What Is Pi-hole and Why You Should Run One: Block Ads, Stop Trackers, and Take Back Your DNS with Unbound

Every website you visit, every app you open, your device sends out DNS requests. These are like phone calls asking "where does this domain live?" Normally those calls go to your internet provider, Google, or Cloudflare. That means someone else always knows what you are visiting.

Pi-hole fixes that. It runs on a small server on your network, catches every DNS request, and blocks the bad ones before they ever leave your house. No ads. No trackers. No third party watching your lookups.

In this article, I will walk you through what Pi-hole does, how it blocks ads, and how to install it with Unbound so your DNS queries stay completely private.

What Is Pi-hole?

Pi-hole is a free tool that acts as your network's DNS server. When any device on your WiFi wants to visit a website, it asks Pi-hole for the address. Pi-hole checks the request. If the domain is an ad server or a tracker, it blocks it. If it is a normal website, it lets it through.

Here is what makes it powerful:

It works on every device. Phones, laptops, smart TVs, game consoles, Alexa. You do not install anything on each device. It just works.
It blocks ads before they load. Not after they appear. The ad never downloads in the first place.
It is free and open source. No subscriptions, no accounts, no cloud service.

How Does Pi-hole Block Ads?

Think of Pi-hole as a bouncer at a club door.

Your phone wants to load ads.doubleclick.net
The request goes to Pi-hole first
Pi-hole checks its blocklist (a list of known ad and tracker domains)
If the domain is on the list, Pi-hole says "nope, does not exist"
The ad never loads

If the domain is clean (like google.com), Pi-hole passes the request through and returns the real address.

The blocklists are maintained by the community and updated regularly. You add the lists you want, and Pi-hole does the rest.

Why Pi-hole Alone Is Not Enough

Pi-hole blocks bad domains, but your clean requests still go somewhere. If you use Google DNS (8.8.8.8) or Cloudflare (1.1.1.1) as your upstream, those companies still see every domain you visit.

That is where Unbound comes in. Unbound resolves domains itself by talking directly to the root DNS servers. No Google, no Cloudflare, no middleman. Your DNS queries stay on your network.

What You Need

A device that stays on all the time. A Raspberry Pi, a mini PC, an old laptop, or a VPS
Ubuntu or Debian installed on it
Basic comfort with the terminal (I will give you every command)

Step 1: Install Pi-hole

Run this one command:

curl -sSL https://install.pi-hole.net | bash

A setup wizard will appear. Here is what to pick:

Network interface: choose eth0 (or whatever your main one is)
Upstream DNS provider: pick anything for now (we will change it to Unbound later)
Blocklists: keep the default ones checked
Web interface: say yes
lighttpd web server: say yes
Privacy settings: pick "show everything"

When it finishes, it shows you the admin URL and a password. Save both.

Your admin panel will be at http://YOUR-SERVER-IP/admin.

Step 2: Give Pi-hole a Static IP

Pi-hole needs the same IP address every time your server restarts. Otherwise your devices will lose their DNS server.

Edit your network config:

sudo nano /etc/netplan/01-netcfg.yaml

Add this (change the IP and gateway to match your network):

network:
  version: 2
  ethernets:
    eth0:
      addresses:
        - 192.168.2.6/24
      routes:
        - to: default
          via: 192.168.2.1
      nameservers:
        addresses: [127.0.0.1]

Save the file (Ctrl+O, Enter, Ctrl+X), then apply:

sudo netplan apply

Step 3: Install Unbound

sudo apt update
sudo apt install unbound -y

That is it for the install. Now we configure it.

Step 4: Configure Unbound

Create a config file for Pi-hole:

sudo nano /etc/unbound/unbound.conf.d/pi-hole.conf

Paste this entire block:

server:
    verbosity: 0
    interface: 127.0.0.1
    port: 5335
    do-ip4: yes
    do-udp: yes
    do-tcp: yes
    do-ip6: yes
    prefer-ip6: no
    harden-glue: yes
    harden-dnssec-stripped: yes
    use-caps-for-id: no
    edns-buffer-size: 1232
    prefetch: yes
    num-threads: 1
    so-rcvbuf: 1m
    private-address: 192.168.0.0/16
    private-address: 169.254.0.0/16
    private-address: 172.16.0.0/12
    private-address: 10.0.0.0/8
    private-address: fd00::/8
    private-address: fe80::/10

What the important settings do:

port 5335: Unbound listens here so it does not clash with Pi-hole on port 53
127.0.0.1: only Pi-hole can talk to Unbound (nobody else)
harden-dnssec-stripped: blocks fake DNS responses (spoofing protection)
prefetch: caches popular domains so they load faster

Now enable DNSSEC (the anti-spoofing feature):

sudo nano /etc/unbound/unbound.conf.d/root-auto-trust-anchor-file.conf

Add:

server:
    auto-trust-anchor-file: "/var/lib/unbound/root.key"

Restart Unbound and set it to start on boot:

sudo systemctl restart unbound
sudo systemctl enable unbound

Step 5: Connect Pi-hole to Unbound

Open the Pi-hole admin panel in your browser. Go to Settings > DNS.

Under "Upstream DNS Servers", uncheck everything (Google, Cloudflare, etc.) and scroll to the "Custom" fields. Enter:

127.0.0.1#5335

Click Save.

Or edit the config file directly:

sudo nano /etc/pihole/pihole.toml

Find the upstreams line under [dns] and set:

upstreams = ["127.0.0.1#5335"]

Then restart:

pihole restartdns

Step 6: Point Your Router at Pi-hole

This is the step that makes it work for every device on your network.

Log into your router's admin page (usually 192.168.2.1 or 192.168.1.1)
Find the DNS settings (sometimes under DHCP, LAN, or Internet settings)
Set the Primary DNS to your Pi-hole's IP (for example, 192.168.2.6)
Leave Secondary DNS empty

Important: do not add Google or Cloudflare as a secondary. If you do, some of your traffic will skip Pi-hole entirely.

Save the router settings. Every device on your WiFi now uses Pi-hole automatically.

Step 7: Test That It Works

On your Pi-hole server, run these commands:

Test that Unbound resolves domains:

dig pi-hole.net @127.0.0.1 -p 5335

You should see an IP address in the answer.

Test that DNSSEC blocks fake responses:

dig sigfail.verteiltesysteme.net @127.0.0.1 -p 5335

Should return SERVFAIL. That means spoofing protection is working.

Test a clean domain:

dig google.com @127.0.0.1 -p 5335

Should return a normal IP address.

Open the Pi-hole admin panel and check the dashboard. You should see queries coming in and domains being blocked.

Adding Blocklists

Pi-hole comes with one default blocklist (StevenBlack hosts), which is good for basic ad and tracker blocking. But you can add more to cover specific categories.

How to Add a Blocklist

Open your Pi-hole admin panel
Go to Adlists in the left menu
Paste the URL in the "Address" field
Add a comment so you remember what it blocks
Click Add
Go to Tools > Update Gravity and click Update

That is it. The new blocklist is now active.

Recommended Blocklists

Here are the lists I use and recommend. They are grouped by what they block.

Ads and Trackers (base protection):

List	What it blocks
`https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts`	Ads, trackers, malware (default, already included)
`https://blocklistproject.github.io/Lists/ads.txt`	Additional ad servers
`https://blocklistproject.github.io/Lists/tracking.txt`	Tracking domains

Malware and Scam Protection:

List	What it blocks
`https://blocklistproject.github.io/Lists/malware.txt`	Known malware domains
`https://blocklistproject.github.io/Lists/scam.txt`	Scam and phishing sites

Social Media (optional, for parental control):

List	What it blocks
`https://blocklistproject.github.io/Lists/social.txt`	All major social media
`https://blocklistproject.github.io/Lists/tiktok.txt`	TikTok specifically
`https://blocklistproject.github.io/Lists/facebook.txt`	Facebook and its services
`https://blocklistproject.github.io/Lists/twitter.txt`	Twitter/X

Adult Content (for parental control):

List	What it blocks
`https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-gambling-porn/hosts`	Adult content, gambling, fake news
`https://blocklistproject.github.io/Lists/porn.txt`	Pornographic domains

Protecting Kids with Groups

This is one of Pi-hole's best features. You can apply different blocklists to different devices. For example, your kids get strict filtering while you get normal browsing.

Create Groups

Go to Group Management > Groups
Create a group called Kids
Optionally create another called Adults

Assign Devices to Groups

Go to Group Management > Clients
Add the IP address or MAC address of each child's device
Assign it to the Kids group

Assign Blocklists to Groups

Go to Adlists
When adding a blocklist, select which group it applies to
Add the adult content and social media blocklists and assign them to the Kids group only

Now kids' devices cannot reach social media or adult sites, while your devices work normally.

Adding Wildcard Domains for Extra Protection

For tighter control, you can block specific domains with wildcards. Go to Domains in the left menu, select Wildcard as the type, and add entries like:

*.facebook.com
*.instagram.com
*.tiktok.com
*.youtube.com
*.snapchat.com
*.pornhub.com
*.xvideos.com
*.xhamster.com
*.onlyfans.com
*.discord.com
*.twitch.tv

Assign these to the Kids group. The wildcard (*) blocks all subdomains automatically.

What You Get After This Setup

No ads on any device connected to your WiFi
No trackers collecting data from your phone, smart TV, or IoT devices
No third party seeing your DNS lookups (Unbound handles everything)
DNSSEC protection against DNS spoofing attacks
Parental controls with per-device group filtering
A dashboard showing every query, every block, and every domain your devices contact

You will be surprised how many domains your smart TV contacts when it is sitting idle. Pi-hole shows you all of it.

Need Help Setting This Up?

If you want Pi-hole and Unbound running on your network but do not want to deal with the configuration yourself, I can handle it for you. Whether it is a Raspberry Pi, a small server, or a VPS, I will get it set up with the right blocklists and parental controls for your family. Reach out through the contact page and let us talk about your setup.

Frequently Asked Questions

Does Pi-hole block YouTube ads? No. YouTube serves ads from the same domains as its video content, so DNS-level blocking cannot separate them. For YouTube ads, you still need a browser extension like uBlock Origin or YouTube Premium.

Can I run Pi-hole on a Raspberry Pi? Yes, absolutely. A Raspberry Pi 4 or 5 handles Pi-hole and Unbound easily. It uses very little power and runs quietly 24/7. This is the most popular setup.

Will Pi-hole slow down my internet? No. DNS lookups are tiny and fast. Unbound caches results, so frequently visited sites may even load faster than with a public DNS server.

What happens if my Pi-hole server goes down? Your devices lose DNS and cannot reach the internet. The fix is to set up a second Pi-hole as a backup, or accept that you will need to restart the server quickly if it goes offline.

Do I need to install anything on my phone or laptop? No. Once your router points to Pi-hole, every device on the network is covered automatically. Guests, new phones, smart home devices, all of them.

Is Pi-hole free? Yes. Completely free and open source. You only need a device to run it on.

Can I still use a VPN with Pi-hole? Yes. Pi-hole works on your local network. When you connect through a VPN from outside, your traffic goes through the VPN's DNS. If you want VPN users filtered too, assign the VPN client IP to a Pi-hole group.