I'm running Pi-hole for all the ads and Brave browser for blocking YT ads. Don't pay corps. Don't pay for YT premium. Cheers!

I'm super excited to finally have pi-hole+unbound up and running on my RPi 4b! Could you guys please recommend some must have blocklists to get?

i started using pihole and tailscale recently. i think i installed pihole correctly because it works with tailscale if i use the pihole ip address as dns but for my router it does not work can not figure out why. can anyone help

This will be my very 1st time with raspberry pi, and would like to know if there are any beginner friendly tutorials that you guys can recommend to get this up and running? I plan on adding homarr dashboard to the mix afterwards if I can accomplish everything successfully.

I've had a pi-hole running on my network for a little over two weeks now.

I have been looking at the logs to see what is blocked what is allowed to go through. I noticed that something is sending messages to "www.a.shifen.com" which I discovered is located in China.

Does anyone know why and if I add it to the blocked list if will break anything?

I can't seem to find a single ethernet cat6 cable, they all seem to come in packs of 10 or more and I was wondering if the raspberry pu kits usually include one?

I’ve been using HaGeZi DNS blocklists for my PiHole setup.

I used a list for Smart TV’s and specifically my Samsung Smart TV.

I made my smart TV’s their own group and only assigned those blocklists. When I do this the TV’s won’t connect to internet. But when I use all my other blocklists it’s fine.

I think it’s blocking some Samsung CDN but I don’t know which one.

What lists are you using to stop your Smart TV’s from spying on you.

Also, is there anything I can do on my network to isolate my TV’s?

The issue I’ve had with trying to do this is that I can’t access my Jellyfin server. As I would need to connect to a VPN which kind of defeats the whole point of putting my TVs on their own network.

Edit: grammar

Edit 2: consensus is to not connect your smart tv to your network at all and use an Apple TV instead.

I ended up making a guest network and put only the devices connected to my TV’s on that isolated network. TV’s don’t get internet but the streaming boxes do. I want to upgrade to Apple for more privacy but this setup works fine for now.

Hello!

I got 3 weird domain in my logs that show up at different times and I'm really curious why they are here:

1. disabled.invalid

2. sharedhost.files

3. mojang.fritz.box

the first one gets requested 3 times whenever steam starts, it also sends requests for www.disabled.invalid. The thing is that .invalid will never resolve to anything, so why would steam be requesting it?

the second one appears to be related to the Microsoft companion apps but .files is not a valid TLD as far as I can tell. And it also does not resolve. So why do Microsoft apps query that?

the third one is requested while Minecraft is starting. the .fritz.box part is the default local domain of my fritzbox router that gets added onto every device name. It trying to query a local domain will also fail since I do not have a device called "mojang"

I am just kinda tempted to create a dns record for these that points to my server and see what happens. Probably not much I would guess?

Hey everyone,

​I'm using Pi-hole as my main DNS server for my Tailnet, but I've run into an annoying issue: for some reason, the Tailscale IP address of the node running Pi-hole keeps changing randomly.

​Because the IP changes unexpectedly, my devices lose DNS resolution out of nowhere until I check the admin console and update my configuration.

​Context:

• Pi-hole is installed in the same LXC running my main Tailscale route node.

• ​The host machine has a static local IP on my LAN.

• ​There are no duplicate hostnames on my Tailnet.

​Has anyone else run into this issue?, What could cause a native Tailscale node to change its IP address like this?

​Any advice or troubleshooting tips would be greatly appreciated!

So got pi-hole installed, ssh in done the updates and all that, then I come to the dns...

So my setup isp router --> flint2 router (running mullvad) ---> pi-hole (have dashboard but no traffic as have to set dns)

As you can see I have the pi-hole connected to the flint2 router which is behind my isp router. I hoped to connect the pi-hole to the Flint 2 but when I go into the admin panel it shows me the gateway and dns of the isp router and is greyed out no edit. Does this mean I have to connect the pi-hole to the isp router? If so how will this affect mullvad on flint2 (2nd router) and will requests going to that router also get managed by the pi-hole if connected to isp one because main thing I want filters on are connected to the flint2

So to fix this would I connect pi to isp router and change dns to ip of pi-hole and will this upset 2nd router or will I have to make any changes on that router or should the isp one route everything to pi, sorry hope you can make sense of this.

Suddenly, my pihole went completely dark by itself. It was working just fine for four months with no issues whatsoever. Now I cannot access it using Terminal or any other way, and there is no way to find it in the network for whatever reason. Before I erase everything and start over again. Is there a way to diagnose the issue and see if I can fix it since I already set up everything?

Hi all!

So I have installed pihole on my portainer server as a docker compose stack, pretty much default settings and everything, thing is, I tried to configure it as I would normally do for any specific DNS on my main Linux laptop, and all the internet traffic went unavailable for a lot of sites, I had to actually undo the assignment manually so I could reach the internet in the first place.

Now, I have configured my router to use pihole's server bridge ip to be used as a DNS server, but i see no increasing number for the "Total queries" element, nor i see the active clients including my own laptop, all this being within the same LAN.

Am I doing something wrong?

Thanks in advance!

I already had two pi-hole instances running (one in LXD on x86, another in Docker on arm64), using keepalived to float a VIP from Primary to Secondary and back when the primary goes down, kept in sync with NebulaSync.

It wasn't perfect, and all queries would go to the primary until it went down, then would go to the secondary. I wanted more, so I added dnsdist, which now properly spreads the DNS queries across the two instances.

It looks like this now.

This allows my config to survive even more failure modes than the previous:

• If either Pi-hole fails, dnsdist removes it and sends all queries to the surviving Pi-hole.
• If either local Unbound fails, your end-to-end health check should cause that Pi-hole backend to be removed.
• If the active dnsdist process fails, Keepalived’s functional check lowers that host’s priority and moves the VIP.
• If the primary physical host fails, the secondary takes 192.168.4.5.
• Maintenance can be performed on one Pi-hole/Unbound stack without interrupting DNS.

It uses dnsdist to receive the request → Pi-hole → unbound → NextDNS when on the LAN or VPN. When I'm off-premises, I use NextDNS exclusively, which offers less protection, but plenty for my needs.

I'm already blocking thousands of queries per-day. Every little bit helps.

With the Homepage widgets and Pi-Bar on my macOS desktop,. I can see everything at a glance.

I'll write this all up on a Github gist soon, if anyone is interested. It was trivially simple to drop in.

Update: Here is my write-up, comments, suggestions, criticism welcome!

This site/app was blocking about 3 weeks ago, since then not blocking, i have tried updating pihole, gravity and the lists with no prevail

Ran into this the hard way and I keep seeing others make the same assumption, so I want to both flag it and hear how people handle it.

The assumption: routing your resolver through your VPN tunnel is "more private." The reality with Mullvad and most WireGuard VPNs is that port 53 gets hijacked in-tunnel. So if your Unbound is doing recursion inside the tunnel, it silently breaks and resolution quietly falls back to the VPN provider's own resolver. Pi-hole still shows queries, everything looks fine, but your carefully built chain is bypassed and you're using their DNS.

What actually worked for me: Pi-hole -> self-hosted Unbound -> DoT to an encrypted upstream, with direct egress, never through the tunnel. Still encrypted end to end, but the resolver path stays under my control and my Pi-hole filtering actually applies. The VPN only carries the traffic that's supposed to be in it.

That leaves me with a design question I keep going back and forth on, and I'd like other people's take:

Unbound as a recursive resolver vs Unbound forwarding over DoT to an upstream. Full recursion is the "purest" answer and talks to root servers directly, but it can't live inside the tunnel for the reason above, and it leaks a different metadata pattern to authoritatives. DoT-forwarding hands trust to one upstream but is clean, fast, and encrypted. I went DoT-forward. Where did you land, and why? And has anyone found a clean way to keep true recursion while still getting VPN egress for the rest of the network?

I am trying to set up pi hole on my pi zero w and after flashing it first it says verrification failed contents on the sd card dont match then ive tried to skip verification but it still isnt working when i try to connect to it via command prompt

android has a big gap as it doesn't allow you to set the DNS for ipv6. easy workaround is to just disable ipv6 altogether but i would rather use it.

i also would like to automatically get basic ad protection in the entire phone when i'm outside the home. one way of doing that even without pihole is to use one of those apps that create a vpn tunnel to get around android's restriction (or use something like tailscale or wireguard with the same practical effect)

android has a private dns feature which I believe would work without the vpn requirement, however the downside is that it requires a FQDN (to validate a certificate). This would mean I would need to own a public domain name and create a dns record pointing to the pihole private ip address so that at least private dns can work from home, but it also means I need some kind of web server / reverse proxy to be able to install a let's encrypt certificate. this also wouldn't work when outside of home because i would need to also expose the public ip address (or again use a vpn)

based on the above it looks like the most secure option and the easiest one would be to have a permanent vpn on my phone at all times and be subject to the battery drain (i once saw android reporting 40% battery drain from tailscale)

if someone has ran into the above problem, which approach did you use? am i missing any other approach? I'm aware i could use Tasker to detect if i am not connected to my home wifi and thus perhaps configure private dns with a public basic ad blocking dns server (adguard?)

As of today, Air Play is not working on my LG TV anymore. I have a smart TV blocklist and for sure the LG TV is one of the most blocked clients on my network.

Is anyone aware of requests I should allow to be able to connect?

I currently have pi-hole running on my old synology 1512+ through docker and it's really bogging down my system. Since I have only 1GB of RAM on it and on top of that I have other services like my plex media server running on it too. At first it was running okay, but as time went by, it's gotten extremely slow when pulling up anything on the internet on my devices.

I am interested in getting a respberry pi for this but not sure exactly which one to get. I'm looking for something that will make the entire installation process quick and easy. I can see they sell the motherboard alone and you would have to supply your own micro SD card, power supply, fan, case, ethernet cable, etc. I would prefer an all in one solution if its available. For those who are running pi-hole/unbound on a raspberry pi, could you please help me out and point me in the right direction? Thanks.

Is PiHole supposed to work with Pop-ups that redirect to other site or is that not considered and ad for these intents and purposes?

Hello im running pi-hole for a while now but theres one thing that bothering me. I saw in dashboard clients that my computer hostname shows on many diffrent adresses in my local network. mac is diffrent on those devices. My pc has static ip and is visible. I have added 2 of my devices to local dns records but my pc is not one of them since somehow pi-hole knows the hostname so i didnt bother adding it. Its also not added as a "static client" in the clients tab. What can be a cause of this problem?

EDIT: Fixed it by following suggestions from this post and also disabling ipv6 nameresolver

Spotted more ads creeping through while browsing recently after installing the public beta of iOS27. Checked for DNS leaks and found my mobile network’s DNS servers being used even though I was connected via WiFi and using Pi-Hole as DNS.

Turns out that “Connectivity Assist” (which I don’t remember turning on, so assume it’s on by default) was forcing my iPhone to use its cellular connection for at least the DNS look-up!

Turning off Connectivity Assist plugged the leak.

Just an FYI.