How to Set Up Pi-hole for Network-Wide Ad Blocking

01. What Is Pi-hole?

Pi-hole is a DNS-level ad blocker. Instead of installing an ad-blocker extension inside every browser on every device (which does nothing for smart TVs, game consoles, or mobile apps that grind through ads), Pi-hole sits at the DNS level of your network. Every device that asks "where is this ad served from?" gets the answer "nowhere" and the ad simply never loads.

Because it works at the DNS layer there is nothing to install on your phone, laptop, tablet, smart TV, or streaming box. You change one setting on your router, and every device on the network is protected instantly. It is fast, free, and self-hosted -- you own the data and the logs never leave your home.

What you get with Pi-hole

• •Network-wide protection. One setup, every device covered automatically.
• •Faster browsing. Ads never download in the first place, so pages load with less junk.
• •Privacy. Tracking domains are blocked at the source before any request leaves your home.
• •A dashboard. See exactly what is being blocked, on which device, in real time.
• •Total control. Whitelist anything that breaks, swap blocklists in and out at will.

Step 1. Gather Your Requirements

Pi-hole is lightweight. It runs happily on a $35 Raspberry Pi 4 (or even a Pi 3) and uses virtually no CPU and only a few hundred megabytes of RAM. You have three practical options for the host machine.

1. 1. A Raspberry Pi (recommended). A Pi 3B or newer is plenty. Add a spare microSD card (16GB or larger) and a power supply. This is the classic Pi-hole setup because the Pi is silent, low-power, and can run 24/7 in a drawer.
2. 2. Any Linux server or mini PC. An old laptop, a NUC, a home lab box, or a VPS you already pay for. Anything that runs Linux and Docker will do.
3. 3. A NAS appliance. Many QNAP, Synology, and Unraid setups support Docker containers, so you can drop Pi-hole next to your file shares.

What else you need

• •Docker installed on the host -- see the Docker install guide if you do not have it yet.
• •Access to your router's admin panel so you can change the DNS servers handed out by DHCP.
• •A static (or reserved) IP address for the Pi-hole host, so devices on the network keep pointing at it after a reboot.
• •A laptop or phone on the same network for testing once you are done.

Step 2. Install Pi-hole With Docker

The cleanest way to run Pi-hole is inside a Docker container. The official image bundles everything -- the DNS server, the web admin, the blocklist updater -- so you do not have to install dnsmasq, lighttpd or any other dependencies by hand. One command and you are running.

Run this command on the host machine (SSH in or open a terminal):

What each flag does

• -dRun the container in the background (detached).
• --name piholeGive the container a friendly name so you can manage it easily.
• -e TZ=Europe/LondonSet the timezone so log timestamps and the dashboard clock are correct. Swap in your own timezone.
• -v pihole:/etc/piholePersist Pi-hole's own config and database so nothing is lost when the container updates.
• -v dnsmasq:/etc/dnsmasq.dPersist the dnsmasq config directory (blocklist sources, custom DNS rules).
• --restart=unless-stoppedAutomatically restart Pi-hole after a reboot or a crash, unless you explicitly stop it.
• -p 53:53/tcp -p 53:53/udpPublish the DNS port (both TCP and UDP) so devices on the network can query it.
• -p 80:80Publish port 80 for the web admin dashboard.
• pihole/piholeThe official Pi-hole image, pulled from Docker Hub automatically on first run.

If port 53 is already in use

Many Linux distributions ship with systemd-resolved listening on port 53, which conflicts with Pi-hole. Disable it with:

Step 3. Set the Admin Password

Out of the box the Pi-hole admin web interface is open to anyone on your local network. That is fine for some home setups, but it is much better practice to lock it behind a password so that no one -- including a curious smart TV firmware update -- can change your blocklists.

Set a password for the admin dashboard:

You will be prompted to type and then confirm a password. The password is stored hashed inside the container's config volume. From now on, anyone visiting the admin dashboard will need these credentials to log in and change settings.

1. 1.Run the command above on the host.
2. 2.Type a strong password (12+ characters, a mix of letters, numbers, and symbols) when prompted.
3. 3.Confirm the password by typing it again.
4. 4.Store the password in a password manager -- there is no easy reset if you forget it.

To change the password later

Passing the new password as an argument skips the interactive prompt, which is useful in scripts or when you want to rotate the password on a schedule.

Step 4. Point Your Router's DNS at Pi-hole

This is the step that turns Pi-hole from a single-machine tool into a network-wide ad blocker. By changing the DNS server your router hands out via DHCP, every device on the network -- phones, laptops, tablets, smart bulbs, streaming sticks -- will start resolving DNS through Pi-hole automatically.

1. 1.Find your Pi-hole's IP address. Run docker inspect pihole on the host, or just check the Pi's own IP with ip addr. Write it down -- something like 192.168.1.50.
2. 2.Log in to your router's admin page. Usually http://192.168.1.1 or http://192.168.0.1 in a browser. The exact address and login are printed on a sticker on the router itself.
3. 3.Find the DHCP / LAN settings section. Different router brands call this different things: "Local Network", "DHCP Server", "LAN Setup", or "Advanced Network". Look for a field labelled "DNS Server" or "Primary DNS".
4. 4.Set the primary DNS to your Pi-hole's IP. Leave the secondary DNS blank, or set it to a known-good public resolver like 1.1.1.1 as a fallback (only used if the Pi-hole is down).
5. 5.Save and apply. The router will usually restart its DHCP service. You do not need to reboot the router, but it helps to do so on some models.
6. 6.Reconnect devices (toggle Wi-Fi off/on or reboot) so they pick up the new DNS server from DHCP.

Confirm devices are using Pi-hole

On any device on the network, visit a known ad-heavy site or check with a DNS-leak test. Ads that used to grind the page to a halt should now load instantly or quietly disappear. The Pi-hole dashboard will show live query counts climbing as devices start using it.

On routers that do not let you change DNS

Some ISP-supplied routers lock the DNS field. If yours does, the workaround is to disable the router's own DHCP server and let Pi-hole hand out IP addresses (and itself as the DNS server) instead. Pi-hole has a built-in DHCP server you can turn on under Settings → DHCP in the admin dashboard.

Step 5. Access the Admin Dashboard

The dashboard is where Pi-hole becomes fun. You can see live queries flooding in from every device on the network, watch ads get blocked in real time, and figure out exactly which devices are pinging trackers at 3am.

Open the admin panel in a browser:

For example, if your Pi-hole is at 192.168.1.50, the dashboard URL is http://192.168.1.50/admin/. Bookmark it.

1. 1.Click "Login" in the top-right and enter the password you set in Step 3.
2. 2.Land on the main dashboard. The big number tiles at the top show Total Queries, Blocked Queries, Percentage Blocked, and Domains on the blocklist.
3. 3.Scroll down to the graphs. The query log shows the most recent DNS requests, flagged green if allowed or red if blocked, with the source device IP and the requested domain.
4. 4.Use the top-of-page queries menu to filter by client device, by blocked-only, or by time range. This is how you spot a single rogue app grinding through tracker calls.
5. 5.Watch the live "Recent Queries" feed on the dashboard to confirm ads are being blocked. The percentage bar should climb above 10% for most home networks within the first hour.

Reading the query log

The Query Log is the heart of troubleshooting. Every DNS request from every device is listed with:

• •Time -- when the request was made.
• •Domain -- the host that was being looked up (e.g. ads.doubleclick.net).
• •Client -- the IP of the device that made the request.
• •Status -- OK (allowed), Blocked (by blocklist), or Cached (answered from Pi-hole's cache).
• •Action buttons -- one-click whitelist or blacklist from the row itself.