🛡️ Pi-hole: Your Network's Bouncer

Flash the OS

1. Download Raspberry Pi Imager: https://www.raspberrypi.com/software/
2. Insert microSD card
3. Choose "Raspberry Pi OS Lite" (no desktop needed)
4. Configure:
   • Set hostname: pihole
   • Enable SSH
   • Set username/password (NOT default pi/raspberry)
   • Configure WiFi if not using ethernet
5. Write the image

First Boot

# SSH into your Pi
ssh [email protected]
# Or use IP if that doesn't work (find your Pi's IP from your router admin)
ssh [email protected]  # Replace xxx with your Pi's actual IP

# Update everything first
sudo apt update && sudo apt upgrade -y

# Set static IP (important!)
sudo nano /etc/dhcpcd.conf

Add to dhcpcd.conf:

interface eth0  # or wlan0 for WiFi
static ip_address=192.168.1.100/24  # Pick an IP outside DHCP range
static routers=192.168.1.1  # Your router's IP
static domain_name_servers=1.1.1.1 1.0.0.1  # Temporary upstream DNS

# One-liner installation
curl -sSL https://install.pi-hole.net | bash

Installation prompts - what to choose:

• Upstream DNS: Cloudflare (1.1.1.1) or Quad9 (9.9.9.9) for privacy
• Blocklists: Keep defaults, add more later
• Protocols: Both IPv4 and IPv6
• IP address: Use the static one you set
• Web interface: Yes, install it
• Web server: lighttpd (default)
• Log queries: Your choice (privacy vs troubleshooting)
• Privacy mode: Show everything (for home use)

Three ways to use Pi-hole, from easy to best:

Option A: Device by Device (Testing)

Manually set DNS on each device to Pi-hole's IP. Good for testing, annoying long-term.

Option B: Router DHCP Settings (Recommended)

1. Log into router admin panel
2. Find DHCP settings
3. Set Primary DNS: Your Pi-hole IP (192.168.1.100)
4. Set Secondary DNS: Leave blank or use Pi-hole IP again
5. Save and restart router

Option C: Pi-hole as DHCP Server (Advanced)

1. Disable DHCP on router completely
2. Enable DHCP in Pi-hole settings
3. Pi-hole assigns IPs and forces its DNS
4. Most reliable, but Pi offline = network offline

Default lists are weak. Add these:

The Essentials

# OISD (comprehensive, well-maintained)
https://dbl.oisd.nl/

# Developer Dan's lists
https://www.github.developerdan.com/hosts/lists/ads-and-tracking-extended.txt

# NoTracking list
https://raw.githubusercontent.com/notracking/hosts-blocklists/master/hostnames.txt

For Maximum Blocking

# Energized Ultimate (aggressive)
https://block.energized.pro/ultimate/formats/hosts

# The Block List Project
https://blocklistproject.github.io/Lists/ads.txt
https://blocklistproject.github.io/Lists/tracking.txt
https://blocklistproject.github.io/Lists/malware.txt

To add: Web Interface → Group Management → Adlists → Paste URL → Add

Then update gravity: pihole -g

Some stuff breaks. Common fixes:

# Microsoft (if you use Windows/Office)
click.email.microsoftonline.com
officeclient.microsoft.com

# Banking apps often need
chase.com
wellsfargo.com
[your bank's domains]

# Shopping
amazon.com
ebay.com
target.com

# Streaming services
netflix.com
hulu.com

Add via: Web Interface → Whitelist → Add domain

Enable DNSSEC

Settings → DNS → DNSSEC → Enable

Prevents DNS hijacking. Some ISPs break it. If internet stops working, disable it.

Conditional Forwarding

Makes local hostnames work (printer.local, nas.local):

• Enable: Yes
• Router IP: 192.168.1.1
• Domain: local (or home.arpa)

DNS Privacy (Advanced)

Use DNS-over-HTTPS to hide queries from ISP:

# Install cloudflared
wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm
sudo mv cloudflared-linux-arm /usr/local/bin/cloudflared
sudo chmod +x /usr/local/bin/cloudflared

# Configure as service (see Cloudflare docs)
# Point Pi-hole to 127.0.0.1#5053