Entware Pi-hole directly on the router? Yes!

[jacklul]

Hi @jacklul!
I am following the recommendations to install the prerequisites (asuswrt-scripts). After installing the boot script (‘https://raw.githubusercontent.com/jacklul/asuswrt-scripts/master/scripts/scripts-startup.sh’), when I check the value of “nvram get script_usbmount”, I notice that my previous content has been overwritten. What would be the best way to re-enable the swap partition?

Are you on the stock firmware or Asuswrt-Merlin?
Installing the startup script overwrites the variable, yes.
You can install swap.sh from the asuswrt-scripts repository and configure it to use your swap file path.
Or.. you can call "/jffs/scripts/scripts-startup.sh start" from your script and restore nvram value back to your script.
On most devices script_usbmount is getting cleaned by firmware anyway, I'm surprised you have it working on your device.

Getting this now on re-install

admin@RT-AX88U-17A0:/tmp/home/root# opkg update && opkg install pi-hole
Downloading https://bin.entware.net/aarch64-k3.10/Packages.gz
Updated list of available packages in /opt/var/opkg-lists/entware
Downloading https://jacklul.github.io/entware-pi-hole/aarch64-k3.10/Packages.gz
Updated list of available packages in /opt/var/opkg-lists/pi-hole
package pi-hole suggests installing logrotate
Installing pi-hole (2025.08.19-1) to root...
Downloading https://jacklul.github.io/entware-pi-hole/aarch64-k3.10/pi-hole_2025.08.19-1_aarch64-3.10.ipk
package pi-hole suggests installing logrotate
Configuring pi-hole.
  [i] Running Pi-hole install/upgrade tasks...
  [i] Setting random gravity update and updatechecker times...
  [i] Setting user and group in logrotate file...
  [i] It looks like the root user is not called 'root' - this can cause issues!
  [i] Correcting username in crontab file...
  [i] Generated password for the web interface: s7gH_pKp
  [i] It can be changed using 'pihole setpassword' command.
  [✓] Restarting pihole-FTL service...
  [✓] DNS resolution is available

  [i] Creating new gravity database
Error: unable to open database "/etc/pihole/gravity.db": unable to open database file
   [✗] Unable to create /etc/pihole/gravity.db
   [✗] Error creating new gravity database. Please contact support.
   [✗] Unable to migrate to database. Please contact support.
  [✗] Gravity database rebuild failed - waited 1 hour for it to complete!

I still can't access the WebUI on a fresh install either but no idea why it's not building the gravity database

The fact it generated new password means pihole.toml was missing, which is how it should be, I'm clueless as to why is it using /etc instead of /opt/etc, it shouldn't.

I seem to not be able to reproduce this on my device:

RT-AX58U:/opt/etc# opkg install pi-hole
package pi-hole suggests installing logrotate
Installing pi-hole (2025.08.19-1) to root...
Downloading https://jacklul.github.io/entware-pi-hole/armv7sf-k3.2/pi-hole_2025.08.19-1_ar
mv7-3.2.ipk
package pi-hole suggests installing logrotate
Installing bind-nslookup (9.20.7-1) to root...
Downloading https://bin.entware.net/armv7sf-k3.2/bind-nslookup_9.20.7-1_armv7-3.2.ipk
Installing net-tools-netstat (2.10-2) to root...
Downloading https://bin.entware.net/armv7sf-k3.2/net-tools-netstat_2.10-2_armv7-3.2.ipk
Configuring bind-nslookup.
Configuring net-tools-netstat.
Configuring pi-hole.
  [i] Running Pi-hole install/upgrade tasks...
  [i] Setting random gravity update and updatechecker times...
  [i] Setting user and group in logrotate file...
  [i] It looks like the root user is not called 'root' - this can cause issues!
  [i] Correcting username in crontab file...
  [i] Generated password for the web interface: 3Dcpy7Wn
  [i] It can be changed using 'pihole setpassword' command.
  [✓] DNS resolution is available

  [✗] Migrating the list's cache directory to new location
  [i] Creating new gravity database
  [i] Migrating content of /opt/etc/pihole/adlists.list into new database
  [✓] Deleting existing list cache
  [i] Neutrino emissions detected...

  [✓] Preparing new gravity database
  [✓] Creating new gravity databases
  [✓] Pulling blocklist source list into range
  [i] Using libz compression

  [i] Target: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
  [✓] Status: Retrieval successful
  [✓] Parsed 231413 exact domains and 0 ABP-style domains (blocking, ignored 1 non-domain
entries)
      Sample of non-domain entries:
        - fe80::1%lo0

  [✓] Building tree
  [i] Number of gravity domains: 231413 (231413 unique domains)
  [i] Number of exact denied domains: 0
  [i] Number of regex denied filters: 0
  [i] Number of exact allowed domains: 0
  [i] Number of regex allowed filters: 0
  [✓] Optimizing database
  [✓] Swapping databases
  [✓] The old database remains available
  [✓] Cleaning up stray matter
  [✓] Done.

 

[heslo]

Well if you don't know, I certainly don't

Any ideas where I can go from here? Or do I just abandon it and wait for a "full" release?

 

[jacklul]

Well if you don't know, I certainly don't

Any ideas where I can go from here? Or do I just abandon it and wait for a "full" release?

Can you generate another debug log and pass me the link?

 

[heslo]

Of course

Sign in - Google Accounts

 

[capitantrueno]

Are you on the stock firmware or Asuswrt-Merlin?
Installing the startup script overwrites the variable, yes.
You can install swap.sh from the asuswrt-scripts repository and configure it to use your swap file path.
Or.. you can call "/jffs/scripts/scripts-startup.sh start" from your script and restore nvram value back to your script.
On most devices script_usbmount is getting cleaned by firmware anyway, I'm surprised you have it working on your device.

Hi!

Yes, I use the standard AsusWRT. Asuswrt-Merlin is not compatible with 4G routers. So using your scripts and developments is the way to add additional functionality to my router.

Wow, I didn't notice that ‘swap.sh’ script. Maybe my firmware is old enough to not include that set of cleanup tasks that come with newer routers and firmwares. But since you have included a specific script to enable swap, I will use it to follow a more structured and tested scripting pattern

BR

 

[jacklul]

Your config shows changes to stuff I don't touch in the install script:

[dns]
upstreams = [
   "127.0.0.1#5335",
   "1.1.1.1",
   "1.0.0.1"
] ### CHANGED, default = []
queryLogging = false ### CHANGED, default = true
[database]
maxDBdays = 2 ### CHANGED, default = 91
[dns.rateLimit]
count = 0 ### CHANGED, default = 1000

Is this configuration similar to the one from your Pi?

Your router is running aarch64, just like @bibikalka, yet they did not have any issues like this.. there must be something we are missing here.

 

[heslo]

Your config shows changes to stuff I don't touch in the install script:

[dns]
upstreams = [
   "127.0.0.1#5335",
   "1.1.1.1",
   "1.0.0.1"
] ### CHANGED, default = []
queryLogging = false ### CHANGED, default = true
[database]
maxDBdays = 2 ### CHANGED, default = 91
[dns.rateLimit]
count = 0 ### CHANGED, default = 1000

Is this configuration similar to the one from your Pi?

Your router is running aarch64, just like @bibikalka, yet they did not have any issues like this.. there must be something we are missing here.

I'm not sure, it's not something that I touched myself when I set up my RPi. Should I change these settings back to the default behaviour as listed and try again? Or is there a "clean" pihole.toml I can use? I would have thought uninstalling and deleting the files would have meant starting from scratch without any of these changed values?

I just don't know how or why these values have been changed

 

[jacklul]

I'm not sure, it's not something that I touched myself when I set up my RPi.

If you could take a look on the Pi and compare those setting them it would be appreciated.
The only explanation I can come up with right now is that it somehow pulls the configuration from your Pi.

 

[heslo]

If you could take a look on the Pi and compare those setting them it would be appreciated.
The only explanation I can come up with right now is that it somehow pulls the configuration from your Pi.

Yeah they're the same!

I thought the same as you so I'd totally disconnected the RPi, uninstalled pihole on the router, installed again.... same thing. So it can't be pulling the config from there. But how it got there in the first place I don't know

 

[jacklul]

Yeah they're the same!

I thought the same as you so I'd totally disconnected the RPi, uninstalled pihole on the router, installed again.... same thing. So it can't be pulling the config from there. But how it got there in the first place I don't know

Assuming the RPi is powered off, try:
- /opt/etc/ini.d/S65pihole-FTL stop
- mv /opt/etc/pihole/pihole.toml /opt/etc/pihole/pihole.toml.old
- wait few minutes, see if /opt/etc/pihole/pihole.toml comes back
- if it does then you have a program on your router doing this, don't bother doing next steps
- if it didn't come back run: pihole-FTL --config debug.all false
- see if /opt/etc/pihole/pihole.toml has those extra variables changed again (it should be clear since one of them is right on the top of the file)
- if it does then somehow FTL pulls it from somewhere in your network (I looked at the code for --config handling, it shouldn't do anything like that)
- rm /opt/etc/pihole/pihole.toml
- touch /opt/etc/pihole/pihole.toml
- wait few minutes and see if the config file fills with content
- if it does then something on your router, again, is doing this

 

[heslo]

Assuming the RPi is powered off, try:
- /opt/etc/ini.d/S65pihole-FTL stop
- mv /opt/etc/pihole/pihole.toml /opt/etc/pihole/pihole.toml.old
- wait few minutes, see if /opt/etc/pihole/pihole.toml comes back
- if it does then you have a program on your router doing this, don't bother doing next steps
- if it didn't come back run: pihole-FTL --config debug.all false
- see if /opt/etc/pihole/pihole.toml has those extra variables changed again (it should be clear since one of them is right on the top of the file)
- if it does then somehow FTL pulls it from somewhere in your network (I looked at the code for --config handling, it shouldn't do anything like that)
- rm /opt/etc/pihole/pihole.toml
- touch /opt/etc/pihole/pihole.toml
- wait few minutes and see if the config file fills with content
- if it does then something on your router, again, is doing this

Legend, just about to leave to go out with the wife, I'll try this later and report back

Should I leave pihole installed on the router while doing all this?

 

[jacklul]

Legend, just about to leave to go out with the wife, I'll try this later and report back

Should I leave pihole installed on the router while doing all this?

Yes

 

[capitantrueno]

Hi @jacklul!

There is something I don't understand. In order to use the “https://github.com/jacklul/asuswrt-scripts” scripts. You need to have ENTWARE installed and functional. And to use pihole as an entware package, is it necessary to reinstall ENTWARE using the “https://github.com/jacklul/asuswrt-scripts/blob/master/scripts/entware.sh” script? I just tried to run the entware script and it failed.

/jffs/scripts/entware.sh: line 705: curl: not found

I think something is broken because it can't find the curl binary.

Is it possible to follow the instructions by skipping the entware installation step and use the existing installation provided by the https://github.com/entware/entware/wiki/Install-on-ASUSWRT-step-by-step repository?

BR

 

[jacklul]

Hi @jacklul!

There is something I don't understand. In order to use the “https://github.com/jacklul/asuswrt-scripts” scripts. You need to have ENTWARE installed and functional. And to use pihole as an entware package, is it necessary to reinstall ENTWARE using the “https://github.com/jacklul/asuswrt-scripts/blob/master/scripts/entware.sh” script? I just tried to run the entware script and it failed.

/jffs/scripts/entware.sh: line 705: curl: not found

I think something is broken because it can't find the curl binary.

Is it possible to follow the instructions by skipping the entware installation step and use the existing installation provided by the https://github.com/entware/entware/wiki/Install-on-ASUSWRT-step-by-step repository?

BR

Unfortunately most of the scripts in the asuswrt-scripts repository were designed for newer firmware versions (where we have a limited curl available).
I could look into adding a fallback to wget to the scripts in the near future, but right now I'm doing complete redesign of that repository so that would have to wait.

I'm unsure if the Entware wiki instructions work, you may try.

 

[bibikalka]

@jacklul

I modified my Wiki a bit:

Install on Asuswrt‐Merlin (by bibikalka1)

Pi-hole as an Entware package – run it on a router, NAS, or other devices! - jacklul/entware-pi-hole

github.com

I added a GitHub repository as well so I could post the full config files. That should make it easier to do diff, and get going!

 

[bibikalka]

Have been running Pi-Hole on the router for a few days now. Performance is fast, all good. RAM usage is reasonable, ~40MB most of the time.

My DNS statistics cleared a bit, looks like the previous screenshots with port 53 requests were a fluke based on the pre-unbound requests. Now everything is flowing through Unbound. However, the unbound hit rate is rather low - is that because Pi-Hole already caching a bunch of easy entries?

 

[capitantrueno]

Unfortunately most of the scripts in the asuswrt-scripts repository were designed for newer firmware versions (where we have a limited curl available).
I could look into adding a fallback to wget to the scripts in the near future, but right now I'm doing complete redesign of that repository so that would have to wait.

I'm unsure if the Entware wiki instructions work, you may try.

Yeah, entware wiki instructions worked like a charm on my old router. I will keep you informed with my (slow) progress.

BR

 

[jacklul]

However, the unbound hit rate is rather low - is that because Pi-Hole already caching a bunch of easy entries?

Yes, you can see on the Pi-hole's web interface that over 30% was a reply from cache.

 

[bibikalka]

Yes, you can see on the Pi-hole's web interface that over 30% was a reply from cache.

So unbound cache had no known hits to respond with?