Block Ads on Every Device with Pi-hole

Last updated September 2026. Some links on this page may be affiliate links, which means RPi4U may earn a small commission at no extra cost to you.

Pi-hole turns a small Raspberry Pi into a DNS server for your whole home. Every phone, laptop, smart TV and game console asks it for website addresses, and Pi-hole simply refuses to answer for known ad and tracking domains. The result is fewer ads and trackers on every device, with no apps or browser extensions to install.

It makes a great first server project. A Zero 2 W easily handles a typical household and sips power next to your router.

At a glance

Difficulty	Beginner
Time	45 minutes
Works on	Any Pi · Zero 2 W ideal
Parts cost (approx, US)	About $39 (Zero 2 W $15, power supply ~$8, microSD ~$10, case ~$6)

What you need

• Raspberry Pi Zero 2 W (any other Pi works too)
• Micro-USB power supply for the Zero (2.5A, like the official one)
• microSD card, 16GB or larger
• A case for the Zero
• A computer with a microSD card reader to flash the card and connect over SSH
• Access to your router’s admin page (usually a web page or phone app)
• Your Wi-Fi name and password

Step 1: Flash Raspberry Pi OS Lite

Pi-hole runs without a desktop, so use Raspberry Pi OS Lite (64-bit). The current release is based on Debian Trixie. If you have never flashed a card before, follow our first setup guide and come back here. While customizing the image in Raspberry Pi Imager, make sure you:

1. Set a hostname such as pihole.
2. Create a username and a strong password.
3. Enter your Wi-Fi name, password and country (the Zero 2 W has no Ethernet port).
4. Turn on SSH so you can log in from your computer.

Put the card in the Pi, power it up and give it a couple of minutes to boot. Then connect from your computer:

ssh yourusername@pihole.local

Bring the system up to date before installing anything:

sudo apt update && sudo apt full-upgrade -y

Step 2: Give the Pi a fixed address

Every device on your network will be told to send its DNS lookups to the Pi’s IP address. If that address changes, those lookups go nowhere and the internet appears to break. Pi-hole needs an address that never changes, and the official docs note that a DHCP reservation on your router is fine for this.

A reservation is the easiest option because you set it once on the router and leave the Pi alone. First, find the Pi’s current address:

hostname -I

1. Log in to your router’s admin page.
2. Find the list of connected devices or DHCP clients. It is often under LAN, Network or DHCP settings.
3. Pick the device named pihole and choose the option to reserve its address (some routers call it “static lease” or “address reservation”).
4. Save, then reboot the Pi with sudo reboot and confirm it comes back on the same address.

Write the address down. This guide uses 192.168.1.50 as an example, so swap in your own.

Step 3: Install Pi-hole

Pi-hole provides a one-line installer. It installs the current version, Pi-hole v6:

curl -sSL https://install.pi-hole.net | bash

The installer is a series of blue text screens. Use the arrow keys, Space to select and Enter to confirm. Along the way it will:

1. Remind you that Pi-hole is a server and needs a static IP. You already handled that in Step 2, so continue.
2. Ask which network interface to use. On a Zero 2 W pick wlan0.
3. Ask you to choose an upstream DNS provider (see the next step).
4. Offer to add StevenBlack’s Unified Hosts List as a starting blocklist. Say yes.
5. Ask whether to enable query logging and which privacy level to use. Logging is useful for troubleshooting; pick whatever you are comfortable with.

Pi-hole v6 no longer needs a separate web server or PHP. Its web interface and API are built into the pihole-FTL service, which listens on port 80 for HTTP and 443 for HTTPS (it falls back to 8080 and 8443 if something else is already using those ports). Settings now live in a single file, /etc/pihole/pihole.toml, though you rarely need to touch it.

When the installer finishes, it shows the web interface address. If it shows a login password, note it. Either way, set your own password now:

sudo pihole setpassword

Open http://192.168.1.50/admin in a browser and log in. You can also use https://, but expect a certificate warning, because Pi-hole creates its own self-signed certificate that browsers do not trust by default.

Step 4: Choose an upstream DNS provider

Pi-hole only blocks. For everything else it forwards the question to an upstream DNS service. The installer offers several, including Google, OpenDNS, Quad9 and Cloudflare. Quad9 and Cloudflare are popular choices because they focus on privacy, and Quad9’s filtered option also blocks known malicious domains.

You can change this later in the web interface under Settings > DNS by ticking a different provider and saving.

Step 5: Point your network at the Pi

Option A: The router (recommended)

The official recommendation is to have your router tell its DHCP clients to use Pi-hole for DNS. Then every device that joins your network is covered automatically.

1. In your router’s admin page, find the DHCP or LAN settings (not the WAN or internet settings).
2. Set the primary DNS server to your Pi’s address, for example 192.168.1.50.
3. Leave the secondary DNS blank, or set it to the Pi as well. A public server here lets devices skip Pi-hole whenever they like.
4. Save. Devices pick up the change when they renew their connection, so turn Wi-Fi off and on, or restart them.

Option B: One device at a time

Some routers, especially ones supplied by internet providers, do not let you change DNS. You can still set the DNS server by hand on each device. In the Wi-Fi or network settings for your phone, tablet or computer, switch DNS from automatic to manual and enter the Pi’s address.

Step 6: Test that it works

On the Pi, check that blocking is active:

pihole status

From a computer on your network, ask the Pi directly about a well-known ad domain. This works in Windows, macOS and Linux terminals:

nslookup doubleclick.net 192.168.1.50

A blocked domain comes back as 0.0.0.0 (and :: for IPv6), which is Pi-hole’s default way of saying no. Try a normal site such as raspberrypi.com and you should get a real address. Finally, open the dashboard and browse a few sites. The query counters should start climbing within seconds.

Step 7: Add more blocklists

The default list is a solid start. To add another one:

1. In the web interface, open Group Management > Lists.
2. Paste the list’s URL into the address field, add a short comment so you remember what it is, and add it as a block list.
3. Go to Tools > Update Gravity and run the update so Pi-hole downloads the new list.

You can also refresh every list from the command line:

pihole -g

More is not always better. Big stacks of lists tend to break real sites, so add one at a time.

Step 8: Allow a site that broke

Sooner or later a link, shopping cashback or app login will stop working. Pi-hole v6 calls the exception list the allowlist (it used to be the whitelist).

1. Open Query Log and look for blocked entries from the device having trouble around the time it failed.
2. Copy the domain you want to allow, open Group Management > Domains and add it as an allowed domain.
3. Retry the site. You may need to clear the browser cache first.

From the command line, the same thing is one command. Use pihole -q first if you want to see which list is blocking a domain:

pihole -q example.com
pihole allow example.com

Step 9: Keep it updated

Update Pi-hole and the operating system every month or so. Pi-hole’s own updater covers its core, web interface and FTL service:

pihole -up
sudo apt update && sudo apt full-upgrade -y

Optional: Should Pi-hole be your DHCP server?

Pi-hole can hand out IP addresses itself, replacing your router’s DHCP server. Only do this if your router will not let you change the DNS server it gives out. If the Pi goes down, devices cannot get an address at all, which is far worse than losing ad blocking. If you do go this route, turn off DHCP on the router first so the two do not fight, then enable it under Settings > DHCP.

Troubleshooting

• Ads still show everywhere. Check that the router’s secondary DNS is not a public server, then reconnect your devices so they get the new settings.
• The dashboard shows almost no queries. Your router may be advertising its own IPv6 DNS server. Look for an IPv6 DNS option in the router and point it at Pi-hole or turn it off. Some browsers also have a “secure DNS” setting that bypasses Pi-hole.
• The web page will not load. Make sure you included /admin. If port 80 was busy during install, try port 8080.
• Forgot the password. SSH in and run sudo pihole setpassword.
• The whole internet stopped working. The Pi is probably off or changed address. Check it is powered and still on its reserved IP, or temporarily set your router’s DNS back to automatic.

Where to go next

• Want a second Pi project, like a media server? Try Jellyfin on a Raspberry Pi.
• Not sure which board to use for your next build? Our Pi picker narrows it down in a few questions.
• Comparing models and prices? Read the Raspberry Pi buying guide.

Sources: Pi-hole install docs, Pi-hole prerequisites, Pi-hole post-install, pihole command reference, Pi-hole updating, Pi-hole blocking modes, Pi-hole TLS docs, Introducing Pi-hole v6, Raspberry Pi OS documentation