Troubleshooting Questions

[robroy90]

I was curious to know how I can determine the effectiveness of my installation? I have pi-hole up and running, but lately it doesn't seem to be blocking ads very effectively. Further, the web interface at http://ip.address/admin/index.php does not load, I just get a blank browser window with no errors. If anyone could please give me some things to look at, I would appreciate it. I can ssh into the installation and run the gravity update script without issue.

Thanks!

-Rob

[jacobsalmela]

Run through this FAQ.

I have noticed that more and more ads are coming through https and/or IPv6, which isn't supported well yet. I'm working as hard as I can on this, and @dschaper has been helping a ton, but it's getting to be a big project that is getting difficult to manage alone.

Let me know if the above link helps you.

Also, more ads can be blocked by adding the mahakala list, but you will need to whitelist a bunch of legitimate domains, but it might be worth it.

[dschaper]

Yeah, I've noticed a lot of the big ad networks are serving through IPv6, but the good news is that dnsmasq does a good job (and by proxy PiHole) when I set my IPv6 resolver to the address that my Pi is using. (A quick ip -6 route get 2001:4860:4860::8888 will pull out the address, and setting my Windows 10 box to that address for testing...) I was thinking a need to switch resolver packages would be needed but it doesn't look like that's the case, the most difficult part is going to probably be configuring the hosts to use the right address.

[dschaper]

osxdaily.com is my test site and the difference is night/day when IPv6 is being blocked.

[robroy90]

Thank you both for such prompt and detailed replies. I am far from an expert on Debian, and know just enough about IPv6 to be utterly dangerous. I have the installation of my PiHole on a static, public IPv4 address (to avoid any potential NAT issues) and I thought (perhaps mistakenly) it would be advantageous to create an IPv6 tunnel for it, so I did so using Hurricane Electric's service.

Knowing these details, what can I do now in an effort to improve the effectiveness of my installation? Could you please give me specific steps/add them to the FAQ on what I should change in my configuration?

Lastly, any idea why I can't pull up the web interface of my PiHole?

THANK YOU for your time and dedication to this project. I plan to donate shortly!

[jacobsalmela]

Even within one year of making the Pi-hole, I have noticed a big spike in IPv6 ads coming through. I don't think an IPv6 tunnel would help block them but rather help, since the ads can be delivered via IPv6. We need the Pi-hole to listen/respond to IPv6 queries.

I have been successful blocking IPv6 ads, but don't have any of it documented (or fully-functioning yet).

[jacobsalmela]

So @dschaper when you say you set your IPv6 resolver, what do you mean?

And it blocks IPv6 without any additional config on the Pi-hole?

P.S. I also use osxdaily.com as a test site.

[dschaper]

With Windows 10, when you manually set the IPv4 DNS server, you can go into the IPv6 properties and set the DNS server for IPv6 queries. I'm trying to set up a Hackintosh so I can see how to configure Yosemite (plus I need to be able to test on a Mac platform and the only Mac i have is a 512Ke.)

And yes, it does work without any further configuration on the PiHole, dnsmasq serves the right resource records without needing to do anything.

[jacobsalmela]

So when you set the IPv6 DNS server, you point it to the Pi's IPv4 address?

[dschaper]

You need the IPv6 address of the pi. The way I did it was to run
ip -6 route get 2001:4860:4860::8888
and in the result you should get the IPv6 address of the Pi. (I'm using the one after the word src, it's the public IPv6 for that Pi but it works.)

Then set the IPv6 DNS server to that address and that's all the configuration needed.

[dschaper]

[jacobsalmela]

I think this one can be closed, too, based on the conversation. See #144

[robroy90]

What about modifying your script to add ::1 to all the of the ipv4 host
entries for ipv6 compatability? I noticed this option in AdAway for
android. It seems viable at first glance. Would it work?

Thanks,

Rob
On Jan 1, 2016 6:48 PM, "Jacob Salmela" notifications@github.com wrote:

Closed #127 #127.

—
Reply to this email directly or view it on GitHub
#127 (comment).

[dschaper]

That would just add a loopback to each address for IPv6 and wouldn't send the requests to the web server for advert replacement. Since the webserver sends a small gif (or what ever the user has configured) to keep the sites from breaking and possibly timing out, it's necessary to send the address of the pihole server that is running the web server.

[robroy90]

I'll readily admit I am not fully up to snuff on ipv6, but I saw the option
in AdAway today, and wondered how it continues to be generally effective in
blocking ads, especially on an Android mobile, where I know the carrier
uses ipv6. It was just a thought... I'd like to see this project prosperous
again.
On Jan 2, 2016 7:49 PM, "Dan Schaper" notifications@github.com wrote:

That would just add a loopback to each address for IPv6 and wouldn't send
the requests to the web server for advert replacement. Since the webserver
sends a small gif (or what ever the user has configured) to keep the sites
from breaking and possibly timing out, it's necessary to send the address
of the pihole server that is running the web server.

—
Reply to this email directly or view it on GitHub
#127 (comment)
.

[dschaper]

It works for AdAway because that application runs it's own webserver, so sending a loopback address is fine. It looks like this latest release of PiHole has IPv6 all tied up, give it a try and see if it works for you. (And let us know if you run into any problems!)

[dschaper]

It's a good idea though, and that's the address I used when testing a working solution for PiHole #71 (comment). The released version gets the actual address of the PiHole server and uses that instead.

[robroy90]

Thanks! You guys are great! Can I somehow also run a webserver on my Pi and
do loop backs like AdAway?

Also, I took my PiHole offline for a while because it wasn't blocking well,
plus my ISP sent me a "nastygram" because I was running my own DNS server
on one one of my public, static IPs for ease of access to it. How can I
resurrect it and not run into trouble with them?

I obviously want to to use it on my LAN, but I'd like to use it for my
mobile devices to block ads when I am away from my network without using
NAT/VPN.

Thanks again!

-Rob
On Jan 2, 2016 9:46 PM, "Dan Schaper" notifications@github.com wrote:

It works for AdAway because that application runs it's own webserver, so
sending a loopback address is fine. It looks like this latest release of
PiHole has IPv6 all tied up, give it a try and see if it works for you.
(And let us know if you run into any problems!)

—
Reply to this email directly or view it on GitHub
#127 (comment)
.

[jacobsalmela]

I'm not familiar with AdAway, so someone else might be able to answer that. As for the remote access to the Pi-hole, port forwarding comes to mind, but maybe that's how you were already using it and why they were getting upset with you.

[dschaper]

AdAway runs on Android and is similar to the Pi-Hole, it intercepts DNS requests via hosts file and optionally runs a small webserver. Since it's self-contained it just serves up loopback addresses to point back to itself. So for @robroy90, if there is a way to have AdAway forward it's requests to the Pi-Hole DNS server then you'd have double layer protection. I don't know if thats possible though.

As for a public DNS, if you have port 53 open and accessible to the public then you are probably violating the TOS of your provider in regards to running a server on a non-commercial account. If they can portscan you and get a response then they are going to ding you for it. If you want to use a VPS, I can suggest Hostus.US as a good and cheap provider. You can do a Sky-Hole type setup that way. And we've tested the code so it works on an OpenVZ based provider, thanks to the help of another PiHole user who let me in to his setup to test the code.

[robroy90]

Thank you very much, I sent some bitcoin your way as a donation. I
appreciate your assistance and information, as well as all the hard work I
know you put into this!

-Rob

On Sun, Jan 3, 2016 at 1:32 PM, Dan Schaper notifications@github.com
wrote:

AdAway runs on Android and is similar to the Pi-Hole, it intercepts DNS
requests via hosts file and optionally runs a small webserver. Since it's
self-contained it just serves up loopback addresses to point back to
itself. So for @robroy90 https://github.com/robroy90, if there is a way
to have AdAway forward it's requests to the Pi-Hole DNS server then you'd
have double layer protection. I don't know if thats possible though.

As for a public DNS, if you have port 53 open and accessible to the public
then you are probably violating the TOS of your provider in regards to
running a server on a non-commercial account. If they can portscan you and
get a response then they are going to ding you for it. If you want to use a
VPS, I can suggest Hostus.US as a good and cheap provider. You can do a
Sky-Hole type setup that way. And we've tested the code so it works on an
OpenVZ based provider, thanks to the help of another PiHole user who let me
in to his setup to test the code.

—
Reply to this email directly or view it on GitHub
#127 (comment)
.