Set Up Pi-hole on a Raspberry Pi (Ad Blocker)
Block ads and trackers on every device in your home with Pi-hole on a Raspberry Pi, a network-wide DNS filter set up in 20 minutes.
Browser ad blockers protect one browser on one device. Pi-hole protects everything: the smart TV that has no extension slot, the phone that shows ads in free apps, the console, the guest's laptop. It does this at the DNS level on a Raspberry Pi that costs less than a video game, and the whole thing takes about 20 minutes.
Quick answer
To run Pi-hole, flash Raspberry Pi OS Lite to a microSD card (enable SSH in the Imager), give the Pi a static IP via a DHCP reservation in your router, then install with one command: curl -sSL https://install.pi-hole.net | bash. Pick an upstream DNS provider like Cloudflare (1.1.1.1), accept the default block lists, and finally set your router's DNS to the Pi's IP so every device is covered automatically. A Pi Zero 2 W is enough hardware.
This guide walks through flashing the OS, installing Pi-hole, and pointing your router at it.
Key takeaways
- Pi-hole filters ads and trackers network-wide via DNS, covering every device.
- A Pi Zero 2 W is plenty; a Pi 4 leaves headroom for extras.
- Give the Pi a static IP so devices can always reach it.
- Install with a single command, then choose an upstream DNS provider.
- Point your router's DNS at the Pi to cover the whole network at once.
Prepare the Raspberry Pi
Flash Raspberry Pi OS Lite onto a microSD card using the Raspberry Pi Imager. In the Imager's OS customization screen, enable SSH, set a hostname, and add your Wi-Fi details if you are not using Ethernet. Boot the Pi and connect to it over SSH, then update it with sudo apt update && sudo apt upgrade.
Not sure which board to buy? Here is how the common options stack up for a Pi-hole that just blocks ads:
| Board | Approx. price | Good for | Notes |
|---|---|---|---|
| Pi Zero 2 W | ~$15 | A typical home network | Tiny, low power, Wi-Fi only |
| Pi 4 (2GB) | ~$45 | Pi-hole plus a few extras | Ethernet, more headroom |
| Pi 5 (4GB) | ~$60 | Pi-hole, Unbound, and more services | Overkill for ad blocking alone |
| Old Pi 3 you own | $0 | Reusing hardware | Perfectly capable; use Ethernet if possible |
For ad blocking alone, the cheapest option on the list is plenty. Spend more only if you plan to run other services on the same box.
Give the Pi a static IP
Pi-hole must always be reachable at the same address, so reserve its IP. The easiest method is in your router: find the Raspberry Pi in the DHCP client list and create a reservation tying its current IP to its MAC address permanently. Note that IP; you will need it.
Install Pi-hole
- On the Pi, run
curl -sSL https://install.pi-hole.net | bash. - Follow the prompts and confirm the static IP you reserved.
- Choose an upstream DNS provider (Cloudflare's 1.1.1.1, or 1.1.1.3 for malware and adult-content filtering).
- Accept the default block lists.
- Note the admin password shown at the end; you will need it for the dashboard.
After install, open http://your-pi-ip/admin in a browser to reach the Pi-hole dashboard, where you can see blocked queries and manage settings.
The upstream DNS provider you pick is the resolver Pi-hole forwards allowed queries to. Here are the common choices:
| Upstream DNS | Address | Why pick it |
|---|---|---|
| Cloudflare | 1.1.1.1 | Fast, privacy-focused, no logging of personal data |
| Cloudflare (filtered) | 1.1.1.3 | Adds malware and adult-content blocking |
| Quad9 | 9.9.9.9 | Blocks known malicious domains |
| 8.8.8.8 | Very reliable, but it is Google seeing your queries | |
| Your own (Unbound) | local recursive | Maximum privacy, more setup |
Tip
Test it on one device first: set that device's DNS to the Pi's IP and confirm pages load with fewer ads before switching your whole network over.
Point your router at the Pi
To cover every device automatically, log in to your router and change its DNS server to the Pi's IP address. Now every device that gets its network settings from the router uses Pi-hole, with no per-device setup. If your router will not let you change DNS, you can set the Pi's IP as DNS on individual devices instead.
Keep it healthy
Pi-hole needs little maintenance: update it occasionally with pihole -up, and check the dashboard if a site breaks (rarely, a block list catches something you need, which you whitelist in one click). Because it sits in the DNS path, if the Pi goes down, name resolution stops, so consider a second DNS fallback on the router.
That single point of failure is the one design decision people get wrong, so it is worth dwelling on. When you set the Pi as your only DNS server, every device on the network depends on it to turn domain names into addresses. If the Pi reboots, the SD card corrupts, or you unplug it to move it, the whole house loses the internet until it comes back, even though the actual connection is fine. The clean fix is to give your router a secondary DNS that is not the Pi (for example a public resolver), so devices fail over automatically. The trade-off is that any query answered by the fallback skips ad blocking, so do not point the fallback at another Pi-hole you do not run; just accept that brief gaps in filtering are better than the network going dark.
One subtlety worth knowing: a few clients ignore the DNS your router hands out. Some smart TVs and streaming sticks are hardcoded to use a public resolver like Google's 8.8.8.8, which lets them sidestep Pi-hole entirely. The fix is a router firewall rule that redirects or blocks outbound DNS on port 53 to anything other than the Pi, forcing every device back through the filter. Not every consumer router supports this, but if yours does, it closes the most common ad-blocking leak.
For more privacy wins, pair this with our secure home router checklist, and to stop smart TVs phoning home about what you watch, see turning off smart TV ACR tracking. If you want to reach the Pi-hole dashboard securely while away from home, Tailscale is a clean way to do it.
What to do right now
Run these in order and you will have network-wide ad blocking by the end:
- Flash Raspberry Pi OS Lite with SSH enabled in the Imager.
- Create a DHCP reservation in your router so the Pi keeps a fixed IP.
- SSH in, run the one-line installer, and note the admin password.
- Test on one device by pointing its DNS at the Pi before going network-wide.
- Set the router's DNS to the Pi's IP, and add a fallback DNS so browsing survives a reboot.
- Bookmark
http://your-pi-ip/adminto watch blocked queries.
Frequently asked questions
Does Pi-hole block ads inside apps and on smart TVs?
It blocks ads served from known ad and tracker domains, which covers many apps, smart TVs, and websites. It cannot block ads stitched into a video stream from the same domain as the content, such as some YouTube ads.
What Raspberry Pi do I need?
Very little. A Pi Zero 2 W handles a typical home network easily. A Pi 4 gives extra headroom if you want to run other services alongside Pi-hole.
Will the internet stop working if the Pi turns off?
If your router uses only the Pi for DNS and the Pi goes down, name resolution fails and browsing stops. Add a secondary DNS server in the router as a fallback, or keep the Pi reliably powered.
Can I undo it easily?
Yes. Change your router's DNS back to its default or your ISP's, and devices stop using Pi-hole immediately. You can leave the Pi running or power it off without harming the network.
