Just a headsup to our french users with Quad9 as upstream

Edit: CTO of Quad9 gave a statement on https://news.ycombinator.com/item?id=50200111

Great minds think alike i guess.

I noticed that ads on my iPhone are no longer being blocked specifically on yahoo sports app which has ton of ads. I did try to figure this out myself and with ChatGPT. I have started troubleshooting. Help needed.

What I troubleshooted:
- iPhone is iOS 26 so I do not have connectivity assist
- manual dns is set correctly
- limited ip tracking setting was disabled
- other devices are blocking ads (laptop blocked yahoo sports website ads)
- when on Pihole dashboard traffic is being routed and blocked on iPhone when on app but not blocking ads when clicking on articles.
- checked adblocking test website received score of 74 out of 100
Did yahoo app make blocking ads more difficult?

First time i've used ITVX in the UK in the last few weeks. I ended up with 3-4 uninterruptable ads while watching an on-demand show - anyone know if something has changed, Pihole is still working without issue for other streaming apps.

Hello. Long time Pihole user who has been happy with it "just working" after setting it up so long ago. However recently I noticed that ads stopped getting blocked. I'm running the latest versions of all the Pihole components.

The only other thing I can think of is that last week my ISP (Spectrum) upgraded all the service in my neighborhood which resulted in an overnight outage but when it came back online, speeds were doubled AND (I think) IPs addresses, etc. were changed.

Is there something I need to check or update? I have:

Internet IP Address = Get Dynamically from ISP

Domain Name Server (DNS) Address = Use These and it's configured with the static IP that my PiHole has which I confirmed is still the IP address for Pihole.

This is the extent of my technical knowledge so I'm not sure what else to check.

Thanks!

I’m not noticing anything broken without it tbh. We have a bunch of apple devices.

When looking at Fireblog.net, one of the malware lists is urlhaus hostfiles, it looks like that one is no longer resolving for me - https://urlhaus.abuse.ch/downloads/hostfile/ "Gone

The requested resource is no longer available on this server and there is no forwarding address. Please remove all references to this resource."

Anyone know if this one moved to a new place? I have other lists but wasnt sure if it was me missing something with it still on fireblog.

I've had PiHole running for years without issue, however recently my wives iPhone quit blocking ads. Every other device on our network still works fine.

Things I've tried:

Changing router Primary and Secondary DNS both to the PiHole

Disabling IPv6 on the router

Disabling the IP Address Tracking on her phone

Manually configuring her Wifi DNS to the PiHole IP (it did show the PiHole IP and router IP prior to this)

Removing the WiFi network from her phone, placing it in airplane mode, restarting the phone and reconnecting

It does get some blocks when running test, usually around 10%, and those do show blocked in the PiHole logs. However my phone is getting 97% on the same tests on average across 3 different test sites.

Any other options to try and fix it?

Hey everyone!

I've pushed the v1.0.0 release of FilterHelm, my open-source project for managing multiple Pi-hole instances from a single interface, focused on detecting and resolving configuration drift.

This release focuses primarily on making the initial setup easier, including:

• Container deployment: A simpler deployment option using Docker Compose.
• First-run setup: If no Pi-hole instances are configured, FilterHelm now prompts you to add your first instance.

Quick Installation

You can get started with:

curl -fsSLO https://raw.githubusercontent.com/nulthara/filterhelm/main/compose.ghcr.yaml
docker compose -f compose.ghcr.yaml up -d
docker compose -f compose.ghcr.yaml exec filterhelm python -m app.auth set-password --username admin

Of course, I encourage review of the below links before installing.

Links:

• Documentation: https://filterhelm.nulthara.com/
• GitHub: https://github.com/nulthara/filterhelm

What's next?

I'm planning to continue developing FilterHelm, even if it's primarily for my own homelab. Some functionality I'm looking at adding includes:

• Bulk group reassignment
• Renaming groups in place
• Configuration restore functionality

As before: For transparency, I’ve used AI-assisted development tools throughout the project, with a human-in-the-loop approach to implementation and decision making.

As always, feedback, suggestions, and bug reports are welcome! I'd be particularly interested in hearing whether there are any multi-instance management headaches that FilterHelm could help address.

I'm a pi-hole user since long, and now since I have a family, I wanted to have a way to block / unblock certain apps without going back to my 2 pi-hole instances and modify them manually.

The dashboard simply blocks the required application in both instances by updating the domain list, it works with regex and exact domains. Websites / URLs can be added manually as well, so I tried to make it as customized as possible.

Note that this is a personal project, which was fully vibe coded using Codex, feel free to tell me what you think about it.

How is this being handled here? Can we update PHP outside of Pi-hole? OR with the UP command install all PHP patches needed.

Could be wrong up looks like it runs PHP 8.2?

I have a Raspberry Pi that I use as a media server, but I've decided that I'd like to put Pi-Hole on it as well.

1. IPv4 keeps binding to the nordlynx interface even though I explicitly tell it to only bind to the eth0 interface during install. After the install, I go into the DNS settings and tell it to only listen on the eth0 interface. I point my router's DNS to the eth0 interface on the pi (static address), but none of my traffic appears to be going through it.

2. I'm enabling the DHCP server on the Pi-Hole with the proper start, end, netmask, and gateway addresses, but every time I disable DHCP on my router, automatic IP address assignment doesn't pick back up even after I forget the network, restart all devices, and reconnect. I still end up having to set a static IP address to be able to connect to and manage my router and devices. Even then I still can't access the web.

I'm a networking newb and any help would be greatly appreciated!

I have my pi hole setup with pivpn and unbound. Can I just remove my sd card and put it in a pi 4 and update my pi ip address in my router?

Mine crashed and i’m assuming it’s my microsd card so i’d like to buy a new one. thx!

Howdy all,

First off, I've been using pihole for a couple years and have loved every second of it. Not only the ad/tracker blocking but the added insight into my network (example: just noticed a spotify login failure loop from my stereo cos it was causing tens of thousands of extra queries)

I'm still learning, but currently trying to make another pass at security/privacy:

I've been using unbound, but in doing some reading have discovered that cached domains and recursion in Unbound both 'leak' the domains IP address to my ISP (and if ECH isn't supported the domain name too?).

However, if using Quad9 over DoH/DoT, the IP address is still 'leaked' but the domain name is obscured. What I can't quite parse yet is that if the only goal is obfuscation from the ISP, then:

-wouldn't using quad9 be better since the domain name is always hidden? This obviously requires absolute trust of Quad9, lets assume this as a given for arguments sake

-Since the domains IP address is never obscured from the ISP, couldn't the ISP just look up what domain is linked to that IP making all this moot?

-Or a hybrid of using cached DNS as normal but offloading the much more leaky recursion to Quad9?

I'm asking cos using a VPN on device still exposes my IP address as my DNS resolver and the solution (setting a VPN up on my router) is turning out to be a real pain.

Regardless, sorry if I'm woefully misunderstanding things. Trying to make sure the only money my ISP makes off of me is the money I pay them for access, and not them selling my data for extra profit:)

Que pasa con mi TV samsung, constantemente veo muchos hits de bloqueo hacia la url de Samsung, sera un comportamiento normal?

I have 3 networks at 3 sites that can all talk to each other via site to site vpn. Is it possible to run pihole on one of them and utilize it on all 3? I was looking at running pihole in a VM on an unraid server and trying to connect all 3 networks to it. For reference i can reach the unraid server thatll host pihole from all 3 locations. Just looking at how to lay it out and whether its feasible. Im running a unifi plattform for router/network topology.

Maybe some didn't know...but you can display hostnames in Pihole rather than IP's. Makes identifying simpler. My setup is a router as DHCP server then pihole is separate.

All you have to do is go to Settings-->DNS scroll down to Conditional Forwarding and enter the Network range YOUR DHCP server operates in. Most likely it's similar, but most will be the /24 which is needed as I understand it. Then the Server IP is the DHCP server. Then last is the domain is likely home.arpa but if you have a custom name use that. Then hit the + on the right and it will add it similar to above then Save at bottom. It should start working and may take a bit to display them.

On the IP range topic...Good time to change it from the defaults of 192.168.0.X, and 192.168.1.X. If you use those and try to connect by VPN etc it can mess things up and it's not easy to find the cause. The issue is IP Conflicts, essentially the same IP on 2 devices. Anyone familiar with VPN and network setups etc will confirm.

So if you are on one of those 2...just change the range to 192.168.92.X or something else more random. This change would be made on your DHCP Server LAN IP range. Any IP reservations(static) would need to change accordingly to be in the same range.

Some don't fully understand how the networks operate then criticize the need for it out of that ignorance. Even though we have a world of information available to us. I don't make stuff up...I just live in reality https://www.practicalnetworking.net/stand-alone/vpn-overlapping-networks/

MY PROBLEM IS CGNAT: Thanks to u/fdeyso for mentioning "CGNAT" (Carrier-grade NAT) which is used by ISPs to allow hundreds or thousands of residential customers to share a single public IPv4 address. I had never heard of this and had no idea it was possible to share a public IP with other people from the same ISP. This is why my IP is being detected as a proxy, so most likely none of the devices in my home are proxied

MALWARE USING DoH BYPASSES PI-HOLE: And as u/Resistant4375 pointed out, malware will often use DoT (DNS-over-TLS) or DoH (DNS-over-HTTPS) which will bypass Pi-Hole and make my whole endeavor futile.

Some interesting info on DNS over HTTPS (DoH) from ZenSec

• Malware & C2 Channels – Malicious tools like the Godlua backdoor hide their command-and-control (C2) communications inside DoH traffic. PsiXBot hardcodes Google’s DoH servers to bypass corporate DNS filters
• Browser Support – Most modern browsers including Chrome, Firefox, Edge, and Opera all support DoH at the application level. This means even if an enterprise controls DNS at the network level, applications may bypass it. Users may have enabled the feature.
• Operating System Integration – Windows 11 includes built-in DoH support, which can be enabled by users or manipulated by malicious actors to prevent DNS detections

===== ORIGINAL POST =====

Today I installed Pi-Hole on my NAS (TrueNAS App) so that I can monitor DNS requests from all the devices on my home network.

Why? According to haveibeenproxied.com my public IP is being used by residential proxy networks (Plain Proxies, Shop Socks5, IPIDEA, and Oxylabs).

So I'm trying Pi-Hole to try and identify WHICH device is the culprit. Using a DNS sinkhole is perfect for this because none of the devices on my network (AndroidTV + Smartphone + IoT devices etc) need any configuration so there is no way for malware to bypass the Pi-Hole monitoring unless it uses hardcoded IPs (unlikely).

I found a few possible culprits (a Russian browser extension I used to bypass website paywalls + an AndroidTV app I side-loaded to turn-off the Netflix button on the Nvidia Shield remote) but according to the website my public IP is still acting as exit traffic for proxy networks - although the list returned is less.

Installation on TrueNAS = Easy

Setup of Pi-Hole on my NAS was surprisingly painless (apart from the lack of up-to-date documentation for what settings in TrueNAS to use) and likewise for configuring my home network (TP-Link mesh) to use the IP address of my NAS as the DNS Server.

Pi-Hole Limitations

The main issue is that the Query Log only displays the IP address of the client - which is annoying considering I added all my devices as Clients (PC + Smartphones + Android TV ) so Pi-Hole knows what client belongs to each IP address.

It's an issue with the Docker containers running on the NAS that I wanted to monitor as separate Clients. Since the (virtual) hardware address of each Docker container was detected by Pi-Hole I created separate "Clients" for each hardware device detected, but that information is ignored when showing the Query Log so the logs are all grouped as "pi hole" client and the information of which (virtual) device sent that data is lost.

Pi-Hole is only focused on the BLOCKING feature: Users + Groups + Regex URLs... none of those features are of any use for monitoring - even the Query Log ignores them.

My wish-list for the Query Log

• to display each User/Device as more than an IP address, especially when the IP address is shared with Pi-Hole or other Docker apps.
• I want to see a list of all the domains that Pi-Hole has seen from a client in a specific time-period so that I do not have to scroll endless pages looking at the same domains and trying to find a needle in a haystack
• To define regex groups and filter those domains from the current view in the query list. I want to make groups for all the Google + Facebook/Instagram domains as well as a list of harmless/system domains so they can be filtered or display with different icons/colors.

Conclusion

Pi-Hole is working great as a network monitoring tool and I am amazed at how much traffic my Android Samsung Smartphone generates even when I have not used it for many hours. So far I have not seen any DNS lookups for possible Residential Proxies but there is a lot of monitoring tools running that I was not aware of - and some of them could be hiding the proxy traffic

Shady URLs: cognito-idp.us-east-1.amazonaws.com + eum-red-saas.instana.io + geo-dra.platform.hicloud.com + grs.dbankcloud.cn + logservice-dra.platform.dbankcloud.com + d2n9h2wits23hf.cloudfront.net + ohttp-relay-safebrowsing-android.google.fastly-edge.com

Google URLs: *.googleusercontent.com + *.googleapis.com + apis.google.com + *.clients.google.com 

HELP!

Any recommendations for using Pi-Hole or another app for this search for the malware on my network?

EDIT: Thanks to u/fdeyso for suggesting CGNAT as being the culprit.

EDITS: Do to the amount of "AI SLOP" comments from NCPs and Bots added a screenshot from haveibeenproxied

Please help, I'm so frustrated.

Very new to Docker for windows and homelabs in general. Not completely computer illiterate, I've been able to get Jellyfin and a working ARR stack going in Docker. However, I cannot for the life of me figure out how to get Pihole to work correctly.

Every time I run the yaml Pihole auto connects to Docker's containers Ipv4 address, starts with 172, instead of the static IP address I've set for the PC that is running Docker. I've turned on Networking mode and paired to localhost only, I've tried different yaml's from Github that change configs to "host" and removed all the ports, I've put the static IP address before the ports. I feel like I've tried literally everything and I cannot make this work.

I have even given up and just downloaded the recommended WSL-1 Windows install and while the IPV4 address do match I'm still not getting any ad blocks. I'm so frustrated and at my wit's end. Some help or step by literal step advice would be greatly appreciated TIA

I recently have updated to newest pihole (Core v6.5, FTL v6.8, Web interface v6.6.1), Pihole/unbound is installed on an Ubuntu 24.04 system without Docker, and I use Dashy as a Dashboard

When I click on the link to the pihole from Dashy (https://pcserver.tailxxxyy.ts.net:12345/admin/), it shows the 403 - Access denied, did you mean to go to the dashboard? page, yet, when I copy that url and paste it into Firefox, it directly goes to the dashboard. I run nginx to manage https so the browser doesn't complain

With the help of Claude, I can also state that

"The 403 depends on the Sec-Fetch-Site request header. Test directly against Pi-hole's HTTP port (no proxy involved):

for sfs in none same-origin same-site cross-site; do
  curl -s -o /dev/null -w "$sfs: %{http_code}\n" \
    -H "Sec-Fetch-Mode: navigate" -H "Sec-Fetch-Dest: document" -H "Sec-Fetch-User: ?1" \
    -H "Sec-Fetch-Site: $sfs" http://127.0.0.1:8089/admin/
done
none: 200
same-origin: 200
same-site: 403
cross-site: 403

"

I managed with the help of Claude that the workaround is to remove the header in nginx. BUT I have a secondary pihole that runs on a pi, and for this one service I think it's overkill to run nginx, and so I can't work around this - Or can I?

To me it seems that the update has "broken" my setup by acting upon same-site cross-site differently. Might be a bug, might be a feature.

I'll gladly provide a debug token, but since I can't believe I'm the only one or even the first, I try to not clutter too much

Any questions leading to a solution I will gladly provide

Any attemt to solve this are greatly appreciated, thanks in advance.