Pi-hole Setup: Network-Wide Ad Blocking

What You Need

• Any Pi (even a Zero 2 W handles this fine — it's lightweight)
• A static local IP for the Pi — set this in your router's DHCP reservation list, not on the Pi itself, so it survives re-flashes

Install

curl -sSL https://install.pi-hole.net | bash

The installer walks you through picking your upstream DNS (Cloudflare 1.1.1.1 or Quad9 9.9.9.9 are solid privacy-respecting choices), and which blocklists to subscribe to. Accept the defaults on first run — you can tune blocklists later from the admin UI.

Point Your Network at It

Two ways to do this, pick one:

• Router-level (recommended): In your router's DHCP settings, set the DNS server handed out to clients to the Pi's IP. Every device on the network gets ad-blocking automatically, no per-device setup.
• Per-device: Manually set DNS on individual devices to the Pi's IP. Useful for testing before you commit at the router level.

Verify It's Working

dig doubleclick.net @<pi-ip>

You should get 0.0.0.0 back instead of a real IP. The admin dashboard at http://<pi-ip>/admin shows live query stats — you'll be surprised how many requests get blocked in the first hour.

Redundancy

If the Pi goes down, your whole network loses DNS. Two options: run a second Pi-hole as a backup DNS server (most routers let you specify a secondary DNS), or set your router's secondary DNS to a public resolver like 1.1.1.1 as a fallback — you lose ad-blocking during an outage but keep internet access.

Common Gotchas

• Some smart TVs and IoT devices hardcode their own DNS (usually 8.8.8.8) and ignore DHCP-assigned DNS — you'll need to block outbound port 53 to anything but the Pi at the router/firewall level to force them through.
• DNS-over-HTTPS in browsers (Firefox especially) bypasses Pi-hole entirely unless disabled in browser settings, since it doesn't use your network's DNS server at all.