Guides

Pi-hole or AdGuard Home: block ads on your entire network

Ads and trackers are loaded in the background from known addresses. Pi-hole and AdGuard Home are a kind of phone book that says for all those addresses: “doesn’t exist”. This way no ads come through, on every device in the house, even on a smart TV or in an app where an adblocker doesn’t work. You set it up once and it works for the entire network.

What does it do, and what doesn’t it do?

  • It blocks by domain name (via DNS). An ad that comes from the same address as the content, like many ads on YouTube, will remain.
  • It doesn’t see what’s on a page and doesn’t read encrypted traffic.
  • It can sometimes block too much: a store or app won’t work then. You put that address on the exceptions list (allowlist).

What do you need?

A small computer that’s always on: a Raspberry Pi, a mini PC, an LXC container or VM on Proxmox, or Docker on your NAS. Give it a static IP address, preferably through a reserved address in your router. In a Raspberry Pi this is a nice first project.

Installing Pi-hole

The complete steps to set up Pi-hole on a Raspberry Pi are in our guide Installing Pi-hole. Briefly: you start the official installation script, choose your network card and your upstream DNS server, leave the default blocklist and web management on, and set a password. You’ll then find the management interface at http://IP-address-of-the-pi/admin.

Making your network use it

Pi-hole only works if your devices use it as a DNS server. The nicest way is in your router: look at the DHCP settings and enter the address of Pi-hole as the DNS server. All devices will then get it automatically. If your router can’t do that (some provider boxes), then turn off the router’s DHCP server and let Pi-hole do that job, or set the DNS manually per device.

Test if it works. On your computer:

nslookup doubleclick.net IP-address-of-the-pi

A blocked address often returns 0.0.0.0. In the Pi-hole dashboard you also see how many requests have been blocked. With our DNS lookup you check a domain that you manage yourself.

AdGuard Home as an alternative

AdGuard Home does the same thing with a different approach: one program, a step-by-step installation on port 3000, and built-in support for encrypted DNS (DoH, DoT) to your upstream. It’s easier if you want different rules per device or per person. You can install it with Docker (adguard/adguardhome) or with the script on the project page.

  • Pi-hole: large community, lots of documentation and lists, good on Raspberry Pi.
  • AdGuard Home: simple installation and convenient settings per device.

Watch out

  • It becomes a dependency. If Pi-hole goes down, then internet won’t work anymore for those who use it. For a home network that others rely on, set up a second Pi-hole or a backup DNS.
  • Some browsers bypass it with DNS-over-HTTPS. Turn off secure DNS in the browser or set it to “default” if you want Pi-hole to work.
  • Update on time with pihole -up and refresh the blocklists occasionally.

Sources and attribution

This article is written in our own words. Read more: