🛡️ Pi-hole: Your Network's Bouncer

The Truth About Pi-hole

What It Blocks

• Traditional display ads on websites
• Tracking pixels and analytics
• Malware and phishing domains
• Smart TV telemetry (Samsung, Roku, etc.)
• Windows telemetry (partially)
• Mobile app ads (many, not all)
• IoT device phone-home attempts

What It Can't Block

• YouTube ads (they come from same domain as videos)
• Facebook/Instagram sponsored posts
• Amazon product recommendations
• Any same-domain advertising
• VPN or encrypted DNS traffic
• Hard-coded IP addresses (some smart devices)

Streaming Services and Smart TVs: What Pi-hole Actually Does

A recurring question about Pi-hole is whether it removes ads from Netflix, Hulu, Disney+, Spotify or a smart TV's built-in apps. The answer turns on a distinction that is rarely drawn, and drawing it changes what anyone should expect from the box on their network.

There are two very different kinds of traffic involved:

• In-stream ads, which the service presents as part of playback and, in at least one documented case, serves from the same domain as the content. Where that is so, a DNS sinkhole cannot separate them from the thing being watched.
• Telemetry, analytics and viewing-data reporting, which travel to separate destinations from the content. That is the exact shape of traffic DNS filtering was built for.

Pi-hole describes itself in its own README as "a DNS sinkhole that protects your devices from unwanted content without installing any client-side software". It decides which domain names resolve, and nothing else. If an ad and a show share a name, the decision is all-or-nothing.

What the documentation actually establishes

YouTube. Covered earlier in this guide, and the project itself is the source for it. Pi-hole's FAQ on blocking YouTube ads states that "ads are typically served from the same domain as the video is" and that "it's not likely that you'll be able to block in-video ads with Pi-hole", calling it "a moving target". The last dated update on that page is 24 October 2020, so it is the project's stated position rather than a current test result.

Netflix, Hulu and Disney+. Here the honest answer is that the mechanism is not documented. Netflix's own help page on watching with ads confirms only that ads are part of playback: "You can't skip or fast-forward ads while watching TV shows and movies, but you can pause playback during an ad". The same page notes that ad breaks are shown on the progress bar when playback is paused. It says nothing about which domains or CDNs serve those ads. The equivalent Hulu and Disney+ help pages are rendered in the browser with JavaScript and returned no readable text, so nothing could be confirmed from them either way. Reasoning by analogy from YouTube would be a guess, and it is not offered here. What can be said is narrower: the vendor pages checked here say nothing about which domains serve those ads, and Pi-hole itself notes that it "sources its ad domains from third parties (blocklists)", so coverage of any given service is whatever those lists happen to contain.

Spotify. This one is settled outside the technical question. Spotify's User Guidelines list "circumventing or blocking advertisements or creating or distributing tools designed to block advertisements" among prohibited activities, and state on the same page that violations "may result in removal of any content or material you've contributed to the Services and/or termination or suspension of your account". Whatever a blocklist might or might not do, the attempt is against the terms of the account, with account action as the stated consequence. Not a recommended experiment.

Where DNS blocking does have reach

Smart TVs report on their owners through a channel entirely separate from the streams they play. In its 6 February 2017 enforcement action, the FTC and the New Jersey Attorney General announced that VIZIO agreed to pay $2.2 million to settle charges that it "installed software on its TVs to collect viewing data on 11 million consumer TVs without consumers' knowledge or consent". The agency described sets that "capture second-by-second information about video displayed on the smart TV, including video from consumer cable, broadband, set-top box, DVD, over-the-air broadcasts, and streaming devices". That is automatic content recognition, and it is a reporting stream with its own destinations, distinct from whatever app is playing.

Because that traffic goes somewhere else, it is structurally the kind of thing a DNS sinkhole is designed to intercept, in a way in-stream ads are not. No Pi-hole or manufacturer document establishes that it works in practice against any particular television, and no community blocklist is named here, because their real-world effectiveness is unverified. The settings-level approach is covered separately in the guide to disabling smart TV ACR surveillance.

One caution applies to any attempt at aggressive blocking. The Pi-hole FAQ post on tracking down ad domains notes that blocking can break things in ways that are hard to trace: "sometimes certain payment gateways try to collect metrics on the sale, but these domains are blocked by Pi-hole, so the payment cannot be processed". Links passing through a blocked referrer "may land on a blank page instead of the site you meant to go to". A blocklist that reaches too far tends to produce failures that look like broken sites rather than blocked ads.

The short version: the documentation supports a negative answer on in-stream ads only where the mechanism is actually documented, which is YouTube. For Netflix, Hulu and Disney+ it is not established either way. The separate reporting channel a smart TV runs is the part of this that DNS filtering is structurally aimed at, and its real-world effectiveness against any given set remains undocumented.

Hardware Requirements

Installation: The Real Steps

# SSH into your Pi
ssh [email protected]
# Or use IP if that doesn't work (find your Pi's IP from your router admin)
ssh [email protected]  # Replace xxx with your Pi's actual IP

# Update everything first
sudo apt update && sudo apt upgrade -y

# Set static IP (important!)
sudo nano /etc/dhcpcd.conf

interface eth0  # or wlan0 for WiFi
static ip_address=192.168.1.100/24  # Pick an IP outside DHCP range
static routers=192.168.1.1  # Your router's IP
static domain_name_servers=1.1.1.1 1.0.0.1  # Temporary upstream DNS

# One-liner installation
curl -sSL https://install.pi-hole.net | bash

Essential Configuration

# OISD (comprehensive, well-maintained)
https://dbl.oisd.nl/

# Developer Dan's lists
https://www.github.developerdan.com/hosts/lists/ads-and-tracking-extended.txt

# NoTracking list
https://raw.githubusercontent.com/notracking/hosts-blocklists/master/hostnames.txt

# Energized Ultimate (aggressive)
https://block.energized.pro/ultimate/formats/hosts

# The Block List Project
https://blocklistproject.github.io/Lists/ads.txt
https://blocklistproject.github.io/Lists/tracking.txt
https://blocklistproject.github.io/Lists/malware.txt

# Microsoft (if you use Windows/Office)
click.email.microsoftonline.com
officeclient.microsoft.com

# Banking apps often need
chase.com
wellsfargo.com
[your bank's domains]

# Shopping
amazon.com
ebay.com
target.com

# Streaming services
netflix.com
hulu.com

# Install cloudflared
wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm
sudo mv cloudflared-linux-arm /usr/local/bin/cloudflared
sudo chmod +x /usr/local/bin/cloudflared

# Configure as service (see Cloudflare docs)
# Point Pi-hole to 127.0.0.1#5053

Using the Dashboard

What to Watch

• Queries Blocked: Should be 15-40% for most networks
• Top Blocked Domains: Shows what's trying to track you
• Top Clients: Which devices query most (smart TVs are chatty)
• Query Log: Real-time DNS requests (privacy implications)

Suspicious Activity

Watch for:

• Thousands of requests to same domain (malware)
• Unknown devices (neighbors on your WiFi?)
• Weird domains at 3 AM (compromised IoT)
• Constant NTP requests (DDoS bot)

When Stuff Breaks

Advanced Tricks

Per-Client Settings

Kids get stricter blocking than adults:

1. Group Management → Groups → Add groups (Kids, Adults)
2. Group Management → Clients → Assign devices to groups
3. Group Management → Adlists → Assign lists to groups
4. Kids get aggressive lists, adults get normal

Time-Based Rules

Block social media during homework:

# Cron job to enable/disable domains
# Block Facebook at 3pm
0 15 * * * pihole -b facebook.com instagram.com
# Unblock at 8pm
0 20 * * * pihole -b -d facebook.com instagram.com

VPN Access

Use Pi-hole when away from home:

1. Install PiVPN alongside Pi-hole
2. Connect to home VPN
3. All traffic routes through Pi-hole
4. Ad-free browsing everywhere

Monitoring Specific Devices

See what your smart TV is doing:

# Watch Samsung TV queries in real-time
pihole -t | grep "samsung"

# Export specific device's history
sqlite3 /etc/pihole/pihole-FTL.db "SELECT * FROM queries WHERE client='192.168.1.50';" > tv_queries.txt

Keeping It Running

Regular Updates

# Update Pi-hole
pihole -up

# Update OS
sudo apt update && sudo apt upgrade

# Update blocklists
pihole -g

Backups

Settings → Teleporter → Backup

Saves all settings, lists, and configs. Store backup off-Pi.

SD Card Health

SD cards die. Reduce writes:

# Move logs to RAM
sudo nano /etc/fstab
# Add:
tmpfs /var/log tmpfs defaults,noatime,size=64M 0 0

Monitoring Health

# Check status
pihole status

# View diagnostics
pihole -d

# Check disk space
df -h

# Temperature (Pi only)
vcgencmd measure_temp

Alternatives to Pi-hole

The Bottom Line

Pi-hole is fantastic for:

• Blocking ads without installing software
• Reducing tracking across all devices
• Stopping smart TV telemetry
• Learning what's phoning home
• Protecting less technical family members

Pi-hole won't:

• Make you anonymous
• Block all ads (YouTube, Facebook)
• Protect outside your network
• Stop ISP surveillance
• Block malware perfectly

It's one layer of defense. Use it with:

• uBlock Origin in browsers
• VPN for anonymity
• HTTPS everywhere
• Good security practices

Related Guides

• Home VPN Server Setup - Combine Pi-hole with VPN for mobile ad-blocking anywhere
• Build Your Own Cloud VPN - Hide your location with a VPS-based VPN
• Self-Hosted Cloud Storage - Run Nextcloud on the same Raspberry Pi
• VPN Strategy Guide - When and how to use different VPN types