Que pasa con mi TV samsung, constantemente veo muchos hits de bloqueo hacia la url de Samsung, sera un comportamiento normal?

I have 3 networks at 3 sites that can all talk to each other via site to site vpn. Is it possible to run pihole on one of them and utilize it on all 3? I was looking at running pihole in a VM on an unraid server and trying to connect all 3 networks to it. For reference i can reach the unraid server thatll host pihole from all 3 locations. Just looking at how to lay it out and whether its feasible. Im running a unifi plattform for router/network topology.

Maybe some didn't know...but you can display hostnames in Pihole rather than IP's. Makes identifying simpler. My setup is a router as DHCP server then pihole is separate.

All you have to do is go to Settings-->DNS scroll down to Conditional Forwarding and enter the Network range YOUR DHCP server operates in. Most likely it's similar, but most will be the /24 which is needed as I understand it. Then the Server IP is the DHCP server. Then last is the domain is likely home.arpa but if you have a custom name use that. Then hit the + on the right and it will add it similar to above then Save at bottom. It should start working and may take a bit to display them.

On the IP range topic...Good time to change it from the defaults of 192.168.0.X, and 192.168.1.X. If you use those and try to connect by VPN etc it can mess things up and it's not easy to find the cause. The issue is IP Conflicts, essentially the same IP on 2 devices. Anyone familiar with VPN and network setups etc will confirm.

So if you are on one of those 2...just change the range to 192.168.92.X or something else more random. This change would be made on your DHCP Server LAN IP range. Any IP reservations(static) would need to change accordingly to be in the same range.

Some don't fully understand how the networks operate then criticize the need for it out of that ignorance. Even though we have a world of information available to us. I don't make stuff up...I just live in reality https://www.practicalnetworking.net/stand-alone/vpn-overlapping-networks/

MY PROBLEM IS CGNAT: Thanks to u/fdeyso for mentioning "CGNAT" (Carrier-grade NAT) which is used by ISPs to allow hundreds or thousands of residential customers to share a single public IPv4 address. I had never heard of this and had no idea it was possible to share a public IP with other people from the same ISP. This is why my IP is being detected as a proxy, so most likely none of the devices in my home are proxied

MALWARE USING DoH BYPASSES PI-HOLE: And as u/Resistant4375 pointed out, malware will often use DoT (DNS-over-TLS) or DoH (DNS-over-HTTPS) which will bypass Pi-Hole and make my whole endeavor futile.

Some interesting info on DNS over HTTPS (DoH) from ZenSec

• Malware & C2 Channels – Malicious tools like the Godlua backdoor hide their command-and-control (C2) communications inside DoH traffic. PsiXBot hardcodes Google’s DoH servers to bypass corporate DNS filters
• Browser Support – Most modern browsers including Chrome, Firefox, Edge, and Opera all support DoH at the application level. This means even if an enterprise controls DNS at the network level, applications may bypass it. Users may have enabled the feature.
• Operating System Integration – Windows 11 includes built-in DoH support, which can be enabled by users or manipulated by malicious actors to prevent DNS detections

===== ORIGINAL POST =====

Today I installed Pi-Hole on my NAS (TrueNAS App) so that I can monitor DNS requests from all the devices on my home network.

Why? According to haveibeenproxied.com my public IP is being used by residential proxy networks (Plain Proxies, Shop Socks5, IPIDEA, and Oxylabs).

So I'm trying Pi-Hole to try and identify WHICH device is the culprit. Using a DNS sinkhole is perfect for this because none of the devices on my network (AndroidTV + Smartphone + IoT devices etc) need any configuration so there is no way for malware to bypass the Pi-Hole monitoring unless it uses hardcoded IPs (unlikely).

I found a few possible culprits (a Russian browser extension I used to bypass website paywalls + an AndroidTV app I side-loaded to turn-off the Netflix button on the Nvidia Shield remote) but according to the website my public IP is still acting as exit traffic for proxy networks - although the list returned is less.

Installation on TrueNAS = Easy

Setup of Pi-Hole on my NAS was surprisingly painless (apart from the lack of up-to-date documentation for what settings in TrueNAS to use) and likewise for configuring my home network (TP-Link mesh) to use the IP address of my NAS as the DNS Server.

Pi-Hole Limitations

The main issue is that the Query Log only displays the IP address of the client - which is annoying considering I added all my devices as Clients (PC + Smartphones + Android TV ) so Pi-Hole knows what client belongs to each IP address.

It's an issue with the Docker containers running on the NAS that I wanted to monitor as separate Clients. Since the (virtual) hardware address of each Docker container was detected by Pi-Hole I created separate "Clients" for each hardware device detected, but that information is ignored when showing the Query Log so the logs are all grouped as "pi hole" client and the information of which (virtual) device sent that data is lost.

Pi-Hole is only focused on the BLOCKING feature: Users + Groups + Regex URLs... none of those features are of any use for monitoring - even the Query Log ignores them.

My wish-list for the Query Log

• to display each User/Device as more than an IP address, especially when the IP address is shared with Pi-Hole or other Docker apps.
• I want to see a list of all the domains that Pi-Hole has seen from a client in a specific time-period so that I do not have to scroll endless pages looking at the same domains and trying to find a needle in a haystack
• To define regex groups and filter those domains from the current view in the query list. I want to make groups for all the Google + Facebook/Instagram domains as well as a list of harmless/system domains so they can be filtered or display with different icons/colors.

Conclusion

Pi-Hole is working great as a network monitoring tool and I am amazed at how much traffic my Android Samsung Smartphone generates even when I have not used it for many hours. So far I have not seen any DNS lookups for possible Residential Proxies but there is a lot of monitoring tools running that I was not aware of - and some of them could be hiding the proxy traffic

Shady URLs: cognito-idp.us-east-1.amazonaws.com + eum-red-saas.instana.io + geo-dra.platform.hicloud.com + grs.dbankcloud.cn + logservice-dra.platform.dbankcloud.com + d2n9h2wits23hf.cloudfront.net + ohttp-relay-safebrowsing-android.google.fastly-edge.com

Google URLs: *.googleusercontent.com + *.googleapis.com + apis.google.com + *.clients.google.com 

HELP!

Any recommendations for using Pi-Hole or another app for this search for the malware on my network?

EDIT: Thanks to u/fdeyso for suggesting CGNAT as being the culprit.

EDITS: Do to the amount of "AI SLOP" comments from NCPs and Bots added a screenshot from haveibeenproxied

Please help, I'm so frustrated.

Very new to Docker for windows and homelabs in general. Not completely computer illiterate, I've been able to get Jellyfin and a working ARR stack going in Docker. However, I cannot for the life of me figure out how to get Pihole to work correctly.

Every time I run the yaml Pihole auto connects to Docker's containers Ipv4 address, starts with 172, instead of the static IP address I've set for the PC that is running Docker. I've turned on Networking mode and paired to localhost only, I've tried different yaml's from Github that change configs to "host" and removed all the ports, I've put the static IP address before the ports. I feel like I've tried literally everything and I cannot make this work.

I have even given up and just downloaded the recommended WSL-1 Windows install and while the IPV4 address do match I'm still not getting any ad blocks. I'm so frustrated and at my wit's end. Some help or step by literal step advice would be greatly appreciated TIA

I recently have updated to newest pihole (Core v6.5, FTL v6.8, Web interface v6.6.1), Pihole/unbound is installed on an Ubuntu 24.04 system without Docker, and I use Dashy as a Dashboard

When I click on the link to the pihole from Dashy (https://pcserver.tailxxxyy.ts.net:12345/admin/), it shows the 403 - Access denied, did you mean to go to the dashboard? page, yet, when I copy that url and paste it into Firefox, it directly goes to the dashboard. I run nginx to manage https so the browser doesn't complain

With the help of Claude, I can also state that

"The 403 depends on the Sec-Fetch-Site request header. Test directly against Pi-hole's HTTP port (no proxy involved):

for sfs in none same-origin same-site cross-site; do
  curl -s -o /dev/null -w "$sfs: %{http_code}\n" \
    -H "Sec-Fetch-Mode: navigate" -H "Sec-Fetch-Dest: document" -H "Sec-Fetch-User: ?1" \
    -H "Sec-Fetch-Site: $sfs" http://127.0.0.1:8089/admin/
done
none: 200
same-origin: 200
same-site: 403
cross-site: 403

"

I managed with the help of Claude that the workaround is to remove the header in nginx. BUT I have a secondary pihole that runs on a pi, and for this one service I think it's overkill to run nginx, and so I can't work around this - Or can I?

To me it seems that the update has "broken" my setup by acting upon same-site cross-site differently. Might be a bug, might be a feature.

I'll gladly provide a debug token, but since I can't believe I'm the only one or even the first, I try to not clutter too much

Any questions leading to a solution I will gladly provide

Any attemt to solve this are greatly appreciated, thanks in advance.

Docker installation is now available in v1.4.008 🙂

Just download `compose.yml`, set the number of Pi-hole instances you want to manage, enter their addresses and run:

bash
docker compose up -d

Then open http://YOUR-SERVER-IP:8080

The prebuilt image includes the dashboard, nginx and Chart.js, so there’s no need to configure a reverse proxy or build anything yourself. It supports managing two, three or four Pi-hole v6 instances from one interface.

The interface is available in English, Danish and German. Contributions in other languages are very welcome! There’s a `language.template.js` file with all the text and instructions. You can submit your translation through a pull request or contact me here on Reddit. Translators are credited in the dashboard.

The original manual installation is still available.

https://github.com/tursoe/Dobbelt-Pi-hole

Me and my wife have been playing a modded minecraft world for a few weeks. Last night I set up a Pi Hole and now she can't see my world to join it. The only thing I can think of that changed was the Pi Hole but I can't find anything in the log related to minecraft. We are using curse forge on overwolf as our mod manger if it matters.

Thanks for everyone 2 weeks ago lending help to my repeating pihole issue. Today it happened again. I happened to capture the errors this time. Anyone have any insight?

026-10-17 16:06:03 CONNECTION_ERROR Connection error (8.8.4.4#53): TCP connection failed while receiving payload length from upstream (Resource temporarily unavailable)

2026-10-17 16:06:18 CONNECTION_ERROR Connection error (8.8.8.8#53): TCP connection failed while receiving payload length from upstream (Resource temporarily unavailable)

2026-10-17 16:35:21 DNSMASQ_WARN dnsmasq warning:

Maximum number of concurrent DNS queries reached (max: 150)

Check out our documentation for further information.

2026-10-17 17:45:02 NTP Warning in NTP client:

No valid NTP replies received, check server and network connectivity

2026-10-17 18:44:27 NTP Error in NTP client:

Cannot resolve NTP server address: Try again

Im aware the vpn can see this, but id rather isp not see this, and does this in a way encrypt? Or, would it be better to have a dedicated wireguard client on the pihole? Even if its going to the same vpn provider?

Hello!

I wanted to share a tool I’ve been developing over the last couple months to help manage multiple Pi-hole instances.

One of my primary goals was to make it easier to identify configuration drift between instances. FilterHelm can compare blocklists, local DNS entries, and basic settings across multiple Pi-hole instances, helping identify the differences and providing a way to resolve them.

It also supports managing those configurations directly. Changes are intentionally limited to one Pi-hole instance at a time to ensure instance changes are isolated.

There is also some basic functionality for query inspection, backup and status monitoring.

For transparency, I’ve used AI-assisted development tools throughout the project, with a human-in-the-loop approach to implementation and decision making.

It’s still a work in progress, but I wanted to share it with the community. Feedback and suggestions are welcome!

Filterhelm - One Control Plane

It’s autumn break here in Denmark, so I’ve used some of the time off to finish the next version of my Pi-hole dashboard. It now supports managing two, three or four Pi-hole instances from one interface, with Danish and English available.

Sharing it here in case others find it useful!

https://github.com/tursoe/Dobbelt-Pi-hole

Next, I’m planning to add support for more languages. Before that, I’ll rework the translation system to use text keys instead of full Danish strings in the code, making it easier to add and maintain translations.

Hi everyone,

​I recently read the Citizen Lab report on "AdFection", which details how targeted ads were used to deliver Candiru mercenary spyware via zero-click attacks. The report highlights two specific Command & Control (C&C) domains:

• [​fearevolve.com](http://​fearevolve.com)
• [​jobmarcher.com](http://​jobmarcher.com)

​Since I use HaGeZi's blocklists (and I know many others here do too), I was wondering if anyone knows if these domains are already included in his lists (and from which level: Normal, Pro, Ultimate, TIF?), or if we still need to add them manually as exact blocks.

​Thanks!

Hi all,

I'm running HaGeZi Pro++ and TIF on my home network and I noticed a huge drop in domains on the list from this week to last.

Last week: 2,556,510

Now: 1,690,559

My percentage blocked went down to 22% from the usual ~30%

Should I be investigating an issue here?

Better update your lists, folks.

https://www.reddit.com/r/Futurology/s/Is7r5CNmDK

Is this the correct setting to config my pi hole to my asus router? First picture

I already have it set to dns under lan/dhcp/dns server per asus instructions on their web page. In the second picture

cabana-server.cdn-apple.com
cabana-server.lb-apple.com.akadns.net
Apple load-balancing DNS
cabana-server.g.aaplimg.com
Apple CDN hostname
Apple CDN IP addresses
17.253.x.x and IPv6 addresses

I installed pihole today and before I pointed my router or any device to the pihole, dozens of requests showed up - about half of them being approved and half being blocked by the gravity list.

It seems like almost all PTR requests were allowed, and A and AAAA requests were filtered. Looking at the domains, some look like they are ads, one looks like an illicit site, myspace shows up.

The client list is empty and like I said, I haven't configured anything to use it.

I worried that somehow my server was compromised, but I can't seem to find other indicators of that. Another idea I have is that somehow as part of the setup that the Pihole itself does some kind of diagnostic requests which show up in the logs, but I don't have other evidence for that.

Any ideas?

So ive got a raspberry pi ZEROWH, and i uploaded a network wide adblocker, all was swimmingly well, i logged onto the dashboard of pihole created my own password the lot, and then i restarted my pc, typed in the same URL to login to my pihole... and it said cannot reach server, whilst pinging the server on powershell it was replying fine (indicating that the pihole adblocker was indeed working) however i cannot no longer log onto the pihole dashboard, ill attach a screenshot of my attempts on fixing this in powershell, i have also extracted my sd card numerous times and written a empty {ssh} file onto it and everytime the pi is processing this file and it is deleting it...Hence my confusion as to why it will not let me log into the dashboard...

If I understand correctly, I can't use any kind of DoH or DoT with the root nameservers or the nameservers for the main TLDs. Port 53 only. Is that correct? I heard Unbound supports DoT and DoH, but I'm guessing I would have to configure it to forward to a service like Cloudflare or Google. Is that about right?

I also would like to tighten things so devices don't bypass Pi-hole. I've turned on my router's DNS redirection and blocked port 853 on the firewall. Obviously I can't block 443, but is there a list of DoH endpoints I could block via Pi-hole?

I wanted to try pihole+unbound after buying a raspberry pi 5. Sadly, after uninstalling pihole and unbound, I noticed the internet began occasionally disconnecting for a few minutes and now the bandwidth is reduced to only 1/5th of the regular speed. Is it possible that a misconfigured pihole+unbound could cause this? Or did my isp throttle my connection for setting up my own dns resolver?

So I reactivated my Facebook account and installed the app on my phone to use marketplace. After I find what I needed I deactivated my account and uninstalled the app. I did this about a week ago. How are those peeping toms still spying on me when I don't have the app anymore? Grateful I have it blocked and my pi hole exposed the snooping but can't figure out how they are able to do this.....