Every app, website, smart TV, and phone on your network starts almost every connection with a DNS lookup. That makes DNS one of the few places where you can see, and control, what all your devices are talking to. Pi-hole sits at that point: it answers DNS for your whole network and refuses to resolve domains you have decided you don't want.

This guide explains what Pi-hole does, why so many people run it on a Raspberry Pi, how to set it up, and what keeping it running involves.

What Pi-hole does

Pi-hole is a DNS sinkhole. When a device asks "what is the address of ads.example.com?", Pi-hole checks the name against its blocklists. If it matches, Pi-hole returns an empty answer and the connection never starts. If it doesn't match, Pi-hole forwards the question to an upstream DNS server and passes the answer back.

This gives you three things:

• Network-wide blocking. Ad, tracker, and telemetry domains are blocked for every device, including ones where you can't install a blocker, such as smart TVs, consoles, and IoT gadgets.
• Visibility. The dashboard shows which devices are making queries, which domains are asked for most, and what is being blocked.
• Control. You can add your own blocklists, allow-list domains that break things, apply different rules to different devices or groups, and block categories of domains.

Blocking at DNS level also saves some bandwidth and speeds up page loads, since blocked content is never fetched.

Why a Raspberry Pi?

Pi-hole is light. It needs very little CPU and memory, and it should run all day and night, so a small, silent, low-power computer is a natural fit.

• Low power. A Raspberry Pi uses a few watts, so running it 24/7 costs very little.
• Silent and small. No fans, and it fits next to your router.
• Inexpensive. Any model from the Pi Zero W / Zero 2 W up to the Pi 5 can run Pi-hole. A Pi 3 or newer is a comfortable choice, especially if you add Unbound or have many devices.
• Supported platform. Pi-hole officially supports Raspberry Pi OS and other Debian-based systems.

One thing to keep in mind: once the Pi is your network's DNS server, you are also its administrator. The hardware is cheap, but the time you spend on it is the real cost, and the sections below show where that time goes. Use Ethernet if you can, because DNS is latency-sensitive and a wired connection is more reliable than Wi-Fi.

What you need

• A Raspberry Pi with a power supply
• A good-quality microSD card (8 GB or more), or an SSD/USB boot if your Pi supports it
• An Ethernet cable (recommended)
• Access to your router's admin page
• Another computer to flash the SD card
• An hour or two for a first-time setup, a little more if your router's menus are unfamiliar

Step 1: Install the operating system

1. Download Raspberry Pi Imager from raspberrypi.com.
2. Choose your Pi model and select Raspberry Pi OS Lite (64-bit). You don't need a desktop.
3. Open the advanced settings and set a hostname (for example pihole), enable SSH, set a username and a strong password, and enter your Wi-Fi details only if you can't use Ethernet.
4. Write the card, put it in the Pi, and power it on.

After a minute or two, connect over SSH:

ssh youruser@pihole.local

Then bring the system up to date:

sudo apt update && sudo apt full-upgrade -y

Step 2: Give the Pi a fixed IP address

Pi-hole is your network's DNS server, so its address must never change. The cleanest way is a DHCP reservation on your router: find the Pi in the router's device list and assign it a permanent address, such as 192.168.1.2. Note this address, because you will use it in the next steps.

Router menus differ a lot between brands and ISPs, so the exact clicks vary. If you can't find the option, your router's manual or support page is the place to look.

Step 3: Install Pi-hole

Pi-hole's official installer is a single command:

curl -sSL https://install.pi-hole.net | bash

If you prefer to read a script before running it, download it first, inspect it, then run it. The installer is interactive and asks you to:

• confirm the network interface (usually eth0)
• choose an upstream DNS provider (you can change this later)
• accept the default blocklist
• confirm whether to install the web interface and enable query logging

When it finishes, it shows the dashboard address. Set the admin password with:

pihole setpassword

Then open http://pihole.local/admin or http://<the-pi-ip>/admin in a browser.

Note: Pi-hole 6 changed several things, including the built-in web server and the settings file layout. If a guide you find online mentions commands such as pihole -a -p, it was written for version 5. Check docs.pi-hole.net for your version.

Step 4: Point your network at Pi-hole

Pi-hole only helps for devices that ask it. You have two main options:

• Router-wide (best for most homes). In your router's DHCP settings, set the DNS server handed out to clients to the Pi's IP address. Devices pick it up when they renew their lease or reconnect.
• Per device. Set the DNS server manually on a single phone or laptop. This is good for testing before you switch the whole network.

Some ISP routers lock the DHCP DNS setting. In that case you can turn off the router's DHCP server and let Pi-hole's own DHCP server handle it instead, with only one DHCP server active at a time.

Avoid adding a second public DNS server as a "backup" on the router. Devices may use either one, and anything that goes to the backup bypasses your blocking.

Step 5: Check that it works

On any device using Pi-hole, run:

nslookup doubleclick.net

A blocked domain returns 0.0.0.0 (or an empty answer, depending on your blocking mode). The dashboard's Queries page should show the request. If nothing appears, the device is still using a different DNS server.

Step 6: Keep it running well

Once Pi-hole is live, it becomes part of your household's internet, so it's worth giving it a little regular care:

• Tune the blocklists. Start with the default and add slowly, since large lists raise the chance of breaking sites.
• Allow-list what breaks. If a site or app fails, check the query log, find the blocked domain, and allow it. Expect a few of these in the first weeks.
• Use groups. You can apply stricter blocking to a child's tablet or looser rules to a work laptop.
• Update regularly. Run pihole -up to update Pi-hole, pihole -g to refresh blocklists, and sudo apt update && sudo apt upgrade for the OS.
• Back it up. Use Settings → Teleporter to export your configuration so you can restore it after a failure.
• Look after the storage. Constant database writes wear out cheap SD cards, so use a quality card or an SSD and keep query log retention modest.

None of this is difficult, but it is ongoing, and it is the part people tend to underestimate when they first buy the Pi.

Going further: resolve DNS yourself with Unbound

By default, Pi-hole forwards allowed queries to a public resolver such as Cloudflare, Google, or Quad9. That resolver sees every domain you look up. If you would rather not trust one company with that, you can install Unbound, a recursive resolver that walks the DNS tree from the root servers itself and validates DNSSEC signatures.

The basic idea is to install Unbound on the same Pi, make it listen on 127.0.0.1 port 5335, then in Pi-hole go to Settings → DNS, untick the public upstreams, and add 127.0.0.1#5335 as a custom upstream. The Pi-hole documentation includes a maintained Unbound guide with the recommended configuration, and following it is safer than copying a config from elsewhere.

The trade-off: the first lookup of a domain can be a little slower, and authoritative servers see your home IP address, though none of them sees your full browsing profile.

The next step most people want is encrypted DNS that also works when they're away from home. That means putting a TLS proxy such as nginx, stunnel, or dnsdist in front of Pi-hole, getting a certificate for a hostname you own, renewing it, and opening the right firewall ports. It is doable, and it is also the point where many home setups stall. If you'd like the same Pi-hole + Unbound design without building and maintaining that layer, NxValue Stack provisions a private node for you, with DoH and DoT endpoints generated so you paste one hostname into your phone's Private DNS setting. You can try the demo node to see how it compares.

Good to know

Pi-hole is a focused tool, and it helps to know where its edges are:

• Ads from the same domain as the content. Video ads on YouTube or Twitch can't be separated at DNS level, so a browser extension is a good companion.
• Your ISP can still see where you connect. Pi-hole is not a VPN, so IP addresses you connect to remain visible to your ISP.
• Some devices use their own DNS. Certain smart TVs, apps, and browsers have hard-coded DNS servers or their own DNS-over-HTTPS. Blocking or redirecting outbound DNS at the router catches these, if your router allows it.
• DNS is plain by default. Traffic between your devices and Pi-hole, and between Pi-hole and a forwarding upstream, is unencrypted unless you add extra components.
• One Pi means one point of failure. If it is off, DNS is off for the household. A second Pi-hole as a secondary DNS server covers this.
• Keep it off the public internet. Don't port-forward port 53 to it, because an open resolver can be abused for DDoS amplification. Use a VPN such as WireGuard for remote access.
• It complements, not replaces, security basics. Updates, a firewall, and good habits still matter.

Summary

• Pi-hole blocks ad, tracker, and telemetry domains for every device on your network, and shows you what your devices are doing.
• A Raspberry Pi is an inexpensive, quiet, low-power home for it, as long as you're happy to be its administrator.
• Setup takes four things: flash the OS, reserve a fixed IP, run the installer, and point your router's DHCP DNS at the Pi.
• Add Unbound if you want to stop sending your lookups to a public resolver.
• Treat it as one layer in a privacy setup, not the whole thing.

Pi-hole is a registered trademark of Pi-hole LLC. Raspberry Pi is a trademark of Raspberry Pi Ltd. NxValue Stack is an independent service provider and is not affiliated with Pi-hole LLC or Raspberry Pi Ltd.