Unsure if Pihole+Unbound are blocking ads on iPhone

Help
42

Ow by the way, that site is perfect for testing:

image
image774Ɨ580 31.6 KB

43

Hahah, yeah, speedtest.net is good for running reliable speedtests but it is REALLY bad for ads.

44

I ended up purging all files related to unbound and reinstalling. @deHakkelaar helped with ensuring that looked good but the last 6-7 posts indicate something is still weird, even with a fresh unbound install, my Pihole isn't catching ads that it definitely should be. I posted a debug log last night as @deHakkelaar and I were working on it.

45

Run from the machine hosting your Pi-hole, what's the output of:

echo ">stats >quit" | nc localhost 4711
46 
root@DietPi:~# echo ">stats >quit" | nc localhost 4711
domains_being_blocked 279477
dns_queries_today 45255
ads_blocked_today 9093
ads_percentage_today 20.092808
unique_domains 3372
queries_forwarded 27484
queries_cached 8367
clients_ever_seen 24
unique_clients 23
dns_queries_all_types 45255
reply_UNKNOWN 1497
reply_NODATA 4972
reply_NXDOMAIN 1016
reply_CNAME 15724
reply_IP 21668
reply_DOMAIN 195
reply_RRNAME 1
reply_SERVFAIL 0
reply_REFUSED 0
reply_NOTIMP 0
reply_OTHER 0
reply_DNSSEC 0
reply_NONE 0
reply_BLOB 182
dns_queries_all_replies 45255
privacy_level 0
status enabled
47

I'm worried I may have a partial DNS loop and that may be causing these issues...

My Pi-hole is set as my only DNS inside of my DHCP server (my Unifi controller):

2023-08-05_18-56-22
2023-08-05_18-56-22631Ɨ768 19 KB

I also have two other VLANs with the Pi-hole as the only DNS:

2023-08-05_18-58-20
2023-08-05_18-58-20632Ɨ795 19.1 KB

And:

2023-08-05_18-58-43
2023-08-05_18-58-43638Ɨ800 19.3 KB

But then inside of the Pi-hole, I have Conditional Forwarding setup so my local devices show the hostnames inside of the query log:

2023-08-05_18-59-08
2023-08-05_18-59-08968Ɨ488 34.4 KB

Is this setup causing a loop and could that be what's creating these issues, even on a fresh install of Unbound?

48

It could be if you also configured the Pi-hole IP in the WAN/Internet DNS settings on the router which could close a loop or partial loop?
And does below file exists and if so, whats in it?

cat /etc/unbound/unbound.conf.d/resolvconf_resolvers.conf

Also I noticed your clients hostnames having the .local suffix domain name configured which is not recommended:

I see your router settings allow to configure a "Domain Name" suffix for the separate LAN segments.
I'dd suggest name them like below instead of localdomain (which isnt't gonna work properly anyway with CF "Conditional Forwarding" for all three segments):

lan.home.arpa.

iot.home.arpa.

adc.home.arpa.

So you're RFC complient :wink:

I'dd suggest to get it working for your LAN segment only at first.
Configuring Pi-hole with CF for multiple domains on multiple network segments involves a bit of hacking and a better understanding.
You can learn allot if search Discourse here!

EDIT: And oc the docs:

49

Nah, this isn't set in the WAN. The WAN's DNS is 1.1.1.1.

This file does not exist in the new unbound install.

Could this be causing what we were looking at yesterday? The Pi-hole not blocking things that are in the adlists. So in the router, I'll change the domain name for each of the segments (LAN first), but, in the Pi-hole, should I leave the Conditional Forwarding settings the way they are?

50

Dont know.

Only change the CF domain from local into that example: lan.home.arpa.

51

I have noticed that my local devices haven't been playing well together since reinstalling unbound. That's kind of what led me to ask this question. An example from earlier, my iPad screen mirroring to my Samsung TV. This should work flawlessly but sometimes, the connection is very unstable or doesn't work at all.

I thought it may have something to do with the domain name set in the router and the Conditional Forwarding set in the Pi-hole.

52

Ah, so leave the router's domain name set to what it is and set the lan.home.arpa. in the Pi-hole's CF settings?

53

No.
You should configure those domain names on the router in their separate DHCP sections in the "Domain Name" field at the bottom.
And adjust CF accordingly

54

Like this?

2023-08-05_22-07-33
2023-08-05_22-07-33642Ɨ873 21.6 KB

The trailing period is causing it to report invalid.

55

Thats it.
Set the same domain for Pi-hole CF.

EDIT: When we have things sorted first for LAN, I'll show you how to do CF for those other two domains.

EDIT2: Ow you can inspect what domain is advertised with below:

pihole-FTL dhcp-discover

56

Set in both places (for LAN):

2023-08-05_22-10-37
2023-08-05_22-10-37631Ɨ862 20.7 KB

2023-08-05_22-10-46
2023-08-05_22-10-46970Ɨ481 34.5 KB

57

Now go inspect:

At least for your LAN segment.

58 
root@DietPi:~# pihole-FTL dhcp-discover
Scanning all your interfaces for DHCP servers
Timeout: 10 seconds

* Received 307 bytes from eth0:192.168.1.1
  Offered IP address: 192.168.1.188
  Server IP address: 192.168.1.1
  Relay-agent IP address: N/A
  BOOTP server: (empty)
  BOOTP file: (empty)
  DHCP options:
   Message type: DHCPOFFER (2)
   server-identifier: 192.168.1.1
   lease-time: 86400 ( 1d )
   renewal-time: 43200 ( 12h )
   rebinding-time: 75600 ( 21h )
   netmask: 255.255.255.0
   broadcast: 192.168.1.255
   dns-server: 192.168.1.188
   router: 192.168.1.1
   domain-name: "lan.home.arpa"
   --- end of options ---

And I assume these are normal until we get CF working for the other VLANs?

2023-08-05_22-12-55
2023-08-05_22-12-55951Ɨ171 7.9 KB

59

Yes.
EDIT: Hold on, how are you gonna name the other two?

60

I would assume like the above.

61

Create a new config file with below (assuming the ..1 addresses are your routers):

sudo nano /etc/dnsmasq.d/99-my-settings.conf

Containing:

# IoT
server=/iot.home.arpa/192.168.1.1
rev-server=192.168.3.0/24,192.168.1.1

# ADC
server=/adc.home.arpa/192.168.1.1
rev-server=192.168.2.0/24,192.168.1.1

Save/exit and check syntax:

pihole-FTL --test

And apply:

pihole restartdns

Better generate a new token when sorted!
EDIT: And inform if things have improved :wink: