Raspberry Pi Network-Wide Ad Blocker (Pi-hole)

Pi-hole is a network-level DNS sinkhole — it intercepts DNS queries from all devices on your network and blocks those matching ad/tracker domain blocklists. Unlike browser extensions, Pi-hole works on every device automatically: phones, smart TVs, IoT devices, and computers, without any per-device configuration. This guide sets up Pi-hole with DNS-over-HTTPS (DoH) upstream using Cloudflare for added privacy.

What You’ll Need

• Raspberry Pi Zero 2 W, Pi 3, or Pi 4 (Pi Zero 2 W handles a home network with ease)
• MicroSD card (8 GB minimum)
• Ethernet connection (preferred) or WiFi
• Static IP assigned to the Pi (configured on router or via Pi itself)
• Router admin access to change DNS server settings

Step-by-Step Instructions

1. Install Raspberry Pi OS Lite: Flash headlessly with WiFi credentials and SSH enabled (via Imager’s advanced options). Boot and SSH in.
2. Set static IP: On the Pi: sudo nano /etc/dhcpcd.conf. Add static IP configuration for eth0 or wlan0. Choose an IP outside your router’s DHCP range (e.g. 192.168.1.2). Reboot.
3. Install Pi-hole: curl -sSL https://install.pi-hole.net | bash. Follow the installer. When prompted for upstream DNS, choose Custom for now (you’ll change this after DoH setup).
4. Set up DNS-over-HTTPS: Install cloudflared: download the arm64 binary from Cloudflare’s releases. Create /etc/default/cloudflared with CLOUDFLARED_OPTS=”–port 5053 –upstream https://1.1.1.1/dns-query”. Enable and start the service.
5. Configure Pi-hole to use cloudflared: Pi-hole admin panel → Settings → DNS → uncheck all upstream servers → add custom DNS 127.0.0.1#5053. Save.
6. Point your router to Pi-hole: In your router’s DHCP settings (usually under LAN settings), set the primary DNS server to Pi-hole’s static IP. All devices getting DHCP addresses will now use Pi-hole automatically.
7. Add blocklists: Pi-hole admin → Adlists → add additional lists from firebog.net (the “ticked” lists are well-curated). Run gravity update (pihole -g) to download.

Safety Notes

• Pi-hole blocks domains, not IPs — some ads served from the same domain as legitimate content won’t be blocked without breaking the content too.
• If a website stops working after Pi-hole, check the query log for recently blocked domains and whitelist if needed.

Tips & Troubleshooting

• Check the Pi-hole dashboard at http://[PI-IP]/admin for a live graph of queries blocked — most home networks see 15–30% of all DNS queries blocked.
• Some smart TV apps use hardcoded Google DNS (8.8.8.8) to bypass Pi-hole. Block 8.8.8.8 on your router to force all DNS traffic through Pi-hole.
• Set up a second Pi-hole on another Pi for redundancy — if the primary goes down, use the second as fallback DNS on your router.