Why does my router want to access Facebook ?!

Installing and Using OpenWrt Network and Wireless Configuration
1

i have TP-Link TL-WDR3600 v1 with OpenWrt 19.07.4 + Pi-Hole.

My routers DHCP is off and i use my Pi-hole as a DHCP. so when i check the query/log of the router 192.168.1.1 its so weird some example below

so can someone explain to my what is my router/OS is doing.

|2020-10-25 18:43:50|A|b-graph.facebook.com|192.168.1.1|Blocked (gravity)|IP (0.1ms)|Whitelist|
| --- | --- | --- | --- | --- | --- | --- |
|2020-10-25 18:43:50|A|b-graph.facebook.com|192.168.1.1|Blocked (gravity)|IP (0.0ms)|Whitelist|
|2020-10-25 18:43:50|A|b-graph.facebook.com|192.168.1.1|Blocked (gravity)|IP (0.0ms)|Whitelist|
|2020-10-25 18:43:50|A|b-graph.facebook.com|192.168.1.1|Blocked (gravity)|IP (0.1ms)|Whitelist|
|2020-10-25 18:43:50|A|b-graph.facebook.com|192.168.1.1|Blocked (gravity)|IP (0.0ms)|Whitelist|
|2020-10-25 18:43:47|A|people-pa.googleapis.com|192.168.1.1|Blocked (gravity)|IP (0.0ms)|Whitelist|
|2020-10-25 18:43:47|A|people-pa.googleapis.com|192.168.1.1|Blocked (gravity)|IP (0.0ms)|Whitelist|
|2020-10-25 18:43:01|A|edge-mqtt.facebook.com|192.168.1.1|Blocked (exact blacklist)|IP (0.1ms)|Whitelist|
|2020-10-25 18:42:58|A|geomobileservices-pa.googleapis.com|192.168.1.1|Blocked (gravity)|IP (0.1ms)|Whitelist|
|2020-10-25 18:42:58|A|geomobileservices-pa.googleapis.com|192.168.1.1|Blocked (gravity)|IP (0.2ms)|Whitelist|
|2020-10-25 18:42:58|A|geomobileservices-pa.googleapis.com|192.168.1.1|Blocked (gravity)|IP (0.2ms)|Whitelist|
|2020-10-25 18:42:29|A|dc.di.atlas.samsung.com|192.168.1.1|Blocked (gravity)|IP (0.2ms)|Whitelist|
|2020-10-25 18:42:29|A|dc.di.atlas.samsung.com|192.168.1.1|Blocked (gravity)|IP (0.2ms)|Whitelist|
|2020-10-25 18:42:29|A|dc.di.atlas.samsung.com|192.168.1.1|Blocked (gravity)|IP (0.3ms)|Whitelist|
|2020-10-25 18:42:10|AAAA|www.duckdns.org|192.168.1.1|OK (forwarded)|CNAME (241.8ms)|Blacklist|
|2020-10-25 18:42:10|A|www.duckdns.org|192.168.1.1|OK (forwarded)|CNAME (241.3ms)|Blacklist|
|2020-10-25 18:42:09|AAAA|duckdns.org|192.168.1.1|OK (forwarded)|NODATA (348.0ms)|Blacklist|
|2020-10-25 18:42:09|A|duckdns.org|192.168.1.1|OK (forwarded)|IP (200.5ms)|Blacklist|
|2020-10-25 18:42:06|A|geomobileservices-pa.googleapis.com|192.168.1.1|Blocked (gravity)|IP (0.2ms)|Whitelist|
|2020-10-25 18:42:06|A|geomobileservices-pa.googleapis.com|192.168.1.1|Blocked (gravity)|IP (0.2ms)|Whitelist|
|2020-10-25 18:42:06|A|geomobileservices-pa.googleapis.com|192.168.1.1|Blocked (gravity)|IP (0.2ms)|Whitelist|
|2020-10-25 18:41:57|A|mqtt-mini.facebook.com|192.168.1.1|Blocked (gravity)|IP (0.2ms)|Whitelist|
|2020-10-25 18:41:56|A|mqtt-mini.facebook.com|192.168.1.1|Blocked (gravity)|IP (0.8ms)|Whitelist|
|2020-10-25 18:41:44|A|googleads.g.doubleclick.net|192.168.1.1|Blocked (exact blacklist)|IP (0.0ms)|Whitelist|
|2020-10-25 18:41:42|A|people-pa.googleapis.com|192.168.1.1|Blocked (gravity)|IP (0.1ms)|Whitelist|
|2020-10-25 18:41:42|A|web.facebook.com|192.168.1.1|Blocked (gravity)|IP (0.0ms)|Whitelist|
|2020-10-25 18:41:42|A|web.facebook.com|192.168.1.1|Blocked (gravity)|IP (0.0ms)|Whitelist|
|2020-10-25 18:41:42|A|web.facebook.com|192.168.1.1|Blocked (gravity)|IP (0.1ms)|Whitelist|
|2020-10-25 18:41:42|A|web.facebook.com|192.168.1.1|Blocked (gravity)|IP (0.0ms)|Whitelist|
|2020-10-25 18:41:41|A|web.facebook.com|192.168.1.1|Blocked (gravity)|IP (0.0ms)|Whitelist|
|2020-10-25 18:41:41|A|web.facebook.com|192.168.1.1|Blocked (gravity)|IP (0.1ms)|Whitelist|
|2020-10-25 18:41:26|A|geomobileservices-pa.googleapis.com|192.168.1.1|Blocked (gravity)|IP (0.1ms)|Whitelist|
|2020-10-25 18:41:26|A|geomobileservices-pa.googleapis.com|192.168.1.1|Blocked (gravity)|IP (0.2ms)|Whitelist|
|2020-10-25 18:41:25|A|dc.di.atlas.samsung.com|192.168.1.1|Blocked (gravity)|IP (0.2ms)|Whitelist|
|2020-10-25 18:41:25|A|dc.di.atlas.samsung.com|192.168.1.1|Blocked (gravity)|IP (0.2ms)|Whitelist|
|2020-10-25 18:41:16|A|edge-mqtt.facebook.com|192.168.1.1|Blocked (exact blacklist)|IP (0.1ms)|Whitelist|
|2020-10-25 18:41:07|A|geomobileservices-pa.googleapis.com|192.168.1.1|Blocked (gravity)|IP (0.2ms)|
2

Perhaps you have configured DNS hijacking on OpenWrt and some of your clients do not use Pi-hole exclusively, e.g. mobile clients may use Google DNS as secondary/failover no matter the DHCP options.

1 Like
3

no i didnt configure anything. its a new openwrt installation the only thing i configured is turned off the DHCP, and downloaded the dynamicdns cause i use duckdns. that is it.

1 Like
4

Then it should be DNSv6 provided by DHCPv6:
https://openwrt.org/docs/guide-user/base-system/dhcp

Check your configuration:

uci show dhcp; netstat -l -n -p | grep -e dnsmasq -e odhcpd
5

this is what i got

dhcp.@dnsmasq[0]=dnsmasq
dhcp.@dnsmasq[0].domainneeded='1'
dhcp.@dnsmasq[0].boguspriv='1'
dhcp.@dnsmasq[0].filterwin2k='0'
dhcp.@dnsmasq[0].localise_queries='1'
dhcp.@dnsmasq[0].rebind_protection='1'
dhcp.@dnsmasq[0].rebind_localhost='1'
dhcp.@dnsmasq[0].local='/lan/'
dhcp.@dnsmasq[0].domain='lan'
dhcp.@dnsmasq[0].expandhosts='1'
dhcp.@dnsmasq[0].nonegcache='0'
dhcp.@dnsmasq[0].authoritative='1'
dhcp.@dnsmasq[0].readethers='1'
dhcp.@dnsmasq[0].leasefile='/tmp/dhcp.leases'
dhcp.@dnsmasq[0].resolvfile='/tmp/resolv.conf.auto'
dhcp.@dnsmasq[0].nonwildcard='1'
dhcp.@dnsmasq[0].localservice='1'
dhcp.lan=dhcp
dhcp.lan.interface='lan'
dhcp.lan.dhcpv6='server'
dhcp.lan.ra='server'
dhcp.lan.ra_management='1'
dhcp.lan.ignore='1'
dhcp.wan=dhcp
dhcp.wan.interface='wan'
dhcp.wan.ignore='1'
dhcp.odhcpd=odhcpd
dhcp.odhcpd.maindhcp='0'
dhcp.odhcpd.leasefile='/tmp/hosts/odhcpd'
dhcp.odhcpd.leasetrigger='/usr/sbin/odhcpd-update'
dhcp.odhcpd.loglevel='4'

1 Like