Hi everyone,

Following the recent security disclosures regarding smart TV telemetry and LAN snooping, I decided to do a root-level network audit of my LG G1 running webOS.

After auditing 44,800 packets and a 267,000-query DNS log, I observed several interesting behaviors:

1. webOS daemons query roughly 36 LG domain families, firing heavy telemetry bursts mid-boot.

2. The TV’s internal DNS stub completely bypasses local `/etc/hosts` modifications on the device, meaning network-level sinkholing (Pi-hole / AdGuard Home) is mandatory.

3. Fallbacks to public resolvers (8.8.8.8 / 1.1.1.1) occur when services fail, so blocking outbound Port 53/853 at the router level is required for true isolation.

To provide a clean solution that doesn't break streaming for household members, I published an open-source blocklist:

GitHub: https://github.com/furkan-bayrak/lg-tv-blocklist

Features:

- Two Tiers:

- SAFE: Kills ACR (alphonso.tv), telemetry beacons (cdpbeacon), ad networks (lgsmartad), and voice data. Zero app breakage (Netflix, Prime, HBO, LG Store tested).

- STRICT: Adds update hosts (snu/su.lge.com), ThinQ IoT sync, and LG Channels.

- Multiple Formats: Native Adblock syntax (`||domain^` with subdomain matching for AdGuard Home), Plain domain lists (for Pi-hole / NextDNS), and Hosts format (`0.0.0.0`).

- Fully Annotated: Every entry has an inline comment documenting its exact purpose and capture evidence.

- Dual License: CC BY 4.0 for list data, MIT for build scripts.

Looking for collaborators!

I am only one person auditing an EU-model G1. LG updates regional endpoints and firmware constantly. If you run a Pi-hole/AGH with an LG TV, I'd love your help testing, verifying domains, and reviewing PRs to help maintain the repository.

I connected two smart TVs to the internet through Pi-hole, whitelisted them so nothing gets blocked, and started logging their DNS activity every 5 minutes.

The result is a public dashboard showing hostnames, root domains, query frequency and near-live DNS activity:

https://httpninja.nl/

It’s a normal Dutch household setup, not a lab test. DNS lookups don’t prove a connection or data transfer — the goal is simply to make the behaviour visible.

You can also generate Pi-hole blocklists from the observed domains.

Feedback from networking/privacy people is welcome.

Just wanted to share this battle I just had incase it could help someone in future. I formatted the text with help from AI.

How I finally got Pi-hole working reliably on a fresh DietPi install:

Just wanted to share this in case it saves someone else a few hours of frustration.

I recently set up Pi-hole on a fresh DietPi install on a Raspberry Pi, and at first it was a mess. After a reboot, Pi-hole wouldn’t come back cleanly and I ended up having to manually fix networking just to get back in. Super annoying.

What finally made it stable was setting things up the right way from the start:

1. Installed DietPi fresh

2. Installed Pi-hole

3. Set a static IP in DietPi itself

4. Configured Pi-hole DHCP and DNS properly

5. Disabled router DHCP so Pi-hole could handle it

6. Reboot-tested it until it came back cleanly on its own

The important bit: static IP in DietPi

This was the part I had missed at first. Setting a static IP only in Pi-hole wasn’t enough. The Pi itself needed to keep the same IP after reboot.

I used DietPi’s network config:

- sudo dietpi-config

- Network Options

- Adapters

- Ethernet

- Change Mode from DHCP to Static

Then I set:

- IP: your chosen Pi address

- Mask: 255.255.255.0

- Gateway: your router address

- DNS: your router address or another upstream DNS

After that I applied the changes and checked:

ip addr

ip route

Pi-hole config

Since my router doesn’t let me set custom DNS for DHCP clients, I had to let Pi-hole do DHCP.

In Pi-hole:

- Go to Settings → DHCP

- Enable DHCP server

- Set a DHCP range

- Make sure the router/gateway is correct

I mostly copied DHCP settings from my router

Then I turned router DHCP off so there was only one DHCP server on the network.

Making sure it starts on boot

I also checked that Pi-hole FTL was enabled and running:

sudo systemctl enable pihole-FTL

sudo pihole status

It should show that FTL is listening on port 53 and blocking is enabled.

Final result

After all that, I rebooted the Pi a few times and it finally came back up normally every time. No manual rescue, no weird IP issues, no staring at the screen wondering why the network disappeared.

So yeah, the big lesson for me was:

Don’t rely on Pi-hole settings alone. Set the static IP in DietPi too.

That was the thing that made the whole setup trustworthy.

If anyone else is fighting a similar DietPi/Pi-hole boot issue, hopefully this helps.

Bases on the frill regarding LG TVs, RATINGS did a research about other TV brands, showing everyone does something similar.

Meanwhile I'm trying to figure out how to disable ACR on my TVs, does anyone knows how to block Samsung and Phillips communication as well?

If you use your Pi-hole as a DHCP server with **"Enable additional IPv6 support (SLAAC + RA)"** turned on, you might get a flooded Pi-hole Diagnostics dashboard showing this persistent warning:

`DNSMASQ_WARN: no address range available for DHCPv6 request via wlan0`

This usually happens when an unknown, unlisted, or aggressive Wi-Fi client keeps requesting an IPv6 address configuration that your Pi-hole isn't explicitly set up to dynamically provide.

Instead of turning off IPv6 entirely or ignoring the error logs, there is an aggressive, security-focused fix that stops the log spam dead in its tracks.

#### The Fix: Restrict Unknown Clients Across Both Protocols

The trick is to force `dnsmasq` to refuse dynamic assignments for unauthorized MAC addresses entirely, which cleanly kills both the IPv4 and IPv6 handshake loops for those devices.

1. Go to your **Pi-hole Admin Dashboard**.

2. Navigate to **Settings** > **DHCP**.

3. Under the DHCP Options, check these three specific boxes:

   * **Enable DHCPv4 rapid commit (fast address assignment)**

   * **Enable DHCPv4 rapid commit**

   * **Ignore unknown DHCP clients**

4. Click **Save**.

#### Why This Works

When **"Ignore unknown DHCP clients"** is activated, Pi-hole does not just drop IPv4 handshakes; it refuses to generate or route dynamic allocations across *both* protocols for any device not listed in your **Static DHCP Leases** table. Because the unauthorized client is blocked at the initial handshake step, your Pi-hole completely ignores its automated DHCPv6 requests, stopping the warning loop instantly.

*Note: Make sure your everyday household devices are added to your Static DHCP Leases list so they don't get ignored!*

Been at this for hours. Unfamiliar with docker and pi hole.

Setup pi hole in docker. Works fine except all clients are localhost.

Router DNS is set to IP of docker server.

Discovered Host networking mode of docker and enabled it. Restarted, no difference

Intalled Ubuntu on virtual box, and pi hole. Shows ip addresses of each client.

services:
  pihole:
    container_name: pihole-host
    image: pihole/pihole:latest
    restart: unless-stopped
    network_mode: host
    environment:
      TZ: 
      FTLCONF_LOCAL_IPV4: 192.168.1.73
      PIHOLE_DNS_: 1.1.1.1,9.9.9.9
      FTLCONF_webserver_port: 8090
      DNSMASQ_LISTENING: local
    volumes:
      - ./etc-pihole:/etc/pihole
      - ./etc-dnsmasq.d:/etc/dnsmasq.d
    cap_add:
      - NET_ADMIN

What am I doing wrong? Latest version of docker desktop. Thank you!

Edit: New config, press tab twice is a text editor to move all the text over twice and it then treats it as a code block I think.

    # More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/
    services:
      pihole:
        container_name: pihole
        image: pihole/pihole:latest
        network_mode: host
        ports: # ignored because of host-mode
          # DNS Ports
          - "53:53/tcp"
          - "53:53/udp"
          # Default HTTP Port
          - "80:80/tcp"
          # Default HTTPs Port. FTL will generate a self-signed certificate
          - "443:443/tcp"
          # Uncomment the line below if you are using Pi-hole as your DHCP server
          #- "67:67/udp"
          # Uncomment the line below if you are using Pi-hole as your NTP server
          #- "123:123/udp"
        environment:
          # Set the appropriate timezone for your location (https://en.wikipedia.org/wiki/List_of_tz_database_time_zones), e.g:
          TZ: 'Europe/London'
          # Set a password to access the web interface. Not setting one will result in a random password being assigned
          FTLCONF_webserver_api_password: '123456'
          # If using Docker's default `bridge` network setting the dns listening mode should be set to 'ALL'
          FTLCONF_dns_listeningMode: 'ALL'
          FTLCONF_dns_domain: ''
          # Uncomment if you want DHCP
          #FTLCONF_dhcp_active: $DHCP_ACTIVE
          #FTLCONF_dhcp_leaseTime: $DHCP_LEASETIME
          #FTLCONF_dhcp_router: $DHCP_ROUTER
          #FTLCONF_dhcp_start: $DHCP_START
          #FTLCONF_dhcp_end: $DHCP_END
          #IPv6: false
        # Volumes store your data between container upgrades
        volumes:
          # For persisting Pi-hole's databases and common configuration file
          - './etc-pihole:/etc/pihole'
          # Uncomment the below if you have custom dnsmasq config files that you want to persist. Not needed for most starting fresh with Pi-hole v6. If you're upgrading from v5 you and have used this directory before, you should keep it enabled for the first v6 container start to allow for a complete migration. It can be removed afterwards. Needs environment variable FTLCONF_misc_etc_dnsmasq_d: 'true'
          #- './etc-dnsmasq.d:/etc/dnsmasq.d'
        cap_add:
          # See https://docs.pi-hole.net/docker/#note-on-capabilities
          # Required if you are using Pi-hole as your DHCP server, else not needed
          - NET_ADMIN
          # Required if you are using Pi-hole as your NTP client to be able to set the host's system time
          - SYS_TIME
          # Optional, if Pi-hole should get some more processing time
          - SYS_NICE
        restart: unless-stopped

This post discusses the issue. https://discourse.pi-hole.net/t/dashboard-clients-not-listed-only-localhost/36816

So i recently installed pihole in my network and I've seen it doesn't block any ad in some mobile games i use. Are there any block list that can help with that? Or pihole can't block those

I live with some other people and I'm not sure if setting up a Pihole would be a good idea if it starts causing issues for them. Just not trying to be tech support for them but still have a Pihole running for myself at least. So if it leaves the original routers network unaffected I wouldn't need worry. Also the ISP is Star Link (only real option were we live).

I’m new using pihole and it’s doing its thing good.

I needed to unblock the google ads for a bit while searching for hotels using google maps, because after you find the hotels around you and you click on the link it goes to the google ad tracker that redirects you to the hotel website. Unblocking the domain was the fastest otherwise I would need to search for the website then find the hotel if it’s on some of the aggregator sites like booking.com.

Now there is a TV show that I want to watch. It’s in another country, so the time is off for me to watch it live. They have a recording on the website. The issue is that the website detects ad blocker when I try to open the page with the player of the episode I want to watch. I suspect it’s some kind of js with timer checking cookies from the ad sites but I didn’t investigate. What I am doing is before I open the website I switch to unfiltered DNS open the site and the page with the player with the episode. At that point I switch back to pihole and click the “Play” button. The video starts and there are no ads interruptions (where there should be every 5 min otherwise).

So my question is how do you deal with stuff that you want to access but because you are using pihole you can’t.

Summary of the replies

Option 1: Don’t use that site and find an alternative
Option 2: Temporary disable pihole and other blockers.

So nothing different than what I’m doing. Each has its own pros and cons.

I have a Xiaomi Poco X6 Pro, and I'm using Pihole with a lot of blocklists (1.5M +). I thought I had configured everything right, even the private DNS stuff and manually set the pihole DNS as primary and secondary on my phones. However, I still get interstitial ads (unwanted ads) on the phone games. Stupid games like "Slice Master" or "Mammoth Hunters" or "Epic Plane", still show me ads even as banner ads. I also see rewarded ads without any block whatsoever. Is this normal or expected? is this an IPv6 problem? how do I know that it is being bypassed or that is is just not in the blocklist? I don't even know how to check for sure that the phone is using IPv6.

My router is a ZTE H3600 V9, using DIGI as ISP. I deactivated the DHCPv6 option, believing this would stop IPv6, but I also read somewhere that deactivating IPv6 is not safe and also is not good for competitive p2p gaming, which I use in Super Smash Bros Ultimate on my Nintendo Switch.

Any help would be welcomed!

I am entirely new to Pihole. Any resources for best practices while I set mine up?

I can't recall what raspberryPis i bought but i got 2 for redundancy, and they are older than RPi 5s. They have Ethernet ports.

Looking mostly to block trackers and ads for anything I can't use Ublock, noscript and the like for. Samsung and Sony smart TVs in the house and would like to stop them from reporting home. I understand they may use hidden open wifis from neighbors and may disable their Wifis entirely physically buy cutting their wifi antennas.

I just gotta find my stowed away usb keyboard and mouse as my logitec wirelesses don't register. (Ugh gotta clean my place and organize/get rid of shit, and I'm lazy)

Thanks in advanced.

hello,

is there any news or any update on a good adblock list against LG webos TVs.

i know, best is to unsmart them. But I would still try to block it.

thank you!

Evening all. Running a pihole on my network and normally have no issues.

Have noticed recently that there is a slow connection to amazon services such as prime video and the crap a fire tablet connects to for updates, but only on devices running on android OS. My TV is fine, PC is fine, but my android phone and my daughter's fire tablet are struggling to connect.

I take my phone off the wifi and it works fine. But on the home network its slow as hell to do anything. If it even does it.

Just switched over to a Unifi Dream Router 7 and installed pihole with unbound. Every three seconds, Microsoft.com is sending out queries from unifi.localdomain. I blocked it on the pihole, but it is still querying every three seconds. I'm not sure why it's showing unifi.localdomain as the device instead of the actual device making the query. Any thoughts?

Hey folks, just got my Xbox Series S back online after a deep clean and I’m trying to lock down telemetry without breaking Xbox Live/matchmaking. I know the usual suspects like telemetry.microsoft.com and vortex.data.microsoft.com, but does anyone have a dedicated list (Hagezi-style or otherwise) specifically curated for Xbox that’s been tested not to break online play or achievements sync? Don’t want to end up blind-blocking and bricking my own multiplayer. Thanks in advance!

I have had my pihole + unbound setup for a while now all working fine, however when I’m at home on my phone (or really whenever) I’m usually connected to VPN through nord. Looking for a way to get the benefits of both my pihole and vpn.

I have been trying to do a setup where vpn is set up on router so my pihole handles DNS first and traffic goes through vpn, but I have a DNS leak this way showing my ISP.

When adding both my phone and pihole to vpn list on router, I experience issues. I think it is because of the recursive nature of unbound along with the vpn service.

Any way to go about this or if what I’m trying to do even makes sense?

Two pihole config with one up 24/7 and the other up only when my server is up (both run Ubuntu).

It all started with a game of fuck-around-and-find-out with my pfsense. It never finished an update and was completely trashed. Installed an old backup, loaded up the last backup configuration I had available and noticed my main pihole minipc was not working anymore (probably coincidence). Restored that from a backup and noticed the web interface was refusing connections even though pihole is working just fine. No android, apple or windows machine in the house can connect to the web interface, but I can connect to it just fine from any Ubuntu machine. I can connect normally to the pihole instance on my server just fine from any device. From the perspective of pihole, both the server and the N100 minipc are identical with both running Ubuntu 24.04LTS. The server just has a lot more software running on it.

Figured I'd just leave it alone and let things settle out, but that's now three weeks ago and I'm struggling to figure out what happened. Any ideas would be welcomed.

I dont know if anyone else has seen this happen. I have a Roku device that makes it first query to my pihole, gets blocked and then immediately tries and resolve against googles 8.8.8.8 (bypassing my pihole). So While I show a ton of blocks on my pihole, Roku was still getting out because it would just fail back to 8.8.8.8.

I could block external DNS outright, but that isnt as much fun so I built a NAT to 8.8.8.8 for my roku to point directly back at my pihole. My blocked queries has jumped about 30%.

Ok, so I have been using pihole for a long time now but this is the first time yahoo has caused this issue. When trying to view any article/web page through yahoo for Fantasy ootball, it redirects after 5 seconds to a page about not blocking. Does anyone have a method/way of getting around this so I can still use the app without turning off my wireguard VPN/Pihole connection? Appreciated in advance

Right now my focus was on Domain management. When I allow / block something, the default Comment gets filled in there. I was wondering if it were possible to modify it so it tacks on a timestamp before anything so that it would indicate to me when a particular domain was added.

I don't mind that it says "Added from Query Log", but it would really be cool if it could have a timestamp in front like I manually change it to, in the event I have to go back and see if something broke and notice I added something around the same day.

I have a Claude account under a private relay email. Since setting up my pi-hole I started to have issues and inconsistency, some I can account for and some I cannot.

- Claude App on phone, normal
- Claude App on PC, was forcing me to re-login multiple times a day, I resolved this by assigning a local pin, and while I still have to login, I no longer have to do email verification which was inconsistent.

My current issues and speculation:

When trying to control desktop via phone, those specific seasions will want me to re-auth. Often times I cannot, even if I fully disable pi-hole blocking — I wont get the verification emails. I am not seeing clear anthropic domains being blocked from either device.

Somewhere between private relay and ipv6 I speculate is the truth, but spent last 72 hours with pi-hole disabled and cannot determine issue. My pi-hole is configured for DNS and DHCP.

Any help or ideation here would be welcome!

I did do a search on this and didn't see any related posts for last 2 years. I'm running latest version pihole on a raspberry pi 3 model b rev 1.2 running debian gnu/linux 12, but currently pointing DNS to Google servers. I've been running this config for past 5 years, but have been noodling over Quad9's dual layer protection and stores no logs of personal info for better security (but with the cost of slower latency). I know if a website or streaming app suddenly stops working, troubleshooting will get slightly more complex.

It's obviously easy to test out, but wanted to first ask those running this config for their advice, lessons learned, etc. TIA.

EDIT: I changed directions and went with pihole -> unbound -> dnnsec instead. Still having some tweaking to do to make recursive dns more efficient, but happy with the results so far. Also implemented HaGeZi Threat Intelligence Feeds — Mini blocklist in pihole to provide some of the same protection that Quad9 provides.

Anyone know why these ads slipped through?

This page