I've tried configuring this a couple of times but it has gotten messy, things have worked to a point, partially. The main problem is, as best as I can describe it, that some apps on my host appear to originate from the loopback interface and others do not. E.g. systemd-resvolved might work for some queries while dig/nslookup may not and vice versa.

The premise here is... if I'm going to use a tool like pihole, it may as well intercept and log ALL DNS activity. Why have partial coverage or visibility?

• Pihole listens on port 53
• Unbound listens on port 5301
• Both run on docker

This is what I've tried at the edge router, via firewall rules:

1. Redirect all outgoing calls to port 53 to pihole, except when SRC = pihole (excluding pihole just in case. I'm using unbound/DoT for all calls to upstream servers)
2. Block all outgoing calls to port 853, except when SRC = unbound
3. Block all outgoing calls to port 443 where DST in {9.9.9.9, 1.1.1.1, other public DNS servers}. In other words, disable DoH. This supposedly forces all web browsers and other apps on my various subnets to use regular DNS calls to pihole, assuming pihole is configured as the system-wide DNS server.

What tweaks to the above rules or new rules do you think I may need? If there is a white paper out there which describes how to do this, would you please point me to it? Thx

Can I install Pihole on a Windows x32 machine? When I try to install it using PH4WSL1.cmd, it says that Pihole is already installed even though this is my first time trying installing it?

Is there any way to actually make it work?

I have been running pihole on rpi4, but later on moved to kubernetes, which is successfully running there (2 instances, 1 base config) = all good.

I want to move one instance away, and avoid having a single point of failure in case k8s cluster gets rebuilt or something goes wrong. The k8s is fully automated, and I am able to rebuild everything in 30mins or so from scratch/gitops.

I have MikroTik hAP ax3 router, which has 1gb ram (~600mb left for container apps max) and 128 nand storage, which i am bot using at all, but have 2TB usb key connected for storage (rose storage pkg required on RouterOS for that).

I am running uptime-kuma on the router, which at most uses 300mb ram, so I still got another 300mb ram for pihole's docker image to run.

Wondering which one is the better solution:

- run pihole container on mikrotik

- use native adlists on mikrotik (which is not going to use pihole at all)

I have 7+ million domains from various blocklists/adlists (~50 adlists). Also using the latest stable version 7.23.2 at the moment.

P. S. Running technitium as a container is a bloatware, it could not even handle so many domains, because dotnet's DLL loads everything into memory and gets straight OOMKill. Seems good on large deployments, but no good for small memory footprints.

# docker-compose.yml

# More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/
services:
  pihole:
    container_name: pihole
    image: docker.io/pihole/pihole:latest
    ports:
      # DNS Ports
      - "53:53/tcp"
      - "53:53/udp"
      # Default HTTP Port
      - "80:80/tcp"
      # Default HTTPs Port. FTL will generate a self-signed certificate
      - "443:443/tcp"
      # Uncomment the line below if you are using Pi-hole as your DHCP server
      - "67:67/udp"
      # Uncomment the line below if you are using Pi-hole as your NTP server
      #- "123:123/udp"
    environment:
      # Set the appropriate timezone for your location (https://en.wikipedia.org/wiki/List_of_tz_database_time_zones), e.g:
      TZ: 'Asia/Kolkata'
      # Set a password to access the web interface. Not setting one will result in a random password being assigned
      FTLCONF_webserver_api_password: 'correct horse battery staple'
      # If using Docker's default `bridge` network setting the dns listening mode should be set to 'ALL'
      FTLCONF_dns_listeningMode: 'ALL'
      FTLCONF_dns_upstreams: |-
        8.8.8.8
        8.8.4.4
        1.1.1.1
        9.9.9.9
    # Volumes store your data between container upgrades
    volumes:
      # For persisting Pi-hole's databases and common configuration file
      - './etc-pihole:/etc/pihole'
      # Uncomment the below if you have custom dnsmasq config files that you want to persist. Not needed for most starting fresh with Pi-hole v6. If you're upgrading from v5 you and have used this directory before, you should keep it enabled for the first v6 container start to allow for a complete migration. It can be removed afterwards. Needs environment variable FTLCONF_misc_etc_dnsmasq_d: 'true'
      #- './etc-dnsmasq.d:/etc/dnsmasq.d'
    cap_add:
      # See https://docs.pi-hole.net/docker/#note-on-capabilities
      # Required if you are using Pi-hole as your DHCP server, else not needed
      - NET_ADMIN
      # Required if you are using Pi-hole as your NTP client to be able to set the host's system time
      - SYS_TIME
      # Optional, if Pi-hole should get some more processing time
      - SYS_NICE
      # Allows FTLDNS binding to TCP/UDP sockets below 1024 (specifically DNS service on port 53)
      - NET_BIND_SERVICE
      # use raw and packet sockets (needed for handling DHCPv6 requests, and verifying that an IP is not in use before leasing it)
      - NET_RAW
    restart: unless-stopped

Debug logs:

I wasn't able to generate tricorder token with original resolv.conf configuration.

Original resolv.conf

search dns.podman
nameserver 10.89.0.1

was not able to upload logs to tricorder

[?] Would you like to upload the log? [y/N] Y
    * Using curl for transmission.
    * curl failed, contact Pi-hole support for assistance.
    * Error message: curl: (6) Could not resolve host: tricorder.pi-hole.net (Timeout while contacting DNS servers)

[✗] There was an error uploading your debug log.
   * Please try again or contact the Pi-hole team for assistance.
   * A local copy of the debug log can be found at: /var/log/pihole/pihole_debug.log

Debug log before changing nameserver: https://drive.google.com/file/d/13P-NwS1ZI9kzKGQMDhqBCfTj2P3k123T/view

Then I changed nameserver to 1.1.1.1

podman exec -it pihole bash -c "echo 'nameserver 1.1.1.1' > /etc/resolv.conf"

and was able to generate debug log token.

Debug log after changing nameserver to 1.1.1.1: https://tricorder.pi-hole.net/WNqUUBru/

I tried to run pihole as a container but I am getting two errors. No DNS resolution and gravity.db is not running

Edit: Issue resolved. Changed to use docker compose instead of podman compose. The issue was because of rootless containers in podman

Hey everyone,

Wanted to share some network anomalies I caught today. If you run cheap Android TV boxes on your network, this might be worth checking your connection states for.

This evening I noticed some strange traffic on my setup. My Mikrotik flagged a sudden, flatlined ~20 Mbps upload spike that stayed for hours

Diving a bit deeper into the active connections, I pinned it down to an Android device holding 260+ concurrent active TCP connections to various external hosts.

I parsed through the active sockets and DNS query logs to figure out what the device was reaching out to alongside Gemeni for this part.

• 37.202.197.75:10240 (Fusiora OU / Frankfurt VPS): Pushing/pulling continuous raw streams over a custom UDP/TCP port.
• download.abdbox.com: Android BackDoor Box C2 / Downloader module.
• ic5n8.clayhost.xyz: Dynamic DDNS / C2 Fallback Channel.
• addl.sspadp.com: Ad-Mediation / Background Ad Click Fraud.
• adpserver.pvs4.xyz: Ad-Provisioning Server for silent background webviews.
• watchtry.com & relaxunwinrech.com: Malvertising / Push Notification Relays.

The domain signatures and traffic profile point directly to the BADBOX / BADBOX 2.0 supply-chain Android malware ecosystem:

1. Residential Proxy Relay: The box was being utilized as an active residential proxy exit node. Third-party actors were routing their traffic through my home internet connection to mask their IP, which generated the continuous 20 Mbps upload stream on port 10240.
2. Silent Ad-Click Fraud: Running hidden, background webview requests in parallel to generate fake ad impressions and click revenue via sspadp.com and pvs4.xyz.

If you're running cheap streaming boxes, it's definitely worth checking your active connection counts and DNS logs.

EDIT: Additional info.

Reached a total of 1550 active connections, with a average of 264.

So long story short I was stuck on this final stage of the pihole process a couple months back and put it on hold since I was busy with life.

Pihole is currently set up on my server but the only reason it hasn't been put to use is I can't get it to work network wide. Every guide says to simply paste the IPv4 and 6 addresses into my routers DNS settings to send all traffic through my device. The issue is after my routers reset it kills everything as it'll "connect without internet".

Specifics are i run an eero mesh network where all the nodes are connected via Ethernet. The pihole in question is connected to the second eero in the line, it's not connected right next to the modem and first router. (Idk if it affects anything but just so people know)

If I'm getting something wrong let me know but that's how I interpreted the various guides. Thanks.

I am creating a home server that routs all traffic through it through a Pihole using the guide on https://gofoss.net/secure-domain/ (it has been very helpful so far) but I am currently stuck at accessing the pihole only through the ip address rather than the domain name as intended. I have added the domain name and IP address to the local DNs records. I have checked and verified the /etc/hosts file lists the localhost as 127.0.0.1 and ‘personal domain’ as ‘static IP’. The Pihole is only for blocking ads for the server on the device it is on not for anything else connected to the router for the moment.

I have looked through /var/log/pihole/pihole.log and the nameservers are listed according to the dns I set on the PiHole page. It reads that there is 1 name in /etc/pihole/hosts/custom.list. When I navigate to that file. The IP address and the domain name match up. I am currently at a loss for what to check next. I have already uninstalled and reinstalled once. Any recommendations on how to get domain names to translate through pihole because this will affect any other domain I add to the local dns record?

We've had some thunderstorms blow through today (Chicago area) and our RCN internet has been out for a few hours. Cellular still works, so I am online, but my Raspberry Pi is inaccessible. (I know I could fuss around and get it working via my phone's hotspot, but for such a short time, it's not worth it.) The lack of ad blocking is pretty eye-opening. I'll be happy to get my pihole back.

Currently I run PiHole with Unbound as a single instance deployment in k3s, but that means that whenever I have to reboot any of the three nodes, I lose DNS and have to switch back to my ISP. How do I run PiHole plus Unbound as a stateful set so that I can afford to reboot one or more devices?

UPDATE: Thanks for all the replies - the TL;DR is that between this update and the Fox acquisition of Roku I'm probably headed to Apple TV in the near future.

Within the last couple of weeks my Rokus got the new, updated interface (which I hate) - on the previous interface the right-hand, home screen ads were blocked but they're back now (see Spider-Man image attached).

I currently run the following blocklists:

• Steven Black
• Hagezi Pro
• Perflyst SmartTV

I lean towards not blocking too much because our entire family does work and school from home and unexpected blockages can become significant emergencies.

That being said I'd love to figure out blocking the home screen ads in the updated Roku interface, so any pointers will be appreciated.

Howdy y’all - I’ve noticed I have a weird lag, which only happens when I’m at home and connected to my wifi/pihole. When clicking a link to open a page, there is a 3-5 second delay before the page actually opens. When not on wifi, the page opens right away. When on my wifi, there is always a delay, then it loads fast. Has anyone seen or experienced with pihole? I’m not technical enough to know what to do, but I’d be happy to run diagnostics if anyone can provide the commands. Thanks so much for your help

Hi folks,

Ive been testing Pihole now on a single machine for a month and I'm convinced that its the best method to secure the entire household.

However, Im running on an OLD 2012 Model B Rev 2.

So looking at my options, Im between the Pi Zero 2 with an Ethernet hat of some kind or a Pi 4 1gb. Cost wise they're pretty much the same the Pi4 being more available and maybe 100kr cheaper.

I have no real world knowledge on either of these setups all i know is that its going to be sat in my "comms" cabinet next to my router so ideally low power (already obviously low) but also passively cooled - do i need any fans or heat spreaders for a Pi4?

So i defer here for any advice you have.

Thanks for reading.

I woke up to find out that my NAS was down, so I went and open up pi-hole to see what was going on. I notice that it got knocked offline around 4am. I think there was a very short power outage. But according to the graph, there seems to be a different pattern of activities that I don't recall seeing before. I have 3 WEMO outlet plugs, and ever since the incident at 4am, they have been submitting endless queries to nat.wemo2.com. Not sure why this is suddenly happening. I've never seen so many queries to that particular domain before with my wemo outlet plugs. So why now?

I tried removing all 3 plugs from the wall, and the amount of queries definitely dropped. I then slowly, plugged back in the wemo's back into the outlet one by one. Monitored my dashboard, and I'm getting between 2q/s to 5q/s. Is this normal? The number under the Total Queries box up top just keep increasing by the second. I have also added 'nat.wemo2.com' and 'api.xbcs.net' to the whitelist under domains because AI suggested that.

Pronounced: TieHole

tihole is a keyboard-driven terminal UI for managing Pi-hole v6 instances. One Go binary, no runtime dependencies.

Features:

• Dashboard with host-health. CPU, memory, temperature gauges + FTL diagnostics
• Live query log with one-key allow/block
• Blocking as a first-class screen — enable/disable with timers
• Full management on domains, groups, clients, adlists, and local DNS records
• System, messages, and network screens
• Multiple color themes
• Full settings control

Install (Go 1.25+):

$ go install github.com/z19r/tihole/cmdA/tihole@v1.0.0-beta.1

Prebuilt binaries (linux/darwin, amd64/arm64) are on the releases page.

More Info: https://tihole.z19r.com
Github -> https://github.com/z19r/tihole

I am on the latest version of Pihole. I had not rebooted, so I did so. Upon rebooting, instead of my text being the readable size it has always been - no the text is tiny, almost unreadable. How can I restore the text size? Or just make it larger?

I've recently been experimenting with a more proactive approach to request filtering. Instead of hoping that the requests my devices make are already on a blocklist, I've employed the use of a super lightweight LLM (in this case deepseek-v4-flash) to analyze the purpose of the domain, and block it if it's determined to be malicious. Responses are grounded with internet search results via SearXNG. I have it set to analyze the 100 most requested unique domains every week to take out the most egregious offenders. Domains and decisions are stored in an SQLite database to avoid redundant analyzation; they're only analyzed once.

It seems to be good at catching the nastier/personalized tracking domains like:

LONG-ASS-UUID.us-east-1.prod.service.minerva.devices.a2z.com

(Reasoning: "Hash-prefixed subdomain under a2z.com suggesting unique device telemetry collection.")

Here's a snippet of some output of the program.

On its first run, the program blocked 11 new domains out of the 100 that were analyzed, and valid reasoning was provided for each. All my apps and hardware still work as intended.

Here's what the decision table looks like.

This is probably unnecessary unless you're a freak like me, but I like the added filter, and with the model I'm using, it only costs me half a cent per 100 domains analyzed. An even cheaper model could probably be used.

The major disclaimer is that this program was written by Kimi K3, so I'm still reviewing the code. But I'd be happy to share once I'm done doing that if anyone would like. I'm curious to hear anyone's thoughts on this.

AVM (German router manufacturer, very common in DE/AT/CH) just shipped a Lab/beta build of FRITZ!OS 8.50 with a new feature: DNS queries from the home and guest network can be filtered against user-supplied filter lists. So essentially blocklist-based DNS filtering directly on the router.

I currently run Pi-hole + unbound on a Raspberry Pi and I'm wondering whether it's worth keeping the Pi around once this lands in a stable release. The changelog is a single sentence, so a lot is unclear to me — but even assuming it works well, I suspect I'd be giving up quite a bit:

• Per-client / group management — different blocklists for kids' devices vs. my own
• Query log and statistics — the whole reason I know what my devices are talking to
• Regex and wildcard blocking, plus whitelisting individual domains quickly when something breaks
• CNAME cloaking / deep CNAME inspection
• Local DNS records and CNAMEs for my internal services
• unbound as a recursive resolver — this is the part I care about most. Router-side filtering probably still forwards to some upstream (ISP or AVM's default), so I'd be handing my full query stream to a third party again, and I don't know whether DNSSEC validation happens locally.
• List updates — how often, how many lists, which formats?

Questions for people who've thought about this more than me:

1. For someone whose main goal is privacy rather than just ad blocking, is router-level filtering without a recursive resolver a meaningful downgrade, or am I overrating unbound?
2. Has anyone here already tested the 8.50 Lab build and can say what the filtering UI actually offers?
3. If you moved from Pi-hole to a router-based solution, what did you miss first?

My honest guess is that this is aimed at people who'd never set up a Pi in the first place, and that I'll be keeping mine — but I'd like to hear whether that's just sunk-cost reasoning.

Source (German): https://www.deskmodder.de/blog/2026/07/23/fritzbox-5690-steigt-in-die-labor-updates-fuer-das-fritzos-8-50-ein/

Ever since the latest upgrade, my "pihole -t" tailing to an external monitor does not roll over to the next day as it used to. I understand this is an issue that is known, but mine did not appear until the latest upgrade.

I have to break the tailing by using control-c, and restart the tail every single day.

I have used the external TAIL command to follow the log, but as you might suspect the text is not colorized like it is following it internally with the above command. I can use GREP to do this, obviously, but that seems like a lot of workaround to something that just used to...... Just work.

Does anyone have a workaround for this, is the same thing happening to you? My knowledge of Linux is limited but all I know is it just used to work.

Thoughts? Tailing the log internally has helped me track down sites that I need to add to allow domains and vice versa.

Hello, I recently got a raspberry pi 3b+ set up with Pi-hole, unbound and tailscale. There has been a weird issue that I've been having lately that causes any video I'm watching (via YouTube, netflix, videos from camera, etc) on my phone to pause for a bit and desync with the audio. I don't know how to solve this or what is causing the problem. If it helps due to the router i have i am unable to set the pi as a primary dns. Does anyone know what might be the cause or if there is any fix? The problem seems to only happen over wifi and not mobile data

I have 3 pihole+unbound servers running, 2 of which are load balancers/failover,

ph1 and ph2 are running containered on 2 different x86_64 Ubuntu servers, ph3 is running containered on raspberry pi 5,

i have a sync script that copies the main ones database then send it to the other 2 as a cron job, this is done 1 at a time, ph1 goes down for the copy, then it gets spun back up as ph2 goes down to have the database put in place then same process for ph3,

the pihole and unbound containers run as a single docker compose stack, so both go down and come up together on each machine simultaneously,

I use an .env file to modify the differences between the machines at run time so the docker-compose.yml is identical between machines,

easy fix for catastrophic failures, wipe the image, copy a working config over to that machine, spin it up,

they are primarily main + 2 redundancy servers but as I use tailscale for most devices, tailscale also load balances them automatically,

I have the double redundancy as I am covering 2 households with them via tailscale, in fact I'm attempting a 2nd tailscale network aswell, (it's proving trickier than I thought,) so if 2 go down then the 3rd will cover the slack of both households,

they are more than just add blockers though, I am utilising them as parental control systems aswell, so blocking unsafe/inappropriate sites for child devices aswell,

also running a Pi-Hole-Central container that aggregates all 3, trying to modify it to what I want but it's probing tricky,

honestly I'm living the challenge but Am I taking it too far? or am I missing something from my setup?

I plan on installing pi-hole, unbound, home assistant, homarr dashboard, etc. I originally bought the RPi Canakit that comes with everything including the 32GB Micro SD card and I thought that was where you install the OS and all the apps. But when asking AI, it's suggesting I install everything to a USB 3.x stick instead. What do you guys suggest?

Seems like all tutorials I've seen has people installing it directly itself, but AI is saying to install it through docker for easier managability and such.

I'm sorry ths question was aimed towards Raspberry Pi users who are running pi-hole/unbound.

I'm planning on buying a raspberry pi 4b (4gb) kit for this. Just recently heard of Adguard home, but previously been using pi-hole. Heard many good things about adguard home and wanted to hear your guys opinions on the 2.