Pi-hole: block ads on every device at home
Most Pi-hole tutorials are out of date
If you find a Pi-hole setup guide from before February 2025, throw it away. It will tell you to configure lighttpd, edit setupVars.conf, and manage a PHP-based admin panel. None of that exists in Pi-hole v6, the current release. Pi-hole v6 rewrote the entire stack. The web interface is now served directly by pihole-FTL (the core binary), which also hosts a new REST API. There is no lighttpd, no PHP, and no setupVars.conf. Configuration lives in one file: /etc/pihole/pihole.toml. This tutorial uses v6.4.3, released July 2026, and every command here works on the current version. What you get at the end: a DNS resolver on your home network that blocks ads, trackers, and malware domains before they reach any device. No browser extension. No app to install on phones, tablets, or smart TVs. Works for every device that uses your router.
Time needed
About 45 minutes
Cost
Free (Pi-hole is open source)
Difficulty
Beginner, no networking experience required
Current version
Pi-hole Core v6.4.3, FTL v6.7.1, Web v6.6
What hardware you need
Pi-hole v6 runs on almost anything. The official minimum is a single-core CPU with 512 MB RAM. In practice, a Raspberry Pi 4 or Pi 5 is the most common choice: it draws about 3 watts, boots from a microSD card, and sits quietly on a shelf. A Pi Zero 2 W works too if you want the smallest possible footprint. An old PC, a spare laptop, or a virtual machine on an existing NAS all work fine. The machine needs: a wired Ethernet connection (for reliability as a DNS server), Raspberry Pi OS Lite 64-bit (Bookworm) or Debian 12 or Ubuntu 22.04+, and it must be the only machine running DHCP on your network (your router handles DHCP; Pi-hole just answers DNS queries).
Step 1. Give the machine a permanent IP address
Pi-hole answers DNS queries for your whole network. If its IP address changes after a router reboot, every device on your network silently loses DNS. So before installing anything, lock the IP in place. The cleanest method is a DHCP reservation on your router: find the Pi's MAC address, go to your router admin panel, and reserve a fixed IP for that MAC. Look for "DHCP reservation," "static lease," or "address reservation" in your router settings. Pick something outside the normal DHCP pool, like 192.168.1.3. If you prefer to set the IP on the Pi itself, use nmcli. Replace 192.168.1.3/24 with your chosen address and 192.168.1.1 with your router's IP.
sudo nmcli con mod "$(nmcli -t -f NAME con show --active | head -1)" \
ipv4.addresses 192.168.1.3/24 \
ipv4.gateway 192.168.1.1 \
ipv4.dns 127.0.0.1 \
ipv4.method manual
sudo nmcli con up "$(nmcli -t -f NAME con show --active | head -1)"The Pi-hole v6 installer checks for a static IP at startup and stops if it cannot confirm one. Do this step first, before running the installer, to avoid the setup wizard halting on you.
Step 2. Run the Pi-hole installer
Pi-hole installs with one command. The installer is a guided text wizard: it asks you to pick an upstream DNS provider (Cloudflare at 1.1.1.1 is a good default), choose IPv4 or IPv6, confirm your static IP, and set a web admin password. Everything else it configures automatically.
curl -sSL https://install.pi-hole.net | bashWhat the v6 installer sets up
When the wizard finishes, pihole-FTL is running and listening on port 80 and 53. The web interface is at http://[your-pi-ip]/admin. Log in with the password you chose during setup. All settings now live in /etc/pihole/pihole.toml, which is richly commented and safe to read or edit directly. Three separate version numbers are shown in the dashboard footer: Core, FTL, and Web. That is normal in v6. They can update independently.
Step 3. Point your router's DNS at Pi-hole
Pi-hole only filters traffic from devices that send their DNS queries to it. The network-wide result comes from telling your router to hand out the Pi-hole IP as the DNS server for every device that connects. Log into your router admin panel (usually at 192.168.1.1 or 192.168.0.1). Find the DNS settings inside DHCP or LAN configuration. Set the primary DNS to your Pi-hole's static IP (for example, 192.168.1.3). Leave the secondary DNS field blank, or point it to a second Pi-hole instance if you have one. Do not put a public resolver like 1.1.1.1 in the secondary DNS slot. Devices are not required to use the secondary only as a fallback: some will round-robin between them and skip Pi-hole entirely. Save and restart the router. After reconnecting, devices will begin using Pi-hole for DNS. Open the Pi-hole dashboard and watch queries arrive.
Some routers will not let you remove the secondary DNS. If yours insists, use the Pi-hole IP in both fields. Pointing both at the same resolver is harmless and keeps all traffic filtered.
Step 4. Check that blocking is working
From any device on your network, open a browser and visit a site with ads (a news site or a free app store listing works well). Ads should be absent or reduced. You can also test directly from the Pi using the dig command below. A correctly blocked domain returns 0.0.0.0.
dig ads.google.com @localhostVerify from the dashboard
Open http://[your-pi-ip]/admin. The Queries graph shows total queries arriving. The Ads Blocked counter shows how many were intercepted. A freshly installed Pi-hole with the default blocklist (StevenBlack Unified Hosts) blocks roughly 15 to 20 percent of typical home traffic within the first hour. If the counter stays at zero after five minutes of normal browsing, your router's DNS change has not propagated yet. Restart the router and reconnect your test device.
Step 5. Add more blocklists
The default list blocks about 170,000 domains. You can extend coverage by adding community-maintained lists in Settings, then Blocklists. The OISD Big list (oisd.nl/downloads) is well maintained and widely used. The regex-based HaGeZi Multi lists cover trackers that slip past domain-only blocking. After adding lists, go to the Gravity page and click Update Gravity to download and compile the new lists. This rebuilds the DNS database pihole-FTL uses; it takes about 30 seconds.
Avoid stacking dozens of lists. Duplicate domains are deduplicated, so the marginal gain from a fifth or sixth list is small, but the memory used by pihole-FTL grows with each addition. Two or three good lists outperform twenty mediocre ones on a Pi Zero 2 W.
Keeping Pi-hole v6 up to date
Run the update command from a terminal on the Pi. It updates Core, FTL, and Web in one step and prints the version of each component after finishing.
pihole -upPi-hole v6 separates three independently versioned components: Core, FTL, and Web. pihole -up updates all three. You do not need to manage them separately.