Where to put iptables script to execute on boot?

[josh3003]

Wait so even running DNSFilter with the piholes set to no filtering & if I set global filter mode to router if I manually change my dns in windows I still leak google dns when I run a test using 8.8.8.8. Now I've confused myself.

 

[ColinTaylor]

No as in, when I switched over and removed the script and iptable rule I don't get the DOT section either.

Strange. Were you looking in the filter table, not the nat table?

I prefer to not get flooded with all of the redirected queries coming directly from the router and just keep it on a device basis so I may just stick to my original script and call it a day.

I can't see how your script would change that. But as I said earlier there are lots of subtle nuances with DNS and I don't know all your settings.

 

[ColinTaylor]

Wait so even running DNSFilter with the piholes set to no filtering & if I set global filter mode to router...

Why are you doing that? Global filter should be pointing to the Pi (or you need to set the LAN DHCP setting for the Pi - which is what you want to do anyway).

 

[josh3003]

Why are you doing that? Global filter should be pointing to the Pi (or you need to set the LAN DHCP setting for the Pi).

So what are you suggesting? Set it to Custom 1 and have pihole ip address there?

 

[ColinTaylor]

So what are you suggesting? Set it to Custom 1 and have pihole ip address there?

That would be my first choice, but there are many ways to skin a cat.

 

[josh3003]

Yes confirmed I can see the DOT in the filter table. Also found this in my chain forward policy. Should this deleted somehow???

ACCEPT     all  --  192.168.1.0/24       dns.google
ACCEPT     all  --  192.168.1.0/24       dns.google
ACCEPT     all  --  192.168.1.0/24       dns.google
ACCEPT     all  --  192.168.1.0/24       dns.google
ACCEPT     all  --  192.168.1.0/24       dns.google
ACCEPT     all  --  192.168.1.0/24       dns.google

 

[ColinTaylor]

That would be my first choice, but there are many ways to skin a cat.

You should also set the LAN DHCP server to point to the Pi-hole to minimise the number of requests having to be redirected.

 

[ColinTaylor]

Yes confirmed I can see the DOT in the filter table. Also found this in my chain forward policy. Should this deleted somehow???

ACCEPT     all  --  192.168.1.0/24       dns.google
ACCEPT     all  --  192.168.1.0/24       dns.google
ACCEPT     all  --  192.168.1.0/24       dns.google
ACCEPT     all  --  192.168.1.0/24       dns.google
ACCEPT     all  --  192.168.1.0/24       dns.google
ACCEPT     all  --  192.168.1.0/24       dns.google

Sorry, I don't recognise that.

 

[josh3003]

Sorry, I don't recognise that.

When you run
"iptables -t filter -L" under one of the headings I get this result. However, it says policy DROP so I guess perhaps it is the opposite it drops the request?

"

 

[josh3003]

You should also set the LAN DHCP server to point to the Pi-hole to minimise the number of requests having to be redirected.

Use the Pi as DHCP server? I got it currently on the router and pointing to pihole dns on my LAN page.

 

[ColinTaylor]

Use iptables -t filter -L -v to show the complete information. That might give you a clue.

 

[ColinTaylor]

Use the Pi as DHCP server?

No, I was talking about the DNS Server 1 setting.

I got it currently on the router and pointing to pihole dns on my LAN page.

OK, that's what I meant. BTW there's no point specifying the same address for server 1 and server 2, you can leave server 2 blank. Also, is your Pi-hole actually a WINS server?

 

[josh3003]

I'm not sure.. I get the same result using 'iptables -t filter -L -v' maybe I might delete them after I look into it more.

No it's not a wins server so I can delete that and the second server column.

 

[dave14305]

I recall reading that some Google devices will fill DNS 2 in locally with 8.8.8.8, so some people put the Pi-Hole IP twice to fake it out.

Are there different interfaces on those dns.google entries if you run iptables -S FORWARD

 

[josh3003]

Yes yes my mistake. I had 3x entries each for 8.8.8.8 and 8.8.4.4 in routes to block any requests to google dns.

Ok so I have configured DNSFilter as per discussion with ColinTaylor and have re-added the secondary dns server with pihole details just as a failsafe even though DNSFilter should catch any redirects.

I understand now I am seeing any queries trying to bypass the pihole come through as from being requested by the router. There is no way around this is there to tell it to come from the device and not the router? It would be good to know offending device/s but as it comes from the router I am none the wiser but happy to know that all traffic is going through it now.

 

[dave14305]

I understand now I am seeing any queries trying to bypass the pihole come through as from being requested by the router. There is no way around this is there to tell it to come from the device and not the router? It would be good to know offending device/s but as it comes from the router I am none the wiser but happy to know that all traffic is going through it now.

There is a Rube Goldberg setup documented by some rube in this post that might be what you’re looking for.

Merlin, dnsmasq, Pi-hole Accurate Device Names How-To?

I have an RT-AX86U running 386.1 beta 2 and while it is working well, I find that many ads are being served to devices, especially mobile phones. I have tried various suggestions for solving this and the DNSFilter option to force all DNS traffic to my Pi-hole works the best. Unfortunately, it...

www.snbforums.com

 

[josh3003]

There is a Rube Goldberg setup documented by some rube in this post that might be what you’re looking for.

Merlin, dnsmasq, Pi-hole Accurate Device Names How-To?

I have an RT-AX86U running 386.1 beta 2 and while it is working well, I find that many ads are being served to devices, especially mobile phones. I have tried various suggestions for solving this and the DNSFilter option to force all DNS traffic to my Pi-hole works the best. Unfortunately, it...

www.snbforums.com

That actually links back to an older thread of mine when I was just running a single Pi-Hole. With the dnsmasq config on the router. I still have that setup. I now run a dual pihole setup with keepalived to create a virtual shared DNS IP so I have local fallback if one goes offline.

I think even with this in place do you get the queries that are rerouted as having come from the router as opposed to say e.g. a Chromecast device that would have hardcoded 8.8.8.8 for some dns queries etc?

EDIT:
One thing I didn't have was the 'check the box to advertise the router IP in addition to the custom choice.' Could this fix the issue? So it helps redirect back to the culprit device/devices?

 

[dave14305]

That actually links back to an older thread of mine when I was just running a single Pi-Hole. With the dnsmasq config on the router. I still have that setup. I now run a dual pihole setup with keepalived to create a virtual shared DNS IP so I have local fallback if one goes offline.

I think even with this in place do you get the queries that are rerouted as having come from the router as opposed to say e.g. a Chromecast device that would have hardcoded 8.8.8.8 for some dns queries etc?

EDIT:
One thing I didn't have was the 'check the box to advertise the router IP in addition to the custom choice.' Could this fix the issue? So it helps redirect back to the culprit device/devices?

Advertising the router IP was important for single Pi-Hole setups to avoid a single point of failure. The add-subnet and add-mac dnsmasq parameters should be enough to see original IPs and hopefully names on the Pi-Hole for redirected queries.

 

[josh3003]

The add-subnet and add-mac dnsmasq parameters should be enough to see original IPs and hopefully names on the Pi-Hole for redirected queries.

Ok cool, well in that case it doesn't really matter as I do not have single point of failure.

Cool, I shall double check the setup again and test over the coming days. Nothing additional is needed for dnsmasq on PiHole side either? Thanks again for your help and knowledge.

 

[josh3003]

Advertising the router IP was important for single Pi-Hole setups to avoid a single point of failure. The add-subnet and add-mac dnsmasq parameters should be enough to see original IPs and hopefully names on the Pi-Hole for redirected queries.

Still got some requests coming blocked from other devices from the router. Do you get the same result or do you have strictly coming from the devices only?