# Pi-hole A DNS sinkhole that blocks ads and trackers for every device on a network. No client software needed.^[https://docs.pi-hole.net/] - Install it once on a small box. Point the router's DNS at it. The whole network is covered. - Runs on a Raspberry Pi, an old PC, a VM, a NAS or Docker. Needs 512 MB RAM and 2 GB disk.^[https://docs.pi-hole.net/main/prerequisites/] - Free and open source. Volunteer team, funded by donations.^[https://pi-hole.net/] ## How it works 1. A device asks "where is `ads.example.com`?" 2. Pi-hole checks its cache, then its blocklists. 3. Blocked domain: it answers with nothing. The ad never downloads. 4. Allowed domain: it forwards the query upstream and caches the answer. ## Problems it solves - **Ads where browser extensions cannot reach.** Mobile apps, smart TVs, IoT devices. - **Tracking.** Trackers die at the DNS step, before any connection. - **Speed and data.** Blocked content never loads. Cached answers return almost instantly. - **Visibility.** The query log shows every domain each device asks for. You see what your smart TV phones home to. ## Features - Web dashboard, long-term query log, REST API, CLI. - Community blocklists and allowlists, with regex. Group rules per device. - Optional DHCP server. IPv4 and IPv6. - Four privacy levels for how much it logs. - Core engine: `pihole-FTL`, a caching and forwarding DNS server. ## Pi-hole + Unbound - By default Pi-hole forwards to a public resolver (Google, Cloudflare). That resolver sees every lookup. - Add [[NLnet Labs|Unbound]] on the same box. It asks the root and authoritative servers directly.^[https://docs.pi-hole.net/guides/dns/unbound/] - No single upstream can log your full browsing path. - Smaller target for DNS cache poisoning. - DNSSEC validation on your own hardware. - Cost: the first lookup of a new domain can take a second. - Result: you own the naming layer of your home network. Same idea as [[Framework Computer]] for hardware and [[Tails]] for the OS. > [!warning] Limits > - It cannot block ads served from the same domain as the content, such as YouTube ads. > - Devices with hard-coded DNS, or DNS over HTTPS, can bypass it. > - It blocks by domain only. It does not inspect traffic. > - These limits are general knowledge, not from the Pi-hole site. ---- tags: #boat #security links: [[Security MoC]] [[NLnet Labs]] [[Tails]] [[PowerDNS]]