What Is Pi-hole and Why You Should Run One: Block Ads, Stop Trackers, and Take Back Your DNS with Unbound

Every website you visit, every app you open, your device sends out DNS requests. These are like phone calls asking "where does this domain live?" Normally those calls go to your internet provider, Google, or Cloudflare. That means someone else always knows what you are visiting.

I use Pi-hole to filter DNS requests from devices configured to use it. It checks requested domains against my chosen blocklists and blocks matching requests, including many advertising and tracking domains. It cannot block every ad or tracker, and some apps can bypass the configured DNS resolver.

In this article, I explain how Pi-hole filters DNS requests and how Unbound resolves allowed domains without relying on a public recursive DNS provider. This gives me more control over DNS, but it does not make the requests invisible.

What Is Pi-hole?

Pi-hole is a free tool that acts as your network's DNS server. When any device on your WiFi wants to visit a website, it asks Pi-hole for the address. Pi-hole checks the request. If the domain is an ad server or a tracker, it blocks it. If it is a normal website, it lets it through.

Here is what makes it powerful:

It works on every device. Phones, laptops, smart TVs, game consoles, Alexa. You do not install anything on each device. It just works.
It blocks ads before they load. Not after they appear. The ad never downloads in the first place.
It is free and open source. No subscriptions, no accounts, no cloud service.

How Does Pi-hole Block Ads?

Think of Pi-hole as a bouncer at a club door.

Your phone wants to load ads.doubleclick.net
The request goes to Pi-hole first
Pi-hole checks its blocklist (a list of known ad and tracker domains)
If the domain is on the list, Pi-hole says "nope, does not exist"
The ad never loads

If the domain is clean (like google.com), Pi-hole passes the request through and returns the real address.

The blocklists are maintained by the community and updated regularly. You add the lists you want, and Pi-hole does the rest.

Why Pi-hole Alone Is Not Enough

Pi-hole blocks bad domains, but your clean requests still go somewhere. If you use Google DNS (8.8.8.8) or Cloudflare (1.1.1.1) as your upstream, those companies still see every domain you visit.

Unbound contacts root, top-level domain, and authoritative DNS servers to resolve domains and caches the answers locally. Those queries leave my server and are generally unencrypted in a standard recursive setup. I avoid sending all lookups to one public recursive resolver, but network operators and the DNS servers involved can still observe parts of that activity.

What You Need

A device that stays on all the time. A Raspberry Pi, a mini PC, an old laptop, or a VPS
Ubuntu or Debian installed on it
Basic comfort with the terminal (I will give you every command)

Step 1: Install Pi-hole

Run this one command:

curl -sSL https://install.pi-hole.net | bash

A setup wizard will appear. Here is what to pick:

Network interface: choose eth0 (or whatever your main one is)
Upstream DNS provider: pick anything for now (we will change it to Unbound later)
Blocklists: keep the default ones checked
Web interface: say yes
lighttpd web server: say yes
Privacy settings: pick "show everything"

When it finishes, it shows you the admin URL and a password. Save both.

Your admin panel will be at http://YOUR-SERVER-IP/admin.

Step 2: Give Pi-hole a Static IP

Pi-hole needs the same IP address every time your server restarts. Otherwise your devices will lose their DNS server.

Edit your network config:

sudo nano /etc/netplan/01-netcfg.yaml

Add this (change the IP and gateway to match your network):

network:
  version: 2
  ethernets:
    eth0:
      addresses:
        - 192.168.2.6/24
      routes:
        - to: default
          via: 192.168.2.1
      nameservers:
        addresses: [127.0.0.1]

Save the file (Ctrl+O, Enter, Ctrl+X), then apply:

sudo netplan apply

Step 3: Install Unbound

sudo apt update
sudo apt install unbound -y

That is it for the install. Now we configure it.

Step 4: Configure Unbound

Create a config file for Pi-hole:

sudo nano /etc/unbound/unbound.conf.d/pi-hole.conf

Paste this entire block:

server:
    verbosity: 0
    interface: 127.0.0.1
    port: 5335
    do-ip4: yes
    do-udp: yes
    do-tcp: yes
    do-ip6: yes
    prefer-ip6: no
    harden-glue: yes
    harden-dnssec-stripped: yes
    use-caps-for-id: no
    edns-buffer-size: 1232
    prefetch: yes
    num-threads: 1
    so-rcvbuf: 1m
    private-address: 192.168.0.0/16
    private-address: 169.254.0.0/16
    private-address: 172.16.0.0/12
    private-address: 10.0.0.0/8
    private-address: fd00::/8
    private-address: fe80::/10

What the important settings do:

port 5335: Unbound listens here so it does not clash with Pi-hole on port 53
127.0.0.1: only Pi-hole can talk to Unbound (nobody else)
harden-dnssec-stripped: blocks fake DNS responses (spoofing protection)
prefetch: caches popular domains so they load faster

Now enable DNSSEC (the anti-spoofing feature):

sudo nano /etc/unbound/unbound.conf.d/root-auto-trust-anchor-file.conf

Add:

server:
    auto-trust-anchor-file: "/var/lib/unbound/root.key"

Restart Unbound and set it to start on boot:

sudo systemctl restart unbound
sudo systemctl enable unbound

Step 5: Connect Pi-hole to Unbound

Open the Pi-hole admin panel in your browser. Go to Settings > DNS.

Under "Upstream DNS Servers", uncheck everything (Google, Cloudflare, etc.) and scroll to the "Custom" fields. Enter:

127.0.0.1#5335

Click Save.

Or edit the config file directly:

sudo nano /etc/pihole/pihole.toml

Find the upstreams line under [dns] and set:

upstreams = ["127.0.0.1#5335"]

Then restart:

pihole restartdns

Step 6: Point Your Router at Pi-hole

This is the step that makes it work for every device on your network.

Log into your router's admin page (usually 192.168.2.1 or 192.168.1.1)
Find the DNS settings (sometimes under DHCP, LAN, or Internet settings)
Set the Primary DNS to your Pi-hole's IP (for example, 192.168.2.6)
Leave Secondary DNS empty

Important: do not add Google or Cloudflare as a secondary. If you do, some of your traffic will skip Pi-hole entirely.

Save the router settings. Every device on your WiFi now uses Pi-hole automatically.

Step 7: Test That It Works

On your Pi-hole server, run these commands:

Test that Unbound resolves domains:

dig pi-hole.net @127.0.0.1 -p 5335

You should see an IP address in the answer.

Test that DNSSEC blocks fake responses:

dig sigfail.verteiltesysteme.net @127.0.0.1 -p 5335

Should return SERVFAIL. That means spoofing protection is working.

Test a clean domain:

dig google.com @127.0.0.1 -p 5335

Should return a normal IP address.

Open the Pi-hole admin panel and check the dashboard. You should see queries coming in and domains being blocked.

Adding Blocklists

Pi-hole comes with one default blocklist (StevenBlack hosts), which is good for basic ad and tracker blocking. But you can add more to cover specific categories.

How to Add a Blocklist

Open your Pi-hole admin panel
Go to Adlists in the left menu
Paste the URL in the "Address" field
Add a comment so you remember what it blocks
Click Add
Go to Tools > Update Gravity and click Update

That is it. The new blocklist is now active.

Recommended Blocklists

Here are the lists I use and recommend. They are grouped by what they block.

Ads and Trackers (base protection):

List	What it blocks
`https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts`	Ads, trackers, malware (default, already included)
`https://blocklistproject.github.io/Lists/ads.txt`	Additional ad servers
`https://blocklistproject.github.io/Lists/tracking.txt`	Tracking domains

Malware and Scam Protection:

List	What it blocks
`https://blocklistproject.github.io/Lists/malware.txt`	Known malware domains
`https://blocklistproject.github.io/Lists/scam.txt`	Scam and phishing sites

Social Media (optional, for parental control):

List	What it blocks
`https://blocklistproject.github.io/Lists/social.txt`	All major social media
`https://blocklistproject.github.io/Lists/tiktok.txt`	TikTok specifically
`https://blocklistproject.github.io/Lists/facebook.txt`	Facebook and its services
`https://blocklistproject.github.io/Lists/twitter.txt`	Twitter/X

Adult Content (for parental control):

List	What it blocks
`https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-gambling-porn/hosts`	Adult content, gambling, fake news
`https://blocklistproject.github.io/Lists/porn.txt`	Pornographic domains

Protecting Kids with Groups

This is one of Pi-hole's best features. You can apply different blocklists to different devices. For example, your kids get strict filtering while you get normal browsing.

Create Groups

Go to Group Management > Groups
Create a group called Kids
Optionally create another called Adults

Assign Devices to Groups

Go to Group Management > Clients
Add the IP address or MAC address of each child's device
Assign it to the Kids group

Assign Blocklists to Groups

Go to Adlists
When adding a blocklist, select which group it applies to
Add the adult content and social media blocklists and assign them to the Kids group only

Devices in the Kids group now receive the selected DNS filtering rules. These rules can reduce access to listed domains, but they are not comprehensive parental controls and can be bypassed.

Adding Wildcard Domains for Extra Protection

For tighter control, you can block specific domains with wildcards. Go to Domains in the left menu, select Wildcard as the type, and add entries like:

*.facebook.com
*.instagram.com
*.tiktok.com
*.youtube.com
*.snapchat.com
*.pornhub.com
*.xvideos.com
*.xhamster.com
*.onlyfans.com
*.discord.com
*.twitch.tv

Assign these to the Kids group. The wildcard (*) blocks all subdomains automatically.

What You Get After This Setup

Filtering of many advertising and tracking domains for devices that use Pi-hole.
Less reliance on a public recursive DNS provider when Pi-hole uses Unbound.
DNSSEC validation for signed domains when correctly configured. This checks authenticity, not confidentiality.
Optional per-device filtering rules. These are an additional safeguard, not a guarantee that children cannot bypass restrictions.
Visibility into the queries Pi-hole receives, subject to the logging and privacy settings I choose.

You will be surprised how many domains your smart TV contacts when it is sitting idle. Pi-hole shows the DNS requests it receives, not every connection or activity.

Need Help Setting This Up?

If you want Pi-hole and Unbound running on your network but do not want to deal with the configuration yourself, I can handle it for you. Whether it is a Raspberry Pi, a small server, or a VPS, I will get it set up with the right blocklists and parental controls for your family. Reach out through the contact page and let us talk about your setup.

Frequently Asked Questions

Does Pi-hole block YouTube ads? No. YouTube serves ads from the same domains as its video content, so DNS-level blocking cannot separate them. For YouTube ads, you still need a browser extension like uBlock Origin or YouTube Premium.

Can I run Pi-hole on a Raspberry Pi? Yes, absolutely. A Raspberry Pi 4 or 5 handles Pi-hole and Unbound easily. It uses very little power and runs quietly 24/7. This is the most popular setup.

Will Pi-hole slow down my internet? Pi-hole usually has a small overhead, and Unbound caches answers. Uncached recursive lookups may take longer than using a public resolver, so performance depends on the server and network.

What happens if my Pi-hole server goes down? Your devices lose DNS and cannot reach the internet. The fix is to set up a second Pi-hole as a backup, or accept that you will need to restart the server quickly if it goes offline.

Do I need to install anything on my phone or laptop? Usually, devices that accept the router's DNS settings can use Pi-hole without additional software. Apps with their own DNS, VPNs, and devices with manual settings may bypass it.

Is Pi-hole free? Yes. Completely free and open source. You only need a device to run it on.

Can I still use a VPN with Pi-hole? Yes. Configure VPN clients to use Pi-hole through the tunnel, allow DNS only from authorised networks, and test for bypasses. Group assignment controls filtering policy but does not configure DNS routing.