when requesting a certificate.

https://community.letsencrypt.org/t/lets-encrypt-certificate-is-reported-expired-on-android-10-private-dns-feature/161281

6

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.