# V4-0 - errors with Cloudflared and DNS over HTTPS

**URL:** <https://discourse.pi-hole.net/t/v4-0-errors-with-cloudflared-and-dns-over-https/11619>\
**Category:** Help\
**Created:** [August 8, 2018, 5:22pm UTC](https://discourse.pi-hole.net/t/v4-0-errors-with-cloudflared-and-dns-over-https/11619 "2018-08-08T17:22:54Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jorgsmash](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jorgsmash/32/7324_2.png) [@Jorgsmash](https://discourse.pi-hole.net/u/Jorgsmash)\
**Post date:** [August 8, 2018, 5:22pm UTC](https://discourse.pi-hole.net/t/v4-0-errors-with-cloudflared-and-dns-over-https/11619/1 "2018-08-08T17:22:54Z")

</div>

#### Please follow the below template, it will help us to help you!

## Expected Behaviour:

_[Pihole blocklists should update and pull domains into blocklist. Dashboard should show total number of domains in blocklist. Nslookup on hosts on the LAN using the pihole for dns queries should return the ip address of entered domain. Eg. nslookup google.com]_

## Actual Behaviour:

\_[When trying to update block lists, connections are refused. Example:

[i] Target: raw.githubusercontent.com (hosts)  
[✗] Status: Connection Refused  
[✗] List download failed: no cached list available

New pihole dashboard shows 0 domains in blocklist, nslookup ran from hosts on LAN no longer work. eg:

> nslookup google.com  
> Server: Pi-hole  
> Address: 192.168.0.5

\*\*\* Pi-hole can't find google.com: Query refused

I have tried to whitelist the above domain so the list can be pulled but connection is still refused.]\_

ping google.com works on other hosts on the LAN, but not from the pihole server terminal. Eg:

$ping google.com  
ping: google.com: Temporary failure in name resolution

I did follow this guide here: [Securing DNS across all of my devices with Pi-Hole + DNS-over-HTTPS + 1.1.1.1](https://scotthelme.co.uk/securing-dns-across-all-of-my-devices-with-pihole-dns-over-https-1-1-1-1/)

to set up DNS over HTTPS and everything was working until I updated, so maybe there is a problem with my configuration settings.

## Debug Token:

\_[[i] Debug script running in automated mode  
\* Using openssl for transmission.  
[✗] There was an error uploading your debug log.

- Please try again or contact the Pi-hole team for assistance.
- A local copy of the debug log can be found at: /var/log/pihole\_debug-sanitized.log]\_

How do I get you guys the log if it failed to upload? Thanks for the help!

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [August 8, 2018, 5:42pm UTC](https://discourse.pi-hole.net/t/v4-0-errors-with-cloudflared-and-dns-over-https/11619/2 "2018-08-08T17:42:12Z")

</div>

What are your upstream DNS servers currently set to in Pi-Hole? From the web admin \> settings \> dns page? The section of the page should look something like this:

 ![image](https://discourse.pi-hole.net/uploads/default/original/2X/2/243486b50ee4582403d5670d06e80b8d8607dd32.jpeg)

---

<div class="post-metadata">

**Author:** ![Jorgsmash](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jorgsmash/32/7324_2.png) [@Jorgsmash](https://discourse.pi-hole.net/u/Jorgsmash)\
**Post date:** [August 8, 2018, 5:48pm UTC](https://discourse.pi-hole.net/t/v4-0-errors-with-cloudflared-and-dns-over-https/11619/3 "2018-08-08T17:48:20Z")

</div>

Thanks for the reply! There are no settings selected on that page due to me configuring the pihole to use cloudflare's DNS over HTTPS. I configured that about a week ago and everything was working even with no upstream server selected. The steps I took to configure the DNS over HTTPS are in that link I posted. That may be the issue. Hopefully not though because DNS over HTTPS seemed like a cool (and more secure) configuration.

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [August 8, 2018, 5:52pm UTC](https://discourse.pi-hole.net/t/v4-0-errors-with-cloudflared-and-dns-over-https/11619/4 "2018-08-08T17:52:29Z")

</div>

Your instructions have it setup on port 54, so it would be 127.0.0.1#54.

Note in the older versions of Pi-Hole, you could not have a custom port, so if you mapped it elsewhere in a configuration file, it would not have shown on the DNS server page. With the newer version (V4.0) of Pi-Hole it will display as a custom IPV4.

Here is what my screen shows using unbound as a local resolver on port 5353, for comparison:

 ![image](https://discourse.pi-hole.net/uploads/default/original/2X/c/c185ed52d781e04e7afd1bf121f339500a907b01.jpeg)

You can also check your settings by running this command and seeing which "server" lines are populated:

`cat /etc/dnsmasq.d/01-pihole.conf`

If fixing the server assignment doesn't work, I recommend that as a short term fix you select Cloudflare (at the bottom of your web GUI for DNS server settings) as your upstream DNS and see if that gets your Pi-Hole running again. May have to restart dnsmasq from the Settings \> System page.

---

<div class="post-metadata">

**Author:** ![wd9895](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/wd9895/32/54849_2.png) [@wd9895](https://discourse.pi-hole.net/u/wd9895)\
**Post date:** [August 8, 2018, 6:15pm UTC](https://discourse.pi-hole.net/t/v4-0-errors-with-cloudflared-and-dns-over-https/11619/5 "2018-08-08T18:15:59Z")

</div>

it's port #53 in my config.

---

<div class="post-metadata">

**Author:** ![Jorgsmash](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jorgsmash/32/7324_2.png) [@Jorgsmash](https://discourse.pi-hole.net/u/Jorgsmash)\
**Post date:** [August 8, 2018, 6:24pm UTC](https://discourse.pi-hole.net/t/v4-0-errors-with-cloudflared-and-dns-over-https/11619/6 "2018-08-08T18:24:11Z")

</div>

Exactly I did have the configuration to go through a proxy on port 54, but that was set in the config files for pihole, not in the admin console. When I made that change all of the upstream servers disappeared. Perhaps it wasn't actually working and the blocking of domains was from the blocklist that was already loaded. Whats even more weird is the internet still worked. I was able to make this post connected to the pihole. I selected the cloudflare upstream dns and all is working again. I suppose the dns over https isn't working properly now though.

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [August 8, 2018, 6:27pm UTC](https://discourse.pi-hole.net/t/v4-0-errors-with-cloudflared-and-dns-over-https/11619/7 "2018-08-08T18:27:38Z")

</div>

I would run through the install process for DNS over HTTPs and see if it that will fix it now that you've updated Pi-Hole.

---

<div class="post-metadata">

**Author:** ![Jorgsmash](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jorgsmash/32/7324_2.png) [@Jorgsmash](https://discourse.pi-hole.net/u/Jorgsmash)\
**Post date:** [August 8, 2018, 7:14pm UTC](https://discourse.pi-hole.net/t/v4-0-errors-with-cloudflared-and-dns-over-https/11619/8 "2018-08-08T19:14:18Z")

</div>

Will do! So when I reconfigure, I should put the custom dns address to loopback.address#54? Is there a reason a # is used instead of a colon? I see in the release notes a bunch of new stuff implemented in v4. For instance it says that the domains for the blocklists are no longer automatically whitelisted. I did not notice them being whitelisted automatically before, and they are not whitelisted now and can still be accessed. What is that supposed to do? Also, it says the new default blocking mode is NULL. Not sure what that means either.

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [August 8, 2018, 7:37pm UTC](https://discourse.pi-hole.net/t/v4-0-errors-with-cloudflared-and-dns-over-https/11619/9 "2018-08-08T19:37:37Z")

</div>

> [@Jorgsmash](#):
>
> So when I reconfigure, I should put the custom dns address to loopback.address#54? Is there a reason a # is used instead of a colon?

Yes, loopback address - # - 54. The convention for ports is to use #.

> [@Jorgsmash](#):
>
> For instance it says that the domains for the blocklists are no longer automatically whitelisted

I once read why, but can't recall the details. I'm sure one of the devs can shed light on this.

> [@Jorgsmash](#):
>
> Also, it says the new default blocking mode is NULL. Not sure what that means either.

In the past, the return for a Pi-Holed IP was the IP of the Pi-Hole. This caused some problems with slow loading pages, among other things. Now there are four options (discussed here: [Blocking mode - Pi-hole documentation](https://docs.pi-hole.net/ftldns/blockingmode/#pi-holes-unspecified-ip-blocking-default)). The developers chose NULL as the default (returns 0.0.0.0) because this is the most reliable solution in most setups.

---

<div class="post-metadata">

**Author:** ![Mcat12](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mcat12/32/20_2.png) [@Mcat12](https://discourse.pi-hole.net/u/Mcat12)\
**Post date:** [August 8, 2018, 7:41pm UTC](https://discourse.pi-hole.net/t/v4-0-errors-with-cloudflared-and-dns-over-https/11619/10 "2018-08-08T19:41:48Z")

</div>

The `#` is used for ports originally because that is the separator that dnsmasq uses for ports in its config file.

The block lists are not automatically whitelisted now to avoid confusion about why certain domains would be whitelisted without the user doing anything, and it was rare that a list would block another list.

---

<div class="post-metadata">

**Author:** ![Jorgsmash](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jorgsmash/32/7324_2.png) [@Jorgsmash](https://discourse.pi-hole.net/u/Jorgsmash)\
**Post date:** [August 8, 2018, 8:10pm UTC](https://discourse.pi-hole.net/t/v4-0-errors-with-cloudflared-and-dns-over-https/11619/11 "2018-08-08T20:10:36Z")

</div>

Thanks! I think the issue is fixed for now. I will reconfigure and see if I break anything! I have some reading to do! Pi hole rules!

---

<div class="post-metadata">

**Author:** ![Jorgsmash](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jorgsmash/32/7324_2.png) [@Jorgsmash](https://discourse.pi-hole.net/u/Jorgsmash)\
**Post date:** [August 8, 2018, 8:39pm UTC](https://discourse.pi-hole.net/t/v4-0-errors-with-cloudflared-and-dns-over-https/11619/12 "2018-08-08T20:39:57Z")

</div>

I reconfigured DNS over HTTPS and now everything is working as it once was, but the DNS settings page is still showing as nothing selected.

 ![image](https://discourse.pi-hole.net/uploads/default/original/2X/e/e4898ac7c4ae3276e3eaecd32815b3cf564b7720.png)

Here is my /etc/dnsmasq.d/01-pihole.conf entries, and like I said everything is working but not showing in settings:

 ![image](https://discourse.pi-hole.net/uploads/default/original/2X/b/b6644e109947ec6619c3155806a7bf316fceef23.png)

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [August 8, 2018, 8:59pm UTC](https://discourse.pi-hole.net/t/v4-0-errors-with-cloudflared-and-dns-over-https/11619/13 "2018-08-08T20:59:55Z")

</div>

That's interesting.

Just for my curiosity, what are the contents of your file `/etc/pihole/setupVars.conf`.

What PIHOLE\_DNS are listed?

---

<div class="post-metadata">

**Author:** ![Jorgsmash](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jorgsmash/32/7324_2.png) [@Jorgsmash](https://discourse.pi-hole.net/u/Jorgsmash)\
**Post date:** [August 8, 2018, 9:10pm UTC](https://discourse.pi-hole.net/t/v4-0-errors-with-cloudflared-and-dns-over-https/11619/14 "2018-08-08T21:10:14Z")

</div>

This file was also edited while setting up DNS over HTTPS, so here are the entries:

![image](https://discourse.pi-hole.net/uploads/default/original/2X/a/acbd19816b7677996d3d51969081c57733fdac02.png)

---

<div class="post-metadata">

**Author:** ![Jorgsmash](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jorgsmash/32/7324_2.png) [@Jorgsmash](https://discourse.pi-hole.net/u/Jorgsmash)\
**Post date:** [August 8, 2018, 9:13pm UTC](https://discourse.pi-hole.net/t/v4-0-errors-with-cloudflared-and-dns-over-https/11619/15 "2018-08-08T21:13:16Z")

</div>

I can verify everything still works as a host on my lan:

> nslookup google.com  
> Server: Pi-hole  
> Address: 192.168.0.5

Non-authoritative answer:  
Name: google.com  
Addresses: 2607:f8b0:4002:80f::200e  
172.217.12.110

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [August 8, 2018, 9:15pm UTC](https://discourse.pi-hole.net/t/v4-0-errors-with-cloudflared-and-dns-over-https/11619/16 "2018-08-08T21:15:23Z")

</div>

Thanks for checking and glad all works. I just hadn't seen that particular configuration before and it is slightly different than unbound. So, I learned something. Thanks.

---

<div class="post-metadata">

**Author:** ![Jorgsmash](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jorgsmash/32/7324_2.png) [@Jorgsmash](https://discourse.pi-hole.net/u/Jorgsmash)\
**Post date:** [August 8, 2018, 9:19pm UTC](https://discourse.pi-hole.net/t/v4-0-errors-with-cloudflared-and-dns-over-https/11619/17 "2018-08-08T21:19:06Z")

</div>

I wouldn't know any other way to do it as I just followed that guide. Not sure why they suggest port 54 instead of 53 either. I haven't heard of Unbound. I'll look that up next!

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [August 8, 2018, 9:21pm UTC](https://discourse.pi-hole.net/t/v4-0-errors-with-cloudflared-and-dns-over-https/11619/18 "2018-08-08T21:21:42Z")

</div>

Here's a good discussion and a guide to setting it up. I prefer using unbound to an encrypted DNS connection.

> [@FTLDNS and Unbound Combined For Your Own All-Around DNS Solution](https://discourse.pi-hole.net/t/ftldns-and-unbound-combined-for-your-own-all-around-dns-solution/10222):
>
> Originally published at: [https://pi-hole.net/2018/06/09/ftldns-and-unbound-combined-for-your-own-all-around-dns-solution/](https://pi-hole.net/2018/06/09/ftldns-and-unbound-combined-for-your-own-all-around-dns-solution/) How Pi-hole Works Pi-hole acts as a forwarding DNS server, which means if it doesn't know where a domain is, it has to forward your query to another server that does. When you install Pi-hole, it knows where the ad-serving domains are (because you tell it), so it doesn't forward those requests. But it doesn't know where legitimate sites are. Thus these requests are fo…

---

<div class="post-metadata">

**Author:** ![Mcat12](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mcat12/32/20_2.png) [@Mcat12](https://discourse.pi-hole.net/u/Mcat12)\
**Post date:** [August 8, 2018, 11:37pm UTC](https://discourse.pi-hole.net/t/v4-0-errors-with-cloudflared-and-dns-over-https/11619/19 "2018-08-08T23:37:07Z")

</div>

Because you removed the first two upstream DNS servers, the script does not find the first server and therefore assumes there are no servers. Remove the commented out lines and change the 3 to a 1.

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [August 29, 2018, 11:40pm UTC](https://discourse.pi-hole.net/t/v4-0-errors-with-cloudflared-and-dns-over-https/11619/20 "2018-08-29T23:40:54Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.