Pi-hole: RasPi Ad Blocker

What is Pi-hole?

Pi-hole is a network-wide ad and malware blocker that runs on a Raspberry Pi or other Linux device. It acts as a DNS server for your home or small business network, intercepting DNS requests and blocking those that are known to be associated with ads, trackers, and malicious content. This allows you to block ads and protect your devices from malware across your entire network, without having to configure individual devices.

Pi-hole has been a game-changer for me over the past 4-5 years that I’ve been using it. It’s a fantastic Raspberry Pi project that is easy to set up and provides tremendous value in terms of blocking unwanted content and improving online privacy. In this tutorial, I’ll walk you through the step-by-step process of getting Pi-hole up and running on a Raspberry Pi, as well as configuring it for optimal ad and malware blocking.

How to Get a Pi-hole in 2023

One of the first questions people often ask about setting up a Pi-hole is whether they can even get their hands on a Raspberry Pi these days. It’s true that Raspberry Pis have been in short supply over the past couple of years due to global chip shortages. However, that shouldn’t stop you from setting up a Pi-hole. There are a couple of options:

Use a Virtual Machine or Docker Container: Pi-hole doesn’t have to run on a physical Raspberry Pi. You can just as easily install it on a virtual machine or in a Docker container. The instructions in this tutorial will work just the same.
Use a Raspberry Pi Locator Tool: If you do want to run Pi-hole on a physical Raspberry Pi, check out the rpilocator.com website or follow the @rpilocator Twitter account. These resources will alert you when Raspberry Pis come back in stock at various retailers so you can snag one.

Don’t let the Raspberry Pi shortage stop you from setting up a Pi-hole. There are plenty of options to get one up and running, even if you can’t find a physical Raspberry Pi right now.

What You Need to Get Started with Pi-hole

To get started with Pi-hole, you’ll need a few basic components:

A Raspberry Pi: Even an older, less powerful Raspberry Pi model will work just fine for running Pi-hole. The project is not resource-intensive at all.
A Micro SD Card: You’ll need a micro SD card to install the Raspberry Pi operating system. An 8GB card is sufficient, but I recommend using a higher quality card since the Pi-hole will be running 24/7.
The Raspberry Pi Imager: This is the easiest way to format your micro SD card and install the Raspberry Pi OS. It works on Windows, macOS, and Ubuntu.

Once you have those basic components, you can follow along with the step-by-step instructions in this tutorial to get your Pi-hole up and running.

Raspberry Pi Imager

The first step is to download and use the Raspberry Pi Imager to prepare your micro SD card. Here’s how:

Download the Raspberry Pi Imager from the Raspberry Pi website.
Open the Imager and select “Raspberry Pi OS (other)” and then choose “Raspberry Pi OS Lite 64-bit” as the operating system.
Select your micro SD card as the destination.
Click the gear icon to open the settings. Here you can:
- Set a hostname for your Raspberry Pi (e.g. “Pi-hole 3”)
- Enable SSH and set a password for the “pi” user
- Set your locale and keyboard layout
Click “Write” to begin the process of flashing the Raspberry Pi OS onto the micro SD card.

Once the Raspberry Pi OS is written to the card, you can insert it into your Raspberry Pi and power it on.

Finding and Connecting to your Raspberry Pi

After a couple of minutes, your new Raspberry Pi should be online and ready to go. The next step is to find its IP address on your network so you can connect to it.

One of the easiest ways to do this is to check the DHCP lease table on your router. This will show you the IP address that was assigned to the new Raspberry Pi. Alternatively, you can connect a keyboard and monitor to the Raspberry Pi and run the “ip a” command to see its IP address.

Once you have the IP address, you can connect to the Raspberry Pi using an SSH client like PuTTY on Windows or the Terminal on macOS/Linux. Log in using the “pi” username and the password you set in the Raspberry Pi Imager.

Updating the Raspberry Pi

The first thing you’ll want to do after connecting to the Raspberry Pi is update the operating system. Run the following commands:

`sudo apt update`
`sudo apt upgrade -y`

This will ensure your Raspberry Pi is running the latest software and security updates.

Setting a Static IP Address on the Raspberry Pi

Next, you’ll want to assign a static IP address to your Raspberry Pi. This ensures that the Pi-hole will always be reachable at the same IP address on your network.

There are a couple ways to do this:

DHCP Reservation: You can set a DHCP reservation on your router so that the Raspberry Pi is always assigned the same IP address.
Static IP Configuration: You can also set a static IP address directly on the Raspberry Pi by editing the `/etc/dhcpcd.conf` file.

For the static IP configuration, you’ll want to choose an IP address that is outside the DHCP pool on your network, but still within the same subnet. For example, if your network uses the 192.168.1.x subnet, you could assign the Raspberry Pi the IP address 192.168.1.52.

Installing Pi-hole on the Raspberry Pi

Now that your Raspberry Pi is updated and has a static IP address, it’s time to install Pi-hole. Run the following command to start the installation:

curl -sSL https://install.pi-hole.net | bash

This will launch the Pi-hole installation wizard. Here’s a quick overview of the steps:

The installer will confirm that you want to transform your device into a network-wide ad blocker.
It will verify your static IP address configuration.
You’ll be prompted to choose an upstream DNS provider. For now, select Cloudflare, but we’ll be changing this later.
Choose whether to import the default block list (recommended).
Select whether to install the web-based admin interface (recommended).
Choose whether to enable query logging (recommended).

Once the installation is complete, you’ll be shown the admin login credentials for the Pi-hole web interface.

Setting the Pi-hole Admin Password

Before logging into the Pi-hole admin interface, you’ll want to set a strong password for the admin user. You can do this by running the following command:

pihole -a -p

Enter and confirm your new password when prompted.

Logging into the Pi-hole

Now you can access the Pi-hole admin interface by navigating to `http://[pi-hole-ip-address]/admin` in your web browser. Log in using the admin username and the password you just set.

Pi-hole Dashboard and Menus

The Pi-hole admin interface provides a wealth of information and configuration options. Let’s quickly review the main sections:

Dashboard: This shows you key statistics like total queries, queries blocked, and the number of domains on your block lists.
Query Log: View a log of all DNS queries that have passed through the Pi-hole.
Groups and Clients: Manage how Pi-hole handles DNS requests from different groups of devices or clients on your network.
Domains: Whitelist or blacklist specific domains.
Adlists: Add and manage block lists for ads, malware, tracking, and other unwanted content.

Adding Pi-hole Block Lists

One of the most powerful features of Pi-hole is its ability to block ads, trackers, and malicious domains using curated block lists. By default, Pi-hole comes with the popular “Unified Hosts” list from Steven Black, which blocks around 158,000 domains.

However, you can add many more block lists to significantly expand Pi-hole’s blocking capabilities. A great resource for finding high-quality, well-maintained block lists is the Firebog website. Here you’ll find lists categorized for ads, tracking, malware, and more.

I recommend adding the top 2-3 lists from each category on Firebog. Just copy the list URLs, go to the Pi-hole admin interface, click “Adlists”, and paste in the URLs. Then click “Add” to import the new block lists.

Once you’ve added all the lists you want, go to the “Tools” section and click “Update Gravity” to refresh the block list data. This will increase the number of domains that Pi-hole is actively blocking.

Remember, more block lists isn’t always better. You don’t want to over-block and end up breaking legitimate websites or services that your family and friends use. Start with the top recommended lists and adjust as needed.

How to Disable Pi-hole

Even with a comprehensive set of block lists, there may be times when you need to temporarily disable Pi-hole. For example, if a website or service isn’t working properly due to Pi-hole’s blocking, you can disable it for a short period of time to troubleshoot the issue.

In the Pi-hole admin interface, you can click the “Disable” button to stop blocking for a specified duration (e.g. 5 minutes). This is a handy feature, but having to manually log in and disable Pi-hole can be a hassle, especially if you have multiple Pi-hole instances on your network.

To make this process easier, you can create a custom URL that allows you to disable Pi-hole with a single click. The blog post includes the exact steps to generate this URL, which you can then bookmark in your browser or integrate into a home automation system like Home Assistant.

More Pi-hole Menu Settings

The Pi-hole admin interface has several other useful settings and features worth exploring:

Local DNS: Allows you to define local domain names that should resolve to specific IP addresses on your network.
Tools: Includes options to update the block lists, flush the DNS cache, and more.

Pi-hole Settings

The “Settings” section of the Pi-hole admin interface provides access to a variety of configuration options:

System: View information about the Raspberry Pi hardware and resource utilization.
DNS: Manage the upstream DNS providers used by Pi-hole. We’ll be changing this later to use the Unbound DNS resolver.
DHCP: Configure Pi-hole to act as a DHCP server for your network (optional).
API/Web Interface: Customize the appearance and behavior of the Pi-hole admin interface.
Privacy: Adjust the level of query logging and anonymity.
Teleporter: Backup and restore your Pi-hole configuration.

Configuring your Devices to use the Pi-hole

Now that Pi-hole is installed and configured, the next step is to point your client devices to use the Pi-hole as their DNS server. There are a couple ways to do this:

Manual Configuration: You can manually configure the DNS settings on each device to use the Pi-hole’s IP address.
DHCP Configuration: You can configure your router’s DHCP server to automatically provide the Pi-hole’s IP address as the DNS server for all connected devices.

The DHCP configuration method is generally the easiest, as it ensures all devices on your network will use the Pi-hole for DNS resolution without requiring manual changes on each device.

One important consideration is to make sure your firewall is configured to only allow DNS queries to the Pi-hole’s IP address. This prevents users from bypassing the Pi-hole by manually changing their DNS settings.

Unbound Installation and Configuration

By default, when a DNS query comes into the Pi-hole and it doesn’t have the answer cached, it will forward the request to an upstream DNS provider like Cloudflare or Google. While these providers offer good privacy protections, an even more private solution is to use the Unbound DNS resolver.

Unbound is a validating, recursive, and caching DNS resolver that allows the Pi-hole to perform its own lookups to the root DNS servers on the internet, without relying on any third-party DNS providers. This provides an extra layer of privacy and security.

To set up Unbound on your Pi-hole, run the following command:

sudo apt install unbound

Then create a new configuration file at `/etc/unbound/unbound.conf.d/pihole.conf` with the settings provided in the blog post. This configures Unbound to work seamlessly with Pi-hole.

After saving the configuration file, restart the Unbound service with `sudo service unbound restart`. You can test that Unbound is working properly by running a DNS lookup against `127.0.0.1#5335`.

Finally, go back to the Pi-hole admin interface, click on “Settings” > “DNS”, and configure Pi-hole to use the local Unbound resolver instead of an upstream provider.

Testing the Pi-hole Ad Blocking

To verify that Pi-hole is effectively blocking ads and other unwanted content, you can use the Ad Blocking Test website. This site runs a series of tests to check how well your Pi-hole is blocking various types of ads and trackers.

Simply visit the site with your device connected to the Pi-hole network. You should see a high percentage of blocked hosts, indicating that Pi-hole is effectively intercepting and blocking the ad and tracking content.

If the test shows a lower blocking rate, you may need to revisit the block lists you’ve configured in Pi-hole and make some adjustments.

Updating the Pi-hole

Occasionally, the Pi-hole developers will release updates to the software. To update your Pi-hole installation, simply run the following command:

sudo pihole

Byzainalsh