Expected Behaviour:
I go to the "list all queries", find the one that I want to block and click the 'deny' button and expect it to acknowledge and block that domain / host going forward.
Actual Behaviour:
When I click the deny button it pops up with an error "Timeout or Network Connection Error!"
This worked for a while and everything else still does. Been running for maybe a couple months and had blocked everything I wanted to (in addition to the built ion list). I found a new host and tried blocking it, but get the error mentioned above. I tried restarting but no change. Not sure what to do, check or try, so any suggestions are much appreciated!
Please upload a debug log and post just the token URL that is generated after the log is uploaded by running the following command from the Pi-hole host terminal:
sudo pihole -d
or if you run your Pi-hole as a Docker container:
docker exec -it <pihole-container-name-or-id> pihole -d
where you substitute <pihole-container-name-or-id> as required.
Sure, I ran that, but thought it said only add that if there are errors listed in the diagnostic tab.
token is https://tricorder.pi-hole.net/gHpU8V15/
Thanks!
Your debug log shows the real error message:
WARNING: API: Could not add to gravity database (key: database_error, hint: UNIQUE constraint failed: domainlist.domain, domainlist.type)
It means the domain is already in the allow/deny list.
The debug log confirms it:
*** [ DIAGNOSING ]: Domainlist
id type enabled group_ids domain
----- ----------- ------- ------------ -------------------------
...
15 exact-allow yes 0 api.roku.com
Apparently you found the same issue (or a very similar one) reported here: Query Log "Allow" button acts on the queried domain, not the CNAME target that caused the block · Issue #3823 · pi-hole/web · GitHub (fixed by Show the API error message when adding from the query log fails by DL6ER · Pull Request #3824 · pi-hole/web · GitHub).
Everything is working. The only issue is the wrong error message.
This fix will be on the next release.
Thanks I was just coming back to note that I tried another one, and it worked. I guess that wasn't already there.
Any idea why the one that's giving the error, would still be showing up as successfully accessed or resolved or whatever it's indicating in green?
Thanks again!
Let me explain in details:
How the Query Log works:
When the Query Log shows a domain that was blocked, it always adds a button to allow that domain.
Please note that the query log page shows a list of past events.
If a domain was blocked, this log line will always be showed with a red background and an Allow button.
Then you click to allow the domain. New entries will be allowed, but old blocked entries with the same domain will still be shown as blocked.
What happened before?
On the first post, you described a situation where you tried to allow a domain that was already allowed.
That time, the API returned an error message (this is expected and correct), but the web interface didn't recognize that message and showed a generic "connection error" message.
The fix linked above changes how this kind of message is interpreted and the next version of the web interface will show the correct "The item is already present" message.
What happened now?
This is expected.
You clicked on a button to allow a domain, the domain was not in the database. The attempt worked and the domain was allowed.
That's the normal behavior.
As I said above, everything is working.
You just need to know that, until the next release, the "connection error" message when you click on this button means the domain is already in the database.
Thank you for the detailed explanation, that definitely helps me understand what's going on.
Just to be 100% clear, on the first post I was trying to say that I was trying to block a domain that had apparently just been accessed successfully as best I could tell from the 'recent queries'.
Basically at 14:55 I saw the 'recent query' from a minute or so earlier at 14:53:27 (seen in the previous picture). That was green and because of that appeared to me to have been a successful connection or DNS resolution. Since it showed in green, and was successful a minute before, I assumed that it wasn't in the list, so I hit the block button and got the error.
So I totally get that it's trying to tell me that it it's already on the list with that message, but don't know why it isn't being blocked / showing as blocked in the recent queries from just a minute and a half before if it is already on the list?
Thanks again for all your help, I really appreciate it!
An updated example, I tried to block cooper.logs.roku.com this afternoon and got the error, indicating it's already blocked. I saw it still comes up green as of 22:40 tonight, and when I clicked the deny button at 22:41 I got the error. Again, if it is on the block list already that makes sense, but if it is, why is it coming up green in it's most recent queries?
Thanks again!
Sorry, I finally found the domains list. Checking in there, I see that the domains in question somehow got explicitly ALLOWED, in addition to being denied. I removed that, and will monitor to see if it gets blocked going forward, and confirm.
Definitely in the deep end at this point! I appreciate all your help!
Yes.
This is exactly what your debug log says and this is why my explanation used an allowed domain as example.
Looking at the log again, I see both entries: one to Allow and one to Block.
When this happens, the Allow rule always wins.
Now that you removed the allow entry, the domain will be blocked.
Yep, checked this morning and they are being blocked now.
Thanks so much for your help and patience getting this figured out!
