Top Clients (total) statistics are incorrect
Docker Tag development-v6Core vDev (development-v6, a16e053b)FTL vDev (development-v6, 7c00ea38)Web interface vDev (development-v6, e71e7f41)
Your screen shows that your Pi-hole to receive requests from public IP addresses like 198.18.129.1.
That would suggest that your Pi-hole is publically accessible, in which case you'd run an open resolver.
That poses a potential threat for all Internet users, e.g. by serving as a multiplier in a DNS Amplification attack.
The Pi-hole team strongly discourages Pi-hole’s usage as an open resolver, and we won't provide support in that case.
Please close inbound port 53 for public access on your router.
Indeed, I now see that you are using the IP range reserved as 'input ports' by network testing equipment in compliance with the Benchmarking Methodology Working Group detailed in RFC6815.
To avoid potential misbehaviour and unintended side effects, I'd recommend to switch that range to one of the IP ranges reserved for local network usage as detailed in RFC1918.
I concur that using this address range isn't a good idea for internal networks.
What you obverse is indeed very odd. Let's start with switching on query debugging using
sudo pihole-FTL --config debug.queries true
and then checking /var/log/pihole/FTL.log for what is reported as requesting clients. Please share some lines with us together with the corresponding Query Log screenshot and also the matching lines from /var/log/pihole/pihole.log - this should give us a good picture of what is going on.
Also, a debug log created using pihole -d and uploaded to our server would be quite useful. Please provide the generated token - only the core developers will be able to retrieve your debug log.
Could you please also provide the matching FTL.log files?
grep "07:40:" /var/log/pihole/FTL.log
That's not what DL6ER asked for.
Please provide the output as requested:
This shows you did not enable the debug logging as I asked you to do above:
Please see below if you need
root@Debian:~# docker exec -it pihole bash
Pi-hole:/# ps -ef | grep pihole
pihole 145 6 0 09:29 ? 00:00:00 /bin/bash -c /usr/bin/pihole-FTL no-daemon >/dev/null
root 146 6 0 09:29 ? 00:00:02 tail -f /var/log/pihole/FTL.log
pihole 147 145 0 09:29 ? 00:01:39 /usr/bin/pihole-FTL no-daemon
root 13724 13717 0 20:41 pts/0 00:00:00 grep pihole
Pi-hole:/# cd /usr/bin/
Pi-hole:/usr/bin# sudo pihole-FTL --config --config debug.queries true
Usage: pihole-FTL --config [<config item key>] [<value>]
Example: pihole-FTL --config dns.blockESNI true
Pi-hole:/usr/bin# sudo pihole-FTL --config debug.queries true
true
Pi-hole:/usr/bin# tail -F /var/log/pihole/FTL.log
2024-08-03 20:42:18.507 CST [147/T151] INFO: [✓] FTLCONF_misc_etc_dnsmasq_d is used
2024-08-03 20:42:18.507 CST [147/T151] INFO: [✓] FTLCONF_webserver_api_password is used
2024-08-03 20:42:18.507 CST [147/T151] INFO: [✓] FTLCONF_dns_upstreams is used
2024-08-03 20:42:18.507 CST [147/T151] INFO: [✓] FTLCONF_dhcp_active is used
2024-08-03 20:42:18.509 CST [147/T151] INFO: Wrote config file:
2024-08-03 20:42:18.509 CST [147/T151] INFO: - 148 total entries
2024-08-03 20:42:18.509 CST [147/T151] INFO: - 140 entries are default
2024-08-03 20:42:18.509 CST [147/T151] INFO: - 8 entries are modified
2024-08-03 20:42:18.509 CST [147/T151] INFO: - 3 entries are forced through environment
2024-08-03 20:42:18.514 CST [147/T151] INFO: Config file written to /etc/pihole/pihole.toml
2024-08-03 20:42:47.024 CST [147M] DEBUG_QUERIES: Replying to pi.hole with interface-local IP address
2024-08-03 20:42:47.024 CST [147M] DEBUG_QUERIES: Preparing reply for "pi.hole", EDE: N/A (-1)
2024-08-03 20:42:47.024 CST [147M] DEBUG_QUERIES: Forced DNS reply to IP
2024-08-03 20:42:47.024 CST [147M] DEBUG_QUERIES: Adding RR: "pi.hole A 127.0.0.1"
2024-08-03 20:43:00.043 CST [147M] DEBUG_ANY: dnsmasq received signal 17
2024-08-03 20:43:00.045 CST [147M] DEBUG_ANY: dnsmasq received signal 17
^C
Pi-hole:/usr/bin# tail -F /var/log/pihole/
FTL.log pihole.log pihole.log.2.gz webserver.log webserver.log.2.gz
FTL.log.1 pihole.log.1 pihole_updateGravity.log webserver.log.1
Pi-hole:/usr/bin# tail -F /var/log/pihole/pihole.log
Aug 3 20:43:09 dnsmasq[147]: cached-stale postgresql is NODATA-IPv6
Aug 3 20:43:09 dnsmasq[147]: forwarded postgresql to 169.254.0.254#5335
Aug 3 20:43:09 dnsmasq[147]: reply postgresql is NODATA-IPv6
Aug 3 20:43:09 dnsmasq[147]: query[AAAA] postgresql from 192.168.249.109
Aug 3 20:43:09 dnsmasq[147]: cached postgresql is NODATA-IPv6
Aug 3 20:43:09 dnsmasq[147]: query[A] postgresql from 192.168.249.109
Aug 3 20:43:09 dnsmasq[147]: cached-stale postgresql is 198.18.0.240
Aug 3 20:43:09 dnsmasq[147]: reply postgresql is 198.18.0.240
Aug 3 20:43:17 dnsmasq[147]: query[A] pi.hole from 127.0.0.1
Aug 3 20:43:17 dnsmasq[147]: Pi-hole hostname pi.hole is 127.0.0.1
Aug 3 20:43:33 dnsmasq[147]: query[PTR] 129.0.31.172.in-addr.arpa from 192.168.249.100
Aug 3 20:43:33 dnsmasq[147]: config 172.31.0.129 is NXDOMAIN
Aug 3 20:43:33 dnsmasq[147]: query[PTR] 100.249.168.192.in-addr.arpa from 127.0.0.1
Aug 3 20:43:33 dnsmasq[147]: config 192.168.249.100 is NXDOMAIN
Aug 3 20:43:36 dnsmasq[147]: query[A] qq.com from 192.168.249.100
Aug 3 20:43:36 dnsmasq[147]: forwarded qq.com to 169.254.0.254#5335
Aug 3 20:43:36 dnsmasq[147]: reply qq.com is 113.108.81.189
Aug 3 20:43:36 dnsmasq[147]: reply qq.com is 123.150.76.218
Aug 3 20:43:36 dnsmasq[147]: query[PTR] 189.81.108.113.in-addr.arpa from 192.168.249.100
Aug 3 20:43:36 dnsmasq[147]: forwarded 189.81.108.113.in-addr.arpa to 169.254.0.254#5335
Aug 3 20:43:37 dnsmasq[147]: reply 113.108.81.189 is NXDOMAIN
Aug 3 20:43:43 dnsmasq[147]: query[A] www.google.com from 192.168.249.100
Aug 3 20:43:43 dnsmasq[147]: forwarded www.google.com to 169.254.0.254#5335
Aug 3 20:43:43 dnsmasq[147]: reply www.google.com is 198.18.0.34
Aug 3 20:43:43 dnsmasq[147]: query[PTR] 34.0.18.198.in-addr.arpa from 192.168.249.100
Aug 3 20:43:43 dnsmasq[147]: forwarded 34.0.18.198.in-addr.arpa to 169.254.0.254#5335
Aug 3 20:43:43 dnsmasq[147]: reply 198.18.0.34 is NXDOMAIN
Aug 3 20:43:47 dnsmasq[147]: query[A] pi.hole from 127.0.0.1
Aug 3 20:43:47 dnsmasq[147]: Pi-hole hostname pi.hole is 127.0.0.1
^C
Pi-hole:/usr/bin# tail -F /var/log/pihole/FTL.log
2024-08-03 20:43:43.134 CST [147M] DEBUG_QUERIES: Checking if "34.0.18.198.in-addr.arpa" is in gravity (exact): no
2024-08-03 20:43:43.134 CST [147M] DEBUG_QUERIES: DNS cache: 192.168.249.100/34.0.18.198.in-addr.arpa is not blocked (domainlist ID: -1)
2024-08-03 20:43:43.134 CST [147M] DEBUG_QUERIES: **** forwarded 34.0.18.198.in-addr.arpa to 169.254.0.254#5335 (ID 5451, src/dnsmasq/forward.c:559)
2024-08-03 20:43:43.194 CST [147M] DEBUG_QUERIES: **** got upstream reply from 169.254.0.254#5335: (NXDOMAIN) is 34.0.18.198.in-addr.arpa (ID 5451, src/dnsmasq/rfc1035.c:771)
2024-08-03 20:43:43.194 CST [147M] DEBUG_QUERIES: Set reply to NXDOMAIN (2) in src/dnsmasq_interface.c:2228
2024-08-03 20:43:43.194 CST [147M] DEBUG_QUERIES: Skipping detection of external blocking IP for ID 5451 as query is PTR
2024-08-03 20:43:47.213 CST [147M] DEBUG_QUERIES: Replying to pi.hole with interface-local IP address
2024-08-03 20:43:47.213 CST [147M] DEBUG_QUERIES: Preparing reply for "pi.hole", EDE: N/A (-1)
2024-08-03 20:43:47.213 CST [147M] DEBUG_QUERIES: Forced DNS reply to IP
2024-08-03 20:43:47.213 CST [147M] DEBUG_QUERIES: Adding RR: "pi.hole A 127.0.0.1"
2024-08-03 20:44:00.034 CST [147M] DEBUG_ANY: dnsmasq received signal 17
2024-08-03 20:44:00.036 CST [147M] DEBUG_ANY: dnsmasq received signal 17
2024-08-03 20:44:10.978 CST [147M] DEBUG_QUERIES: **** new UDP IPv4 query[AAAA] query "postgresql" from eth0/192.168.249.109#44895 (ID 5453, FTL 8966, src/dnsmasq/forward.c:1815)
2024-08-03 20:44:10.978 CST [147M] DEBUG_QUERIES: postgresql is known as not to be blocked
2024-08-03 20:44:10.978 CST [147M] DEBUG_QUERIES: **** got stale cache reply: postgresql is (NODATA) (ID 5453, src/dnsmasq/rfc1035.c:2034)
2024-08-03 20:44:10.978 CST [147M] DEBUG_QUERIES: Set reply to NODATA (1) in src/dnsmasq_interface.c:2141
2024-08-03 20:44:10.979 CST [147M] DEBUG_QUERIES: **** forwarded postgresql to 169.254.0.254#5335 (ID 5453, src/dnsmasq/forward.c:559)
2024-08-03 20:44:10.979 CST [147M] DEBUG_QUERIES: **** new UDP IPv4 query[A] query "postgresql" from eth0/192.168.249.109#33443 (ID 5454, FTL 8967, src/dnsmasq/forward.c:1815)
2024-08-03 20:44:10.979 CST [147M] DEBUG_QUERIES: postgresql is known as not to be blocked
2024-08-03 20:44:10.979 CST [147M] DEBUG_QUERIES: **** got stale cache reply: postgresql is 198.18.0.240 (ID 5454, src/dnsmasq/rfc1035.c:2047)
2024-08-03 20:44:10.979 CST [147M] DEBUG_QUERIES: Set reply to IP (4) in src/dnsmasq_interface.c:2141
2024-08-03 20:44:10.979 CST [147M] DEBUG_QUERIES: FTL_CNAME called with: src = postgresql, dst = postgresql, id = 5454
2024-08-03 20:44:10.979 CST [147M] DEBUG_QUERIES: postgresql is known as not to be blocked
2024-08-03 20:44:10.979 CST [147M] DEBUG_QUERIES: Query 5454: CNAME postgresql ---> postgresql
2024-08-03 20:44:10.979 CST [147M] DEBUG_QUERIES: **** forwarded postgresql to 169.254.0.254#5335 (ID 5454, src/dnsmasq/forward.c:559)
2024-08-03 20:44:10.980 CST [147M] DEBUG_QUERIES: **** got upstream reply from 169.254.0.254#5335: postgresql is (NODATA) (ID 5453, src/dnsmasq/rfc1035.c:1065)
2024-08-03 20:44:10.982 CST [147M] DEBUG_QUERIES: **** new UDP IPv4 query[AAAA] query "postgresql" from eth0/192.168.249.109#49776 (ID 5455, FTL 8968, src/dnsmasq/forward.c:1815)
2024-08-03 20:44:10.982 CST [147M] DEBUG_QUERIES: postgresql is known as not to be blocked
2024-08-03 20:44:10.982 CST [147M] DEBUG_QUERIES: **** got cache reply: postgresql is (NODATA) (ID 5455, src/dnsmasq/rfc1035.c:2034)
2024-08-03 20:44:10.982 CST [147M] DEBUG_QUERIES: Set reply to NODATA (1) in src/dnsmasq_interface.c:2141
2024-08-03 20:44:10.982 CST [147M] DEBUG_QUERIES: **** new UDP IPv4 query[A] query "postgresql" from eth0/192.168.249.109#36457 (ID 5456, FTL 8969, src/dnsmasq/forward.c:1815)
2024-08-03 20:44:10.982 CST [147M] DEBUG_QUERIES: postgresql is known as not to be blocked
2024-08-03 20:44:10.982 CST [147M] DEBUG_QUERIES: **** got stale cache reply: postgresql is 198.18.0.240 (ID 5456, src/dnsmasq/rfc1035.c:2047)
2024-08-03 20:44:10.982 CST [147M] DEBUG_QUERIES: Set reply to IP (4) in src/dnsmasq_interface.c:2141
2024-08-03 20:44:10.982 CST [147M] DEBUG_QUERIES: FTL_CNAME called with: src = postgresql, dst = postgresql, id = 5456
2024-08-03 20:44:10.982 CST [147M] DEBUG_QUERIES: postgresql is known as not to be blocked
2024-08-03 20:44:10.982 CST [147M] DEBUG_QUERIES: Query 5456: CNAME postgresql ---> postgresql
2024-08-03 20:44:10.983 CST [147M] DEBUG_QUERIES: **** query for postgresql is already in progress (ID 5456)
2024-08-03 20:44:11.003 CST [147M] DEBUG_QUERIES: **** got upstream reply from 169.254.0.254#5335: postgresql is 198.18.0.240 (ID 5454, src/dnsmasq/rfc1035.c:1047)
2024-08-03 20:44:13.942 CST [147M] DEBUG_QUERIES: **** new UDP IPv4 query[A] query "www.huawei.com" from eth0/192.168.249.100#53026 (ID 5457, FTL 8970, src/dnsmasq/forward.c:1815)
2024-08-03 20:44:13.943 CST [147M] DEBUG_QUERIES: www.huawei.com is not known
2024-08-03 20:44:13.943 CST [147M] DEBUG_QUERIES: Checking if "www.huawei.com" is in antigravity (exact): no
2024-08-03 20:44:13.943 CST [147M] DEBUG_QUERIES: Checking if "www.huawei.com" is in gravity (exact): no
2024-08-03 20:44:13.943 CST [147M] DEBUG_QUERIES: DNS cache: 192.168.249.100/www.huawei.com is not blocked (domainlist ID: -1)
2024-08-03 20:44:13.943 CST [147M] DEBUG_QUERIES: **** forwarded www.huawei.com to 169.254.0.254#5335 (ID 5457, src/dnsmasq/forward.c:559)
2024-08-03 20:44:14.177 CST [147M] DEBUG_QUERIES: **** got upstream reply from 169.254.0.254#5335: www.huawei.com is (CNAME) (ID 5457, src/dnsmasq/rfc1035.c:845)
2024-08-03 20:44:14.177 CST [147M] DEBUG_QUERIES: Set reply to CNAME (3) in src/dnsmasq_interface.c:2228
2024-08-03 20:44:14.177 CST [147M] DEBUG_QUERIES: FTL_CNAME called with: src = www.huawei.com, dst = www.huawei.com.akadns.net, id = 5457
2024-08-03 20:44:14.177 CST [147M] DEBUG_QUERIES: www.huawei.com.akadns.net is not known
2024-08-03 20:44:14.177 CST [147M] DEBUG_QUERIES: Checking if "www.huawei.com.akadns.net" is in antigravity (exact): no
2024-08-03 20:44:14.177 CST [147M] DEBUG_QUERIES: Checking if "www.huawei.com.akadns.net" is in gravity (exact): no
2024-08-03 20:44:14.177 CST [147M] DEBUG_QUERIES: DNS cache: 192.168.249.100/www.huawei.com.akadns.net is not blocked (domainlist ID: -1)
2024-08-03 20:44:14.177 CST [147M] DEBUG_QUERIES: Query 5457: CNAME www.huawei.com ---> www.huawei.com.akadns.net
2024-08-03 20:44:14.177 CST [147M] DEBUG_QUERIES: **** got upstream reply: www.huawei.com.akadns.net is (CNAME) (ID 5457, src/dnsmasq/rfc1035.c:845)
2024-08-03 20:44:14.177 CST [147M] DEBUG_QUERIES: FTL_CNAME called with: src = www.huawei.com.akadns.net, dst = www.huawei.com.c.cdnhwc1.com, id = 5457
2024-08-03 20:44:14.177 CST [147M] DEBUG_QUERIES: www.huawei.com.c.cdnhwc1.com is not known
2024-08-03 20:44:14.177 CST [147M] DEBUG_QUERIES: Checking if "www.huawei.com.c.cdnhwc1.com" is in antigravity (exact): no
2024-08-03 20:44:14.177 CST [147M] DEBUG_QUERIES: Checking if "www.huawei.com.c.cdnhwc1.com" is in gravity (exact): no
2024-08-03 20:44:14.177 CST [147M] DEBUG_QUERIES: DNS cache: 192.168.249.100/www.huawei.com.c.cdnhwc1.com is not blocked (domainlist ID: -1)
2024-08-03 20:44:14.177 CST [147M] DEBUG_QUERIES: Query 5457: CNAME www.huawei.com.akadns.net ---> www.huawei.com.c.cdnhwc1.com
2024-08-03 20:44:14.177 CST [147M] DEBUG_QUERIES: **** got upstream reply: www.huawei.com.c.cdnhwc1.com is (CNAME) (ID 5457, src/dnsmasq/rfc1035.c:845)
2024-08-03 20:44:14.177 CST [147M] DEBUG_QUERIES: FTL_CNAME called with: src = www.huawei.com.c.cdnhwc1.com, dst = hcdnw.cbgipv6.gslb.c.cdnhwc2.com, id = 5457
2024-08-03 20:44:14.177 CST [147M] DEBUG_QUERIES: hcdnw.cbgipv6.gslb.c.cdnhwc2.com is not known
2024-08-03 20:44:14.178 CST [147M] DEBUG_QUERIES: Checking if "hcdnw.cbgipv6.gslb.c.cdnhwc2.com" is in antigravity (exact): no
2024-08-03 20:44:14.178 CST [147M] DEBUG_QUERIES: Checking if "hcdnw.cbgipv6.gslb.c.cdnhwc2.com" is in gravity (exact): no
2024-08-03 20:44:14.178 CST [147M] DEBUG_QUERIES: DNS cache: 192.168.249.100/hcdnw.cbgipv6.gslb.c.cdnhwc2.com is not blocked (domainlist ID: -1)
2024-08-03 20:44:14.178 CST [147M] DEBUG_QUERIES: Query 5457: CNAME www.huawei.com.c.cdnhwc1.com ---> hcdnw.cbgipv6.gslb.c.cdnhwc2.com
2024-08-03 20:44:14.178 CST [147M] DEBUG_QUERIES: **** got upstream reply: hcdnw.cbgipv6.gslb.c.cdnhwc2.com is 117.25.159.190 (ID 5457, src/dnsmasq/rfc1035.c:1047)
2024-08-03 20:44:14.178 CST [147M] DEBUG_QUERIES: **** got upstream reply: hcdnw.cbgipv6.gslb.c.cdnhwc2.com is 120.39.165.53 (ID 5457, src/dnsmasq/rfc1035.c:1047)
2024-08-03 20:44:14.178 CST [147M] DEBUG_QUERIES: **** got upstream reply: hcdnw.cbgipv6.gslb.c.cdnhwc2.com is 27.159.90.81 (ID 5457, src/dnsmasq/rfc1035.c:1047)
2024-08-03 20:44:14.178 CST [147M] DEBUG_QUERIES: **** got upstream reply: hcdnw.cbgipv6.gslb.c.cdnhwc2.com is 27.159.90.83 (ID 5457, src/dnsmasq/rfc1035.c:1047)
2024-08-03 20:44:14.178 CST [147M] DEBUG_QUERIES: **** got upstream reply: hcdnw.cbgipv6.gslb.c.cdnhwc2.com is 117.25.159.186 (ID 5457, src/dnsmasq/rfc1035.c:1047)
2024-08-03 20:44:14.178 CST [147M] DEBUG_QUERIES: **** got upstream reply: hcdnw.cbgipv6.gslb.c.cdnhwc2.com is 117.25.159.187 (ID 5457, src/dnsmasq/rfc1035.c:1047)
2024-08-03 20:44:14.178 CST [147M] DEBUG_QUERIES: **** got upstream reply: hcdnw.cbgipv6.gslb.c.cdnhwc2.com is 117.25.159.188 (ID 5457, src/dnsmasq/rfc1035.c:1047)
2024-08-03 20:44:14.183 CST [147M] DEBUG_QUERIES: **** new UDP IPv4 query[PTR] query "190.159.25.117.in-addr.arpa" from eth0/192.168.249.100#43128 (ID 5458, FTL 8971, src/dnsmasq/forward.c:1815)
2024-08-03 20:44:14.183 CST [147M] DEBUG_QUERIES: 190.159.25.117.in-addr.arpa is not known
2024-08-03 20:44:14.183 CST [147M] DEBUG_QUERIES: Checking if "190.159.25.117.in-addr.arpa" is in antigravity (exact): no
2024-08-03 20:44:14.183 CST [147M] DEBUG_QUERIES: Checking if "190.159.25.117.in-addr.arpa" is in gravity (exact): no
2024-08-03 20:44:14.183 CST [147M] DEBUG_QUERIES: DNS cache: 192.168.249.100/190.159.25.117.in-addr.arpa is not blocked (domainlist ID: -1)
2024-08-03 20:44:14.184 CST [147M] DEBUG_QUERIES: **** forwarded 190.159.25.117.in-addr.arpa to 169.254.0.254#5335 (ID 5458, src/dnsmasq/forward.c:559)
2024-08-03 20:44:15.605 CST [147M] DEBUG_QUERIES: **** got upstream reply from 169.254.0.254#5335: (NXDOMAIN) is 190.159.25.117.in-addr.arpa (ID 5458, src/dnsmasq/rfc1035.c:771)
2024-08-03 20:44:15.605 CST [147M] DEBUG_QUERIES: Set reply to NXDOMAIN (2) in src/dnsmasq_interface.c:2228
2024-08-03 20:44:15.605 CST [147M] DEBUG_QUERIES: Skipping detection of external blocking IP for ID 5458 as query is PTR
2024-08-03 20:44:17.310 CST [147M] DEBUG_QUERIES: Replying to pi.hole with interface-local IP address
2024-08-03 20:44:17.311 CST [147M] DEBUG_QUERIES: Preparing reply for "pi.hole", EDE: N/A (-1)
2024-08-03 20:44:17.311 CST [147M] DEBUG_QUERIES: Forced DNS reply to IP
2024-08-03 20:44:17.311 CST [147M] DEBUG_QUERIES: Adding RR: "pi.hole A 127.0.0.1"
^C
Pi-hole:/usr/bin#
You accidentally doubled --config, that's why it didn't work:
Yes, the first input was wrong
But the second input was correct
Pi-hole:/# cd /usr/bin/
Pi-hole:/usr/bin# sudo pihole-FTL --config --config debug.queries true
Usage: pihole-FTL --config [<config item key>] [<value>]
Example: pihole-FTL --config dns.blockESNI true
Pi-hole:/usr/bin# sudo pihole-FTL --config debug.queries true
true
Sorry, I checked your post on my phone and didn't see that the field was scrollable.
This shows that everything should work as expected. I will reply later with another thing we can check once I have had some more time to think about possible causes.
If you switch back to the beta v6 and then run
pihole-FTL sqlite3 -h /etc/pihole/pihole-FTL.db "SELECT * FROM queries ORDER BY id DESC LIMIT 5;"
does it show 127.0.0.1 or the real clients?
This all seems correct, could you please upload a debug log so we can have a look at your configuration?
There might be some unintended interference with certain settings which could be causing your Pi-hole to hide all clients except the one you are still seeing (127.0.0.1). My suspicion goes into the direction of the setting webserver.api.excludeClients.
Where can I get the token after running pihole -d?