Remove pi hole

[Col8eral]

I haven't used skynet. Do you want me to run that command?

 

[ColinTaylor]

Firewall - URL Filter with an "Allow List" ?

 

[Col8eral]

admin@RT-AX88U-37E8:/tmp/home/root# cat /jffs/scripts/firewall-start
cat: can't open '/jffs/scripts/firewall-start': No such file or directory

 

[Col8eral]

I found this??

 

[ColinTaylor]

I found this??

View attachment 64720

Bingo!

Remove the github entry and disable the filter.

 

[Col8eral]

really. I cant recalL putting that in there. Shall I remove and dissable. I also found this:

 

[ColinTaylor]

really. I cant recalL putting that in there. Shall I remove and dissable. I also found this:

View attachment 64721

That's OK but you might as well disable it as it's not doing anything (because it's an empty Deny List).

 

[Col8eral]

its working. No DNS entries in LAN DCHP, just WAN. Thank you so much for figuring it out. Why did that url filter stop the router DNS server from working?

 

[ColinTaylor]

Why did that url filter stop the router DNS server from working?

Because it was an Allow List. So it was saying the only DNS addresses you could resolve were those that had "github" in them (and asus.com which is hard-coded).

 

[Col8eral]

Thank you again. Really appreciate it .

 

[dave14305]

[0:0] -A FORWARD -i br0 -p udp -m udp --dport 53 -j DROP

I still don’t understand why LAN DHCP DNS was working since even forwarded DNS traffic should have been dropped, unless it was somehow falling back to TCP.

 

[Col8eral]

It's been running like this for a while. It's only when I removed pihole that I noticed the problem.

 

[ColinTaylor]

I still don’t understand why LAN DHCP DNS was working since even forwarded DNS traffic should have been dropped, unless it was somehow falling back to TCP.

Good point. Or possibly switching to DoH as 1.1.1.1 is on Windows' list of known servers. That might explain the inconsistent client behaviour he initially observed.

 

[dave14305]

Good point. Or possibly switching to DoH as 1.1.1.1 is on Windows' list of known servers. That might explain the inconsistent client behaviour he initially observed.

Pi-Hole must have also had some kind of encrypted DNS running on it, like Unbound DoT, assuming the URL filter has been there for a while. Weird, but enlightening.