Posted inHomeLab

Pi-hole: Set Up Network-Wide Ad Blocking in Your Home Lab

HomeLab tutorial - IT technology blog
HomeLab tutorial - IT technology blog

My home network used to be a mess of ads — smart TVs nagging me with banners, game consoles phoning home, IoT devices doing who-knows-what. Browser extensions don’t help there. Then I stood up Pi-hole, and it’s one of the best hours I’ve ever spent in the home lab. One box, one config, everything covered.

Approach Comparison: Ways to Block Ads

Before committing to a setup, it’s worth knowing what your options actually are — and where each one falls short.

Browser Extensions (uBlock Origin, AdBlock)

The go-to for desktop users. Works well on browsers you control, but does absolutely nothing for smart TVs, game consoles, phones without root, or any IoT device. Every new device needs manual setup. No network-level visibility either.

Router-Level Blocking (OpenWrt, pfSense + pfBlockerNG)

Already running pfSense or OpenWrt? pfBlockerNG gets you close to Pi-hole’s functionality. But it’s more complex to configure, the UI is rougher, and you’re tying ad-blocking tightly to your router — which you’d rather not be rebooting for DNS tweaks.

Cloud DNS Filtering (NextDNS, AdGuard DNS)

Services like NextDNS give you similar blocking without dedicated hardware. Convenient, but your DNS queries go through their infrastructure. It’s a real privacy trade-off, and you’re dependent on their uptime. For a home lab where self-hosting is the point, that feels like giving up.

Pi-hole

A self-hosted DNS sinkhole. Every device on your network uses it as their DNS resolver. When a device tries to look up an ad domain, Pi-hole returns nothing — the request never leaves your network. One setup, zero per-device configuration, full query logging.

Pros and Cons

What Pi-hole Does Well

  • Network-wide coverage — every device, including smart TVs, consoles, printers, and IoT sensors
  • No per-device config — point your router’s DHCP to Pi-hole and you’re done
  • Query dashboard — real-time stats on blocked queries, top clients, top domains
  • Custom blocklists — pull in StevenBlack, Firebog, or any hosts file
  • Easy whitelisting — one command when something gets incorrectly blocked
  • Cheap to run — a Raspberry Pi Zero 2W handles a home network with headroom to spare
  • Optional DHCP server — replace your router’s DHCP for per-client hostname visibility

Where It Falls Short

  • Single point of failure — if Pi-hole goes down without a fallback DNS, your whole network loses DNS
  • YouTube ads survive — Google serves ads from the same domains as content; DNS blocking can’t distinguish them
  • Hardcoded DNS bypass — some apps (certain Google services) ignore DHCP DNS and use hardcoded IPs like 8.8.8.8
  • Maintenance overhead — blocklist updates, occasional whitelist tuning when something breaks
  • VPN bypass — devices connected to a VPN tunnel their DNS through it, bypassing Pi-hole

Recommended Setup

Here’s the setup I landed on after a few iterations — including one evening where Pi-hole took an update reboot and knocked out DNS for the entire network. Redundancy isn’t optional.

Hardware

A Raspberry Pi 4 (2GB) is the comfortable choice. Fast, quiet, low power, and you probably already have one. A Pi Zero 2W handles DNS for a household just fine if power draw matters. Alternatively, any Linux box or VM works — I’ve run it in an LXC container on Proxmox for two years without issues.

Docker vs. Native Install

Already running Docker on the host? Use Docker Compose. Updates shrink to a single docker compose pull && docker compose up -d, and your config stays version-controlled. If you want the simplest possible setup on a dedicated Pi, the native installer is fine and takes five minutes.

Redundancy

Always configure your router with two DNS servers: Pi-hole as primary, a public resolver (1.1.1.1 or 8.8.8.8) as secondary. When Pi-hole reboots for updates, DNS falls back automatically. For higher availability, run two Pi-hole instances synced with Gravity Sync.

Implementation Guide

Option 1: Native Install on Raspberry Pi OS

Flash Raspberry Pi OS Lite, SSH in, then run:

curl -sSL https://install.pi-hole.net | bash

The interactive installer walks you through interface selection, upstream DNS, and blocklists. At the end it prints your admin URL and password. Done.

Option 2: Docker Compose (Recommended for Home Lab)

Create a working directory and drop in a docker-compose.yml:

services:
  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "80:80/tcp"
    environment:
      TZ: "America/New_York"
      WEBPASSWORD: "your_secure_password_here"
    volumes:
      - "./etc-pihole:/etc/pihole"
      - "./etc-dnsmasq.d:/etc/dnsmasq.d"
    restart: unless-stopped
    dns:
      - 127.0.0.1
      - 1.1.1.1
docker compose up -d

Access the admin panel at http://<your-pi-ip>/admin.

Ubuntu users — port 53 is held by systemd-resolved by default. Free it first:

sudo systemctl disable --now systemd-resolved
sudo rm /etc/resolv.conf
echo "nameserver 1.1.1.1" | sudo tee /etc/resolv.conf

Point Your Router at Pi-hole

Log into your router admin panel, find DHCP settings, and set:

  1. Primary DNS → your Pi-hole’s static IP (e.g., 192.168.1.100)
  2. Secondary DNS → 1.1.1.1 as fallback

Save and let devices renew their leases, or reconnect them manually. Within a minute, all DNS traffic flows through Pi-hole.

Add Better Blocklists

The default list is a reasonable start, but the real coverage comes from community-maintained lists. Go to Adlists in the admin panel and add these — StevenBlack’s combined list alone covers ~170,000 known ad and tracker domains:

https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://v.firebog.net/hosts/AdguardDNS.txt
https://v.firebog.net/hosts/Easylist.txt
https://v.firebog.net/hosts/Easyprivacy.txt

Then update gravity to pull them in:

# Native install
pihole -g

# Docker
docker exec pihole pihole -g

Whitelist Broken Domains

When something stops working, check the Query Log in the dashboard. Filter by the client IP and look for blocked entries. Whitelist what shouldn’t be blocked:

# Native
pihole -w example.com

# Docker
docker exec pihole pihole -w example.com

Keeping Pi-hole Updated

# Native install
pihole -up

# Docker — pull new image and recreate
docker compose pull
docker compose up -d

What to Expect After a Week

On a typical home network, Pi-hole blocks 15–25% of all DNS queries. Networks with smart TVs, Android boxes, and a bunch of IoT devices often hit 35–45%. That’s not just ads — it’s telemetry, analytics pings, and background check-ins that were quietly happening all along, now just gone.

The query log is eye-opening. My Samsung TV makes over 300 DNS requests per hour while idle, many pointing straight at Samsung’s ad infrastructure. Printers checking for updates constantly. Apps pinging analytics endpoints every few minutes. It’s all in there. Once you see what your devices are actually doing, Pi-hole becomes a permanent fixture in the lab.

Share:
Tags: