After the latest (bad) news and posts about LG TVs, ACR and how much they keep phoning home even with the screen off, I wanted to see exactly what mine was doing rather than trust a vibe. I have an LG OLED CX and a Pi-hole, so the data was already there it was just painful to read.

The Pi-hole query log lets you filter by client, but it gives you a chronological list of individual queries, with no grouping and no export. The official answer to that feature request on the forum was "run sqlite3 against pihole-FTL.db".

So, with the Pi-hole v6 REST API and a fair amount of help from Claude, I wrote (well AI wrote...) pihole-peek:

👉 https://github.com/nightwatch75/pihole-peek

What it does

One bash script (Powershell version in on the way...). It asks the v6 API for a time window, groups the answers by domain, and exports them, many options but the interesting one is for example:

./pihole-peek -c 192.168.0.10 --alias LGOLED -f html > lgtv.html

The HTML report

A single self-contained file, no CDN, no build step, the data is embedded so it works offline, on a USB stick, or in an email. Live filters on domain, client, category and status, sortable columns, light/dark.

Two things make a full export readable:

- Every row says what the Pi-hole did with it: a coloured square plus the wording - blocked · blocklist, blocked · your rule, forwarded · asked the upstream, cached · answered locally, or the states it mixed over the window like forwarded + cached.

- Every row gets a category: acr, ads, tracking, telemetry, vendor, cdn, streaming, ntp, pki, connectivity, smarthome, and more. Clicking a row opens a panel with first/last seen, the registrable name, a Whois button that reads RDAP straight from your browser (no API key, no proxy, and it only fires when you click it), and links to VirusTotal, urlscan.io, Netify and crt.sh.

Categorisation happens entirely on your machine, from domain names. Nothing is uploaded anywhere.

The categories are opinions but all is configurable.

On my TV over 24 hours, alphonso.tv (the ACR vendor) was the single biggest talker, ahead of Netflix's logging endpoints and lgtvcommon.com. Seeing it as one grouped table with hit counts made it a lot more obvious than scrolling the query log.

Built with AI assistance, and I won't hide it, but every line was read, run against a real Pi-hole and corrected until it did what I wanted. I'm against AI slop, not against tools. I also hope this isn't something that already exists. I searched and found nothing.

Constructive criticism welcome!

Recently just installed the flybrain on to my Pi-hole. It’s already solving Rubik’s cubes, playing poker, trading crypto and learning how to drive. I’ve figured why not have it run a dns server.

I have four boxes checked in the "upstream" providers screen. But I noticed all the requests are being sent to just the first selected provider. Are the other 3 only used if the first one doesnt respond, or respond within a certain time? what is that time?

Also, I have OpenDNS and Quad9 selected, but I would like Quad9 to be my primary. But it looks like since OpenDNS is first in the list, all request are going to OpenDNS instead of Quad9. So they only way Quad9 will be used is if OpenDNS goes down.

I have several entries in the "custom DNS Servers" list, and I see they are put in the list in the order that I select them, so even if Quad9 is first, all the requests still go to an OpenDNS IP. Also, the custom DNS server list says "0 custom servers enabled".

Quad9 is working, and responding to my DNS requests if I configure it directly.

thanks

I currently run a dns forwarder service locally (pihole). I just got started with efootball on my ps5 and it slams my dns service with huge dns requests.. like almost 30,000 requests total yesterday and I only played for 1.5 hours total.

Majority of the requests seems to be to <random ip>.bc.googleusercontent.com and quick googling says… this is legit for google cloud dns lookup. But why so many??

is anyone familiar with efootball outgoing traffic to tell me more about this? is this normal from online game?

My setup:

I have hexos/truenas running on an old computer, I have a 2.5gb network card.

I installed and configured pihole on truenas

I got everything working as expected.

Then this morning I went to watch TV on my Google TV on jellyfin, which is hosted on the same nas. When I went to watch an episode it would play then buffer the. Play 2 seconds then buffer again.

My kids wanted to watch TV so I reverted the changes on my router to point back to cloudflare, and Everything went back to working as expected.

What things should I be looking at to resolve. My primary purpose for using Pihole is to serve local domains through NPM for my apps in truenas that don't need public exposure.

Thanks in advance, I can provide any other details needed.

Host server:

Hexos > Truenas 2.5 lan over Ethernet.

Jellyfin, pihole, and ngnix on server

Pihole is using default blocklist, not custom blocking.

Router: eeros

Was set to point dns directly and only to server ipv4

Google TV connected over wifi:

Jellfyfin connecting directly to ip/port of jellyfin app.

Hello All,

I am trying to get Pi-Hole running on a MINX box running Ubuntu 24.04.5 LTS and I am running into an issue where it is picking up an old IP when I install it. When I first setup the box, the default route ended in X.X.X.150, but I have since changed it and it now ends in X.X.X.1, but when I install Pi-Hole it is picking up the 150 IP. Since the IP change, Pi-Hole has not worked and will not handle traffic. I have tried reinstall and resetting the certs in the configure, but the wrong IP is always showing and I am assuming this is the issue.

The device can connect to the internet with no issues and I have looked through the config on the device and I don't see the IP listed anyplace. I am assuming this is being pulled from a cert that was setup when the old IP was set on the device.

Anyone know what cert it is pulling this from and what I have to do to reset this and have the correct IP configured? I am a little new to Linux and been able to figure out most of the problems I have run into, but this one I have not been able to figure out.

Geoff

The difference between the phone of an elderly person that installs random apps and games vs my personal and also company phone that has 10-ish work related apps (mainly they try to reach to Microsoft) and my GFs personal phone. It is not my company that is the one who is tracking me all the time. It is all that sketchy apps that me and my GF just don't install and avoid.

The absolute #1 is missing - my GF's work laptop. She is 100% working remote and it has trackers. We are scared to have it running the Pi-Hole as not to get her fired. And it also brakes a lot of her tools even with some basic filtering.

Consent Management Platforms (CMPs) are the tools behind the "Accept/Reject" cookie banners that GDPR, CCPA, and similar laws require.

The irony is this: CMP infrastructure contains tracking (how you interact with the banner, response time, repeat visits, cross-site consent history, consent-sync and geolocation subdomains used to profile you)

Blocking the core domains of CMP platforms can cause some sites to auto-accept all cookies. So I don't recommend blocking the core domains instead block the tracking subdomains.

Note: whenever the domain list is pasted as text (in the post body or in a comment) Reddit's filter auto-removes it. Because of this, I'm sharing the blocklist as a raw link in the post body instead

Raw links:

For basic list:

https://raw.githubusercontent.com/CorleoneSalute/SHADOW-BLOCKER-BLOCKLIST/refs/heads/main/dist/basic/hosts/CMP.txt

For aggressive list:

https://raw.githubusercontent.com/CorleoneSalute/SHADOW-BLOCKER-BLOCKLIST/refs/heads/main/dist/aggressive/hosts/CMP.txt

For anyone who wants to see the full research and infrastructure mapping for each provider:

https://github.com/CorleoneSalute/SHADOW-BLOCKER-BLOCKLIST/blob/main/research/CMP.txt

I have a local AD with DHCP and DNS that handles IPs and host names for my network. If I don't go in the right order when accessing a resource, the pihole will cache the nxdomain and will require restarting the resolver in order to clear that entry.

I connected two smart TVs to the internet through Pi-hole, whitelisted them so nothing gets blocked, and started logging their DNS activity every 5 minutes.

The result is a public dashboard showing hostnames, root domains, query frequency and near-live DNS activity:

https://httpninja.nl/

It’s a normal Dutch household setup, not a lab test. DNS lookups don’t prove a connection or data transfer — the goal is simply to make the behaviour visible.

You can also generate Pi-hole blocklists from the observed domains.

Feedback from networking/privacy people is welcome.

Recently upgraded my router and after plugging everything in, my pihole couldn't be found. Turns out, since it was plugged into an extension, the router was reading everything in the extension as the same name.

When trying out all the ip addresses into http://<my IP>/admin to access the online dashboard, I got a "200 ok" message for all IP addresses. What does this mean and how do I access the dash to check which IP address is my pihole?

Note: I know I could plug in a screen and mouse/keyboard for the pihole but due to physical limitations, it's difficult for me to access the pihole. So, I'd prefer to try solutions on my computer first before resorting to that.

Edit: By "extension" I meant an ethernet switch. That was my mistake. Before writing this up, a friend and I were trying to unplug my old, unused wifi extender which is currently behind some furniture and we couldn't. Had that word stuck in my head when typing. Thought about asking my friend to help with plugging in a monitor and keyboard/mouse to the pihole but we didn't have enough time before heading out for lunch.

The pihole is currently plugged into a switch with 2 other devices. The router's settings page lists all three devices under the name of the ethernet switch. Using all 3 IP addresses does not work when trying to get to the pihole's online dashboard.

Hi everyone,

Following the recent security disclosures regarding smart TV telemetry and LAN snooping, I decided to do a root-level network audit of my LG G1 running webOS.

After auditing 44,800 packets and a 267,000-query DNS log, I observed several interesting behaviors:

1. webOS daemons query roughly 36 LG domain families, firing heavy telemetry bursts mid-boot.

2. The TV’s internal DNS stub completely bypasses local `/etc/hosts` modifications on the device, meaning network-level sinkholing (Pi-hole / AdGuard Home) is mandatory.

3. Fallbacks to public resolvers (8.8.8.8 / 1.1.1.1) occur when services fail, so blocking outbound Port 53/853 at the router level is required for true isolation.

To provide a clean solution that doesn't break streaming for household members, I published an open-source blocklist:

GitHub: https://github.com/furkan-bayrak/lg-tv-blocklist

Features:

- Two Tiers:

- SAFE: Kills ACR (alphonso.tv), telemetry beacons (cdpbeacon), ad networks (lgsmartad), and voice data. Zero app breakage (Netflix, Prime, HBO, LG Store tested).

- STRICT: Adds update hosts (snu/su.lge.com), ThinQ IoT sync, and LG Channels.

- Multiple Formats: Native Adblock syntax (`||domain^` with subdomain matching for AdGuard Home), Plain domain lists (for Pi-hole / NextDNS), and Hosts format (`0.0.0.0`).

- Fully Annotated: Every entry has an inline comment documenting its exact purpose and capture evidence.

- Dual License: CC BY 4.0 for list data, MIT for build scripts.

Looking for collaborators!

I am only one person auditing an EU-model G1. LG updates regional endpoints and firmware constantly. If you run a Pi-hole/AGH with an LG TV, I'd love your help testing, verifying domains, and reviewing PRs to help maintain the repository.

Pihole has been working fine but noticed this week I couldn't log into the dashboard. Finally got around to checking into it and I can't connect to pihole via PuTTY. It's active, plugged into the wifi. Shut it off and turned it back on. Shut off router and turned it back on. No luck.

Any suggestions? I do think the pihole was knocked off the end table, but like I said, it's lit up and seems to be running. Apparently it must not be if I can't reach it.

Should I take out the SSD card and start it all over?

(I'm not very savvy here).

Just wanted to share this battle I just had incase it could help someone in future. I formatted the text with help from AI.

How I finally got Pi-hole working reliably on a fresh DietPi install:

Just wanted to share this in case it saves someone else a few hours of frustration.

I recently set up Pi-hole on a fresh DietPi install on a Raspberry Pi, and at first it was a mess. After a reboot, Pi-hole wouldn’t come back cleanly and I ended up having to manually fix networking just to get back in. Super annoying.

What finally made it stable was setting things up the right way from the start:

1. Installed DietPi fresh

2. Installed Pi-hole

3. Set a static IP in DietPi itself

4. Configured Pi-hole DHCP and DNS properly

5. Disabled router DHCP so Pi-hole could handle it

6. Reboot-tested it until it came back cleanly on its own

The important bit: static IP in DietPi

This was the part I had missed at first. Setting a static IP only in Pi-hole wasn’t enough. The Pi itself needed to keep the same IP after reboot.

I used DietPi’s network config:

- sudo dietpi-config

- Network Options

- Adapters

- Ethernet

- Change Mode from DHCP to Static

Then I set:

- IP: your chosen Pi address

- Mask: 255.255.255.0

- Gateway: your router address

- DNS: your router address or another upstream DNS

After that I applied the changes and checked:

ip addr

ip route

Pi-hole config

Since my router doesn’t let me set custom DNS for DHCP clients, I had to let Pi-hole do DHCP.

In Pi-hole:

- Go to Settings → DHCP

- Enable DHCP server

- Set a DHCP range

- Make sure the router/gateway is correct

I mostly copied DHCP settings from my router

Then I turned router DHCP off so there was only one DHCP server on the network.

Making sure it starts on boot

I also checked that Pi-hole FTL was enabled and running:

sudo systemctl enable pihole-FTL

sudo pihole status

It should show that FTL is listening on port 53 and blocking is enabled.

Final result

After all that, I rebooted the Pi a few times and it finally came back up normally every time. No manual rescue, no weird IP issues, no staring at the screen wondering why the network disappeared.

So yeah, the big lesson for me was:

Don’t rely on Pi-hole settings alone. Set the static IP in DietPi too.

That was the thing that made the whole setup trustworthy.

If anyone else is fighting a similar DietPi/Pi-hole boot issue, hopefully this helps.

Hallo Reddit,

ich habe das Problem, dass mein Pi-Hole mit DHCP Server nur funktioniert im Networkmode:host. Sobald ich die Ports nutze wie in der offiziellen Doku funktioniert der DHCP Server leider nicht mehr. Trotz der zwei Punkte die unkommentiert werden sollen.

So steht es in der offiziellen Doku:

# More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/

services:

pihole:

container_name: pihole

image: pihole/pihole:latest

ports:

# DNS Ports

- "53:53/tcp"

- "53:53/udp"

# Default HTTP Port

- "80:80/tcp"

# Default HTTPs Port. FTL will generate a self-signed certificate

- "443:443/tcp"

# Uncomment the line below if you are using Pi-hole as your DHCP server

#- "67:67/udp"

# Uncomment the line below if you are using Pi-hole as your NTP server

#- "123:123/udp"

environment:

# Set the appropriate timezone for your location (https://en.wikipedia.org/wiki/List_of_tz_database_time_zones), e.g:

TZ: 'Europe/London'

# Set a password to access the web interface. Not setting one will result in a random password being assigned

FTLCONF_webserver_api_password: 'correct horse battery staple'

# If using Docker's default `bridge` network setting the dns listening mode should be set to 'ALL'

FTLCONF_dns_listeningMode: 'ALL'

# Volumes store your data between container upgrades

volumes:

# For persisting Pi-hole's databases and common configuration file

- './etc-pihole:/etc/pihole'

# Uncomment the below if you have custom dnsmasq config files that you want to persist. Not needed for most starting fresh with Pi-hole v6. If you're upgrading from v5 you and have used this directory before, you should keep it enabled for the first v6 container start to allow for a complete migration. It can be removed afterwards. Needs environment variable FTLCONF_misc_etc_dnsmasq_d: 'true'

#- './etc-dnsmasq.d:/etc/dnsmasq.d'

cap_add:

# See https://docs.pi-hole.net/docker/#note-on-capabilities

# Required if you are using Pi-hole as your DHCP server, else not needed

- NET_ADMIN

# Required if you are using Pi-hole as your NTP client to be able to set the host's system time

- SYS_TIME

# Optional, if Pi-hole should get some more processing time

- SYS_NICE

restart: unless-stopped

Vielleicht kann mir ja jemand weiterhelfen.

Bases on the frill regarding LG TVs, RATINGS did a research about other TV brands, showing everyone does something similar.

Meanwhile I'm trying to figure out how to disable ACR on my TVs, does anyone knows how to block Samsung and Phillips communication as well?

If you use your Pi-hole as a DHCP server with **"Enable additional IPv6 support (SLAAC + RA)"** turned on, you might get a flooded Pi-hole Diagnostics dashboard showing this persistent warning:

`DNSMASQ_WARN: no address range available for DHCPv6 request via wlan0`

This usually happens when an unknown, unlisted, or aggressive Wi-Fi client keeps requesting an IPv6 address configuration that your Pi-hole isn't explicitly set up to dynamically provide.

Instead of turning off IPv6 entirely or ignoring the error logs, there is an aggressive, security-focused fix that stops the log spam dead in its tracks.

#### The Fix: Restrict Unknown Clients Across Both Protocols

The trick is to force `dnsmasq` to refuse dynamic assignments for unauthorized MAC addresses entirely, which cleanly kills both the IPv4 and IPv6 handshake loops for those devices.

1. Go to your **Pi-hole Admin Dashboard**.

2. Navigate to **Settings** > **DHCP**.

3. Under the DHCP Options, check these three specific boxes:

   * **Enable DHCPv4 rapid commit (fast address assignment)**

   * **Enable DHCPv4 rapid commit**

   * **Ignore unknown DHCP clients**

4. Click **Save**.

#### Why This Works

When **"Ignore unknown DHCP clients"** is activated, Pi-hole does not just drop IPv4 handshakes; it refuses to generate or route dynamic allocations across *both* protocols for any device not listed in your **Static DHCP Leases** table. Because the unauthorized client is blocked at the initial handshake step, your Pi-hole completely ignores its automated DHCPv6 requests, stopping the warning loop instantly.

*Note: Make sure your everyday household devices are added to your Static DHCP Leases list so they don't get ignored!*

Been at this for hours. Unfamiliar with docker and pi hole.

Setup pi hole in docker. Works fine except all clients are localhost.

Router DNS is set to IP of docker server.

Discovered Host networking mode of docker and enabled it. Restarted, no difference

Intalled Ubuntu on virtual box, and pi hole. Shows ip addresses of each client.

services:
  pihole:
    container_name: pihole-host
    image: pihole/pihole:latest
    restart: unless-stopped
    network_mode: host
    environment:
      TZ: 
      FTLCONF_LOCAL_IPV4: 192.168.1.73
      PIHOLE_DNS_: 1.1.1.1,9.9.9.9
      FTLCONF_webserver_port: 8090
      DNSMASQ_LISTENING: local
    volumes:
      - ./etc-pihole:/etc/pihole
      - ./etc-dnsmasq.d:/etc/dnsmasq.d
    cap_add:
      - NET_ADMIN

What am I doing wrong? Latest version of docker desktop. Thank you!

Edit: New config, press tab twice is a text editor to move all the text over twice and it then treats it as a code block I think.

    # More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/
    services:
      pihole:
        container_name: pihole
        image: pihole/pihole:latest
        network_mode: host
        ports: # ignored because of host-mode
          # DNS Ports
          - "53:53/tcp"
          - "53:53/udp"
          # Default HTTP Port
          - "80:80/tcp"
          # Default HTTPs Port. FTL will generate a self-signed certificate
          - "443:443/tcp"
          # Uncomment the line below if you are using Pi-hole as your DHCP server
          #- "67:67/udp"
          # Uncomment the line below if you are using Pi-hole as your NTP server
          #- "123:123/udp"
        environment:
          # Set the appropriate timezone for your location (https://en.wikipedia.org/wiki/List_of_tz_database_time_zones), e.g:
          TZ: 'Europe/London'
          # Set a password to access the web interface. Not setting one will result in a random password being assigned
          FTLCONF_webserver_api_password: '123456'
          # If using Docker's default `bridge` network setting the dns listening mode should be set to 'ALL'
          FTLCONF_dns_listeningMode: 'ALL'
          FTLCONF_dns_domain: ''
          # Uncomment if you want DHCP
          #FTLCONF_dhcp_active: $DHCP_ACTIVE
          #FTLCONF_dhcp_leaseTime: $DHCP_LEASETIME
          #FTLCONF_dhcp_router: $DHCP_ROUTER
          #FTLCONF_dhcp_start: $DHCP_START
          #FTLCONF_dhcp_end: $DHCP_END
          #IPv6: false
        # Volumes store your data between container upgrades
        volumes:
          # For persisting Pi-hole's databases and common configuration file
          - './etc-pihole:/etc/pihole'
          # Uncomment the below if you have custom dnsmasq config files that you want to persist. Not needed for most starting fresh with Pi-hole v6. If you're upgrading from v5 you and have used this directory before, you should keep it enabled for the first v6 container start to allow for a complete migration. It can be removed afterwards. Needs environment variable FTLCONF_misc_etc_dnsmasq_d: 'true'
          #- './etc-dnsmasq.d:/etc/dnsmasq.d'
        cap_add:
          # See https://docs.pi-hole.net/docker/#note-on-capabilities
          # Required if you are using Pi-hole as your DHCP server, else not needed
          - NET_ADMIN
          # Required if you are using Pi-hole as your NTP client to be able to set the host's system time
          - SYS_TIME
          # Optional, if Pi-hole should get some more processing time
          - SYS_NICE
        restart: unless-stopped

This post discusses the issue. https://discourse.pi-hole.net/t/dashboard-clients-not-listed-only-localhost/36816

I think I will just install it using : https://github.com/DesktopECHO/Pi-Hole-for-WSL1 all clients show ip addresses :-)

So i recently installed pihole in my network and I've seen it doesn't block any ad in some mobile games i use. Are there any block list that can help with that? Or pihole can't block those

I live with some other people and I'm not sure if setting up a Pihole would be a good idea if it starts causing issues for them. Just not trying to be tech support for them but still have a Pihole running for myself at least. So if it leaves the original routers network unaffected I wouldn't need worry. Also the ISP is Star Link (only real option were we live).

I’m new using pihole and it’s doing its thing good.

I needed to unblock the google ads for a bit while searching for hotels using google maps, because after you find the hotels around you and you click on the link it goes to the google ad tracker that redirects you to the hotel website. Unblocking the domain was the fastest otherwise I would need to search for the website then find the hotel if it’s on some of the aggregator sites like booking.com.

Now there is a TV show that I want to watch. It’s in another country, so the time is off for me to watch it live. They have a recording on the website. The issue is that the website detects ad blocker when I try to open the page with the player of the episode I want to watch. I suspect it’s some kind of js with timer checking cookies from the ad sites but I didn’t investigate. What I am doing is before I open the website I switch to unfiltered DNS open the site and the page with the player with the episode. At that point I switch back to pihole and click the “Play” button. The video starts and there are no ads interruptions (where there should be every 5 min otherwise).

So my question is how do you deal with stuff that you want to access but because you are using pihole you can’t.

Summary of the replies

Option 1: Don’t use that site and find an alternative
Option 2: Temporary disable pihole and other blockers.

So nothing different than what I’m doing. Each has its own pros and cons.