only way I can get regex white listed domain to work is by disabling the adlist. I thought regex white list would remove blocking entries and basically override what domains may be in adlists. yes/no?
I only have 1 group. The default group.
Pi-hole version is v5.9 (Latest: v5.9)
AdminLTE version is v5.11 (Latest: v5.11)
FTL version is v5.14 (Latest: v5.14)
That is very interesting. I checked nslookup with some domains on my whitelist. Like you're seeing, some give no address. When I disable pi-hole and run the same nslookup, I see the address. I would think that the whitelist would take precedence over the adlist. Very odd.
Ran some more tests. It seems the domains that were on the whitelist also matched a regex on the blacklist. So, perhaps the precedence from greatest to least is blacklist, whitelist, adlist.
Does your domain match anywhere on the blacklist?
Still more tests. pihole -q domain does show domain on exact whitelist and regex blacklist. nslookup shows no address, but I can browse to the domain on Chrome. So, maybe nslookup isn't the best test?
I understand that doesnt' create the regex. the regex is (.|^)gtv[0-9]+.com and already created i'm testing to see if i'm getting the match and per the output. I am matching my whitelist regex and it is not found in blacklist per same output below....
[i] Checking domain against blacklist...
Time: 0.091 msec
[i] Checking domain against whitelist...
(.|^)gtv[0-9]+.com$ matches (regex whitelist, DB ID 305)
Time: 0.087 msec
so per the priority listed in comments my whitelist regex at step 2 should be found just like the above test and stop further testing down to the "Blocklist Domains", step4. This doens't seem to be the case though. I have to disable the adlist in order to relsolve the domain even with whitelist in place.
You will see the domain in the blacklist with a pihole -q. That is just checking if the domain exists on any list. It does. The whitelist is internal and when a query comes for that domain then Pi-hole sees it's whitelisted and doesn't check the blacklist.
What do you see when you dig beacons.gvt2.com @pi-hole?
in my OP I do the pihole -q and it's only found in the adlist which should be the lower priority. also my lookup results are listed, returns 0.0.0.0 unless I fully disable the adlist.
thanks for testing. Blockhead
I've used dig and nslookup on the pi as well as remote. if I force either tool to use google "8.8.8.8" it resolves. Furthermore I see it logged (below) in pihole that it's blocking while nslookup or dig is used.
ex...
Feb 23 13:15:55 dnsmasq[1220572]: query[A] beacons.gvt2.com from 192.168.2.53
Feb 23 13:15:55 dnsmasq[1220572]: gravity blocked beacons.gvt2.com is 0.0.0.0
I verified white list regex matches yet still 0.0.0.0. If I add it as an exact whitelist it works and resolves. it's the regex whitelist I'm not having luck with overriding adlist.
feels like a possible regex whitelist bug to be honest:
tried all of these from advanced to real basic regex whitelist.
regex debugging was posted in the original post along with output.
more examples of regexes used in above post match the domain however still blocked. only exact whitelist seem to be overriding
here are some more tests:
root@pi:~# pihole-FTL regex-test beacons.gtv2.com
[i] Loading regex filters from database...
Compiled 17 black- and 15 whitelist regex filters in 9.935 msec
[i] Checking domain against blacklist...
Time: 0.067 msec
[i] Checking domain against whitelist...
(\.|^)gtv[0-9]+\.com$ matches (regex whitelist, DB ID 305)
(\.|^)gtv[0-9]\.com$ matches (regex whitelist, DB ID 310)
(\.|^)gtv2\.com$ matches (regex whitelist, DB ID 313)
(\.|^)gtv2\.com matches (regex whitelist, DB ID 315)
^beacons\.gtv2\.com$ matches (regex whitelist, DB ID 317)
beacons\.gtv2\.com matches (regex whitelist, DB ID 318)
Time: 0.586 msec
I was still seeing things on my exact whitelist fail nslookup with pi-hole enabled and not with pi-hole disabled and not when using a browser. And I think I may have gotten closer to finding out why.
I'm thinking since it oddly adds a FQDN in nslookup, it fails the exact whitelist and hits on the regex blacklist for a fail result in pi-hole, and the browser doesn't "helpfully" add the FQDN, so it passes. As noted below, is confirmed to be a nslookup issue, not a pi-hole issue.
nslookup on Windows will add that trailing dot by itself along with any local domain you have specified (usually with DHCP). It's any annoying "feature".
