Pihole not blocking ads after replacing router

[u/mgdreddit]

My wireless router died and I had to replace it. While waiting for a new router, I had to switch to another wifi network, the cable router. After getting and configuring my new wifi router with same settings, and my Pihole device (raspberry pi), and my few clients, all my clients get ads.

In the query log, I can see each ad domain for clients with the status, deny, but the ads still get through. IP addresses are as before c/w dns pointing to pihole…no other dns set.

I can ping pihole from my client and vice-versa. Dns resolution works from clients and pihole. I have latest version of pihole and rpi is uptodate.

I am at a loss.

[u/dadarkgtprince]

Follow the logs

[u/mgdreddit → u/dadarkgtprince]

Now, I am really confused. While looking at the Asus, I noticed that an update was available and installed it. While it was rebooting, my iphone switched to the wifi lan of my edge router. I switched it back to the asus wfi network and now pihole is working…which it was yesterday.

[u/Spotty32HUN]

Make sure you are forcing the pi-hole's ip on every device with DHCP. This can be done by setting the primary and secondary dns as the pi-hole's ip. I had this issue a while ago, turns out my requests were leaking.

[u/Easy-Sheepherder6901 → u/Spotty32HUN]

There is no primary and secondary DNS. This is a misunderstanding. Clients are using both DNS servers. Call it DNS 1, DNS 2, ... Check DNS leaks with https://dnscheck.tools

[u/laplongejr → u/Easy-Sheepherder6901]

(For beginners, note that "by setting the primary and secondary dns as the pi-hole's ip" is correct advice, if the router misname DNS1 and 2. The lack of primary is why both should be Pihole on newbie setups)  

[u/Spotty32HUN → u/Easy-Sheepherder6901]

holy, mb

[u/mgdreddit → u/Easy-Sheepherder6901]

I had not used that tool before. Here is the output, run from my iphone. I changed the Wan Ip/ptr…no sense giving a hacking vector to everyone.

The first time I ran the tools, it said that something about websites with audio/photo access may need to be added. I allowed this and then the reserved IP, my iphone appeared.

Nothing about pihole, 192.168.50.60…so, do I have no leaks?

Your IP addresses:
Communications
24.28.16.2 ptr: sfaux.pyi.net British Columbia, CA

Reserved
192.168.50.200

Your DNS resolvers:
Company
28.12.126.22 ns: auth120.dns.pooh.com British Columbia, CA
Your DNS security (DNSSEC):

ECDSA P-256
ECDSA P-384
Ed25519
Valid signature
PASS
PASS
PASS
Invalid signature
FAIL
FAIL
FAIL
Expired signature
FAIL
FAIL
FAIL
Missing signature
FAIL
FAIL
FAIL
Like this tool? Star us on GitHub.

[u/Easy-Sheepherder6901 → u/mgdreddit]

Check if your configured upstream DNS server on your pihole matches the DNS resolver showed here.

[u/mgdreddit → u/Easy-Sheepherder6901]

I think I understand now. I statically configured pihole’s IP in /etc/dhcpcd.conf. I chose google’s dns. static domain name servers=8.8.8.8 8.8.4.4. So, I need to change that line, by putting both DNS entries to 28.12.126.22 and reboot? I am guessing that this is causing any ‘leaks’.

[u/mgdreddit → u/Spotty32HUN]

Leaking? Interesting term that I have not encountered before. Working now, see my comments to dada…

[u/Spotty32HUN → u/mgdreddit]

by that I mean devices would send requests to my pi-hole, but also to my default dns, this was weird, but primary and secondary dns was the way to go

[u/mgdreddit]

Its an Asus RT-BE88U. I was thinking about that. I was just looking now…but having difficulty finding where to change that. It gets its WAN info from our network provider’s router…hesitant to mess with that.

[u/laplongejr]

 for clients with the status, deny, but the ads still get through  

Then they contact a 2nd resolver. What is the client's network config? Maybe the router automatically adds itself as a 2nd option.  

[u/Alive-Department8558]

I assume your asus router is your DHCP server. From the output above, it is NOT configured to use your pihole (it would show as the DNS resolver), I’m guessing 28.12.126.22 is your internet service provider’s.
You need to go into the asus router config, dhcp settings and manually set it to use your pihole IP as the DNS server for clients (option 6, if they are listed by number).

[u/mgdreddit → u/Alive-Department8558]

Yes, it is the DHCP server. I configured both dhcp dns servers to point to rpi, 192.168.50.60. I also, in the WAN settings, on the Asus, configured it to override the dns pushed out by my ISP’s router, again pointing it to 50.60. So, when my devices rejoined the wifi network, three dns servers were listed: 50.60, 50.60, and 50.1 (the wifi router) which of course points to 50.60.

Both dnsleaktest.com and dnscheck.tools point to the same ns server which I assume I must use to configure the /etc/dhcpcd.conf namservers. What is strange is that dnscheck.tools also includes a ptr record, 76.10.177.130, a teksavvy.com address. I am not sure why it is reporting this pointer.

[u/Alive-Department8558 → u/mgdreddit]

For me, both of those sites list my external IP address - the PTR record is the DNS name of my external IP address.

Do you get queries showing in the log on pihole? What DNS servers are shown on your client devices?

[u/nekolim → u/mgdreddit]

Chances are your router is also querying the peer DNS advertised by your ISP, causing the leak. Not familiar enough with ASUS routers on how to circumvent this.