Set Up Pi-hole as a Self-Hosted Network Ad Blocker

Block Ads Before They Reach Any Device on Your Network

Most ad blockers work at the browser level – they sit inside Chrome or Firefox and filter content page by page, device by device. Pi-hole takes a different approach entirely. It operates as a DNS sinkhole, intercepting domain name lookups before your devices ever make a connection to ad servers, tracking scripts, or telemetry endpoints. That means every device on your network – phones, smart TVs, gaming consoles, even refrigerators with Wi-Fi – gets filtered automatically, without installing a single extension.

The setup runs on a Raspberry Pi (or any Linux machine), and once it is configured as the DNS server for your router, the whole household benefits. The interface gives you a live dashboard of blocked queries, whitelists, and per-device statistics. This guide walks through a full installation from scratch, covering dependencies, configuration, and the router changes that make it all work.

What You Need Before You Start

The minimum hardware requirement is a Raspberry Pi running Raspberry Pi OS Lite – any model from the Pi 3 onward handles the workload comfortably. Pi-hole is not resource-intensive, which makes it a natural candidate to run alongside other self-hosted services. If you already have a Plex Media Server running on a Raspberry Pi 5, Pi-hole can share that hardware without any meaningful performance cost, though a dedicated device is cleaner for reliability.

You will also need a static IP address assigned to the Pi. If the Pi’s address changes after a router reboot, every device on the network will lose DNS resolution. Set a static IP either through your router’s DHCP reservation table (the preferred method – easier to manage) or by editing /etc/dhcpcd.conf directly on the Pi. Use the router method if possible, since it survives OS reinstalls.

Before running the installer, make sure the system is fully updated. SSH into the Pi and run sudo apt update && sudo apt upgrade -y. The installer pulls packages from the internet, so a current package list prevents version conflicts. You do not need to install anything else manually – the Pi-hole script handles its own dependencies including lighttpd for the web interface and dnsmasq as the underlying DNS forwarder.

Installing Pi-hole

The installation is a single command. Run curl -sSL https://install.pi-hole.net | bash and the script launches an interactive terminal wizard. It will ask you to confirm your static IP, select an upstream DNS provider (Cloudflare at 1.1.1.1 and 1.0.0.1 is a solid default choice for speed and privacy), and choose which default blocklists to enable. Accept the defaults on blocklists for now – you can add more from the admin panel later. The installer finishes by displaying a randomly generated admin password; write it down immediately.

Once installed, open a browser and navigate to http://[your-pi-ip]/admin. The dashboard loads with real-time query logs, a pie chart of blocked versus allowed traffic, and a left-side menu covering settings, blocklists, and whitelisting tools. At this stage Pi-hole is running, but nothing on your network is using it yet. That part requires a change at the router level.

Pointing Your Router to Pi-hole

Every home router has a DNS settings field somewhere in its admin panel – usually under LAN settings, DHCP server settings, or advanced network options. The label varies by manufacturer. What you are looking for is a field called “Primary DNS” or “DNS Server 1.” Replace whatever is currently there with the static IP of your Pi-hole device. Clear the secondary DNS field or set it to a fallback like 1.1.1.1 – though be aware that a secondary DNS means devices will bypass Pi-hole when it is unreachable, which defeats the point.

After saving the router settings, connected devices will receive the new DNS server address on their next DHCP lease renewal. You can speed this up by disconnecting and reconnecting each device, or by running ipconfig /release && ipconfig /renew on Windows machines. Once devices are using Pi-hole as their DNS server, the dashboard query log will start showing traffic almost immediately.

Some devices – certain Android phones, smart speakers, and streaming sticks – use hardcoded DNS servers like 8.8.8.8 and bypass the router’s DNS settings entirely. Pi-hole cannot intercept those queries on its own. The solution is a DNS redirect rule in your router’s firewall, which forces all outbound traffic on port 53 to route through the Pi. Not all consumer routers support this, but those running DD-WRT, OpenWrt, or pfSense do. Without this rule, hardcoded DNS devices will remain unfiltered.

One adjustment worth making early is enabling the query logging detail level. In the Pi-hole admin panel under Settings – Privacy, the default logging level is “Show everything.” That is fine for most home setups, but if you share the network with others and prefer not to log every domain they visit, Pi-hole offers four progressively more private logging modes down to “Anonymous mode,” which still blocks ads but stores no per-client data. The setting takes effect immediately without a restart.

Managing Blocklists and Handling False Positives

The default blocklists cover most advertising and tracking domains, but adding additional sources sharpens coverage significantly. The Pi-hole admin panel has a section called “Adlists” where you paste blocklist URLs. A widely used community-maintained collection is available at https://firebog.net, which organizes lists by category – advertising, tracking, malware, and telemetry – with color-coded recommendations for which are low-risk to add. After adding new lists, run pihole -g from the terminal (or click “Update Gravity” in the admin panel) to pull and compile the new domains.

False positives are inevitable. At some point Pi-hole will block a domain that a legitimate service depends on – a payment processor, a CDN that doubles as an ad network, or a first-party analytics endpoint that the app cannot function without. When something breaks, the query log is the fastest diagnostic tool. Filter the log by the affected device’s IP address and look for red-highlighted blocked queries in the time window when the breakage occurred. The domain name usually makes the cause obvious. Add it to the whitelist with one click directly from the log entry.

Pi-hole also supports regex-based blacklisting for advanced filtering. If you want to block all subdomains of a known tracking parent domain regardless of what the subdomain is, a single regex entry handles that cleanly. The admin panel has a dedicated regex blacklist section under “Domains.” This becomes useful when ad networks rotate subdomains to evade static blocklists – a pattern that is common among video ad networks specifically.

The long-term maintenance load is low. Gravity (Pi-hole’s compiled blocklist database) can be set to update automatically via a cron job – the installer creates one by default that runs weekly. The admin panel periodically shows update notifications for Pi-hole itself, and upgrades run through a single terminal command: pihole -up. The one configuration detail worth revisiting after any major update is the upstream DNS settings, since version upgrades occasionally reset custom resolver options back to defaults.