May 31, 2024 · Networking / Beginner · ~2 MIN READ

Set Up Pi-hole or AdGuard Home for Network-Wide Ad Blocking

Block unwanted domains across your whole network at the DNS level, and lay the groundwork for local DNS records.

Who This Is For

Beginner.

Think of it like a bouncer standing at the door for every website request that comes through your network. Ads and trackers try to get in, and the bouncer just turns them away before they ever reach your screen.

What You’ll Build

Whole-home DNS filtering, plus a foundation for local service names.

Prerequisites

A Raspberry Pi, VM, LXC, or Docker host
Router admin access

Pi-hole vs. AdGuard Home

Pi-hole, straightforward DNS sinkhole with a mature ecosystem of blocklists
AdGuard Home, integrated DNS rewrites and broader DNS controls in one interface

Deploy It

$ services:
$   pihole:
$     image: pihole/pihole:latest
$     ports:
$       - "53:53/tcp"
$       - "53:53/udp"
$       - "8080:80"

Choose a DHCP/DNS Architecture

Router handles DHCP, Pi-hole/AdGuard handles DNS only (simplest)
Pi-hole/AdGuard handles both DHCP and DNS (more control, more to manage)

Point Your Router at It

Set the router’s DHCP DNS option to your Pi-hole/AdGuard Home IP.

Choose an Upstream DNS Provider

Cloudflare (1.1.1.1), Quad9 (9.9.9.9), or your ISP’s resolver are all reasonable choices, pick one with a privacy policy you’re comfortable with.

Allowlist Broken Services

Some apps break under aggressive blocklists, allowlist specific domains as needed rather than disabling blocking entirely.

Add DNS Redundancy

Configure a second DNS server (router fallback, or a second Pi-hole instance) so a single outage doesn’t take down DNS for the whole house.

Security & Backup Notes

A DNS outage takes down internet access for the whole network, redundancy here isn’t optional once family members depend on it

Troubleshooting

Devices bypass DNS, some apps and OSes hardcode DNS servers (DNS-over-HTTPS especially); check device-level settings
Router ignores custom DNS, some ISP routers override DHCP DNS options; you may need router DNS settings changed directly instead
IPv6 DNS bypass, if IPv6 is active, make sure DNS is also handled over DHCPv6/RA
Smart TVs or apps break, allowlist the specific domains rather than disabling blocking network-wide
DNS server outage disrupts the whole network, this is exactly why redundancy matters

Lab Finish Line

Whole-home DNS filtering plus local service names.