Installing Pi-hole: block ads and trackers across your entire network

Pi-hole blocks ads and trackers for all devices in your home at once, including on your phone, TV, and smart devices, without having to install anything on each device. It works as a filter for DNS: the name-to-address lookup that every device performs. An address from an advertiser gets the response “does not exist”. A Raspberry Pi is perfect for this because it uses very little power.

What do you need?

• A Raspberry Pi with Raspberry Pi OS Lite, as in Setting up Raspberry Pi for the first time.
• A static IP address for the Pi (see Raspberry Pi as a server). This is important: if the address changes, your entire network will stop accessing the internet.
• Access to your router’s settings.

Step 1: install Pi-hole

Log in to the Pi and run the installation from the makers:

curl -sSL https://install.pi-hole.net | bash

That fetches a script and runs it right away. Read the script first, on the project page, if you want to verify it. The installation asks a few questions:

• Interface: choose your network connection (eth0 for the cable).
• Upstream DNS provider: choose one, for example Quad9 or Cloudflare. Pi-hole sends everything that isn’t blocked here.
• Block list: leave the default list.
• Admin page: turn on web admin interface.
• Log: choose how much you want to keep of what your devices query.

Step 2: set a password

sudo pihole setpassword

Choose a strong password for the admin page. You open it at http://pi.hole/admin or at http://your-pi-ip/admin.

Step 3: make your network use Pi-hole

Pi-hole only works if your devices use it as a DNS server. The best way is in your router:

1. Open your router’s settings.
2. Look for the DNS server for DHCP (sometimes “DNS for LAN” or “local DNS”). Enter your Pi’s IP address there.
3. Don’t leave a second external DNS server, because then devices will sometimes bypass Pi-hole.
4. Restart your devices or disconnect and reconnect the wifi connection, so they fetch the new address.

Your router won’t allow this (some provider routers don’t allow it)? Then you can set the DNS address per device, or turn off your router’s DHCP server and use Pi-hole’s.

Testing

Check on the admin page if queries are coming in and how many are being blocked. Test with an address that’s always blocked:

nslookup doubleclick.net 192.168.1.30

Replace the address at the end with your Pi’s. If you see 0.0.0.0, then blocking is working. You can look up regular names with our DNS lookup.

Good to know

• A site isn’t working anymore? Pi-hole sometimes blocks too much. Check in the log what was blocked and put the domain under Domains on the allowlist.
• More lists can be added under Adlists. Don’t choose too many: then more things will break.
• Updating: pihole -up updates Pi-hole itself and pihole -g the block lists.
• Turning off temporarily: in the admin page you can temporarily disable blocking.
• Browsers that use encrypted DNS (DNS over HTTPS) bypass Pi-hole. Turn off that feature in your browser if you want to catch it.
• Pi-hole uses port 53 (see the port list). Never open it to the internet.

If your Pi goes down, you won’t have internet anymore. Consider a second Pi-hole or explain to your housemates how they can temporarily bypass it.