Set Up Pi-hole DNS Filtering on elementary OS

A Pi-hole DNS filter can remove a large share of advertising, tracking and malicious domains before they reach your browser or applications. For someone using elementary OS, it is a practical way to make browsing cleaner across a home network without installing a separate ad-blocking extension on every device.

The key detail is where Pi-hole runs. It can be installed on a Raspberry Pi, a small home server, a virtual machine or another computer that stays switched on. Your elementary OS desktop then uses that machine as its DNS resolver. This arrangement is usually more reliable than running the filter directly on a desktop that may be asleep when other household devices need internet access.

Understand What Pi-hole Filters

DNS, or the Domain Name System, translates a hostname such as example.com into an IP address. When a browser, smart television or phone requests an advertising domain, Pi-hole checks that domain against its blocklists. If it is recognised as unwanted, Pi-hole returns no usable address and the connection generally stops there.

This method works across browsers and many applications because it operates below the browser extension level. It can reduce tracking requests, improve page loading and save bandwidth. It is especially useful on an NBN connection with several phones, streaming boxes and smart-home devices sharing the same router.

DNS filtering has clear limits. Pi-hole cannot inspect encrypted page content, remove advertisements embedded directly into a video stream, or reliably block every promoted post inside a social media service. YouTube advertising, sponsored search results and first-party adverts often come from the same domains as legitimate content. A browser content blocker may still be useful on your elementary OS computer.

Choose A Stable Pi-hole Host

A Raspberry Pi is a popular choice because it uses little electricity and can run continuously beside your router. A small second-hand mini PC, home server or virtual machine also works. The host should have a dependable local address and remain available whenever the network is in use. If Pi-hole disappears, devices may lose name resolution even though the internet connection itself is working.

Installing Pi-hole directly on elementary OS is possible, but it is rarely the best network-wide arrangement. A desktop is commonly suspended overnight, moved between networks or shut down when nobody is using it. A separate Raspberry Pi connected by Ethernet is generally easier to maintain. If your elementary computer is the only device that needs filtering, a local installation can make sense, provided you understand the availability trade-off.

Give the Pi-hole host a fixed address through your router’s DHCP reservation. This is usually better than manually configuring a static address inside the operating system because the router remains responsible for managing the address pool. In an Australian home, router interfaces vary widely between ISP-supplied hardware from Telstra, Optus, TPG and smaller providers, so look for labels such as “DHCP reservation”, “LAN clients” or “static lease”.

Install Pi-hole Safely

Prepare a supported Linux system with network access, an updated package database and a user account with administrative privileges. On a Debian or Ubuntu-based host, update the system before installation:

sudo apt update
sudo apt full-upgrade

Pi-hole’s official installer can then be downloaded from its project website and run from a terminal. Read the installer screens rather than accepting every default automatically. Select the correct network interface, choose an upstream resolver, enable the web administration interface and record the password it displays. A password manager is a sensible place to store those credentials.

If you prefer containers, Pi-hole can run with Docker Compose on a small server. That approach provides easier separation from the host system, although DNS ports and network modes require careful configuration. For a first installation, the native installer on a dedicated Raspberry Pi is usually less complicated. Avoid downloading installation scripts from unofficial forums or copying commands whose source you cannot verify.

After installation, open the dashboard at the Pi-hole host’s address, for example http://192.168.1.20/admin. The exact address will depend on your network. The dashboard should show DNS queries, blocked requests and the selected upstream provider. Change the web password if required and apply available updates through the administration interface.

Point Elementary OS To The Filter

You can test Pi-hole on one elementary OS computer before changing the whole household network. Open System Settings and select Network. Choose the active wired or Wi-Fi connection, open its settings, select the IPv4 section and replace the automatically supplied DNS server with the Pi-hole address, such as 192.168.1.20. Keep the connection method set to DHCP unless you have a specific reason to alter it.

Disconnect and reconnect to the network, then check which resolver is being used. In Terminal, resolvectl status can show DNS settings for the active connection. You can also query Pi-hole directly:

dig example.com @192.168.1.20

A valid answer confirms that the Pi-hole host is responding. To see whether filtering works, query a domain listed in the dashboard’s blocked activity, or browse the Pi-hole query log while loading a familiar website. A blocked request may return 0.0.0.0, :: or another empty response, depending on the configured blocking mode.

For a network-wide setup, change the router’s DHCP DNS option to advertise the Pi-hole address. New devices will receive the setting automatically when they join the network. Existing devices may need to disconnect and reconnect, renew their lease or restart. If the ISP router does not permit custom DNS settings, place it in bridge mode and use your own router, or configure DNS manually on each device.

Select Upstream DNS And Blocklists

Pi-hole still needs an upstream resolver for domains that are allowed. Common choices include Cloudflare, Quad9, Google Public DNS and the resolver supplied by your ISP. They differ in privacy policies, filtering and performance. Quad9 is often chosen for security-focused malware blocking, while other providers may be selected for speed or familiarity.

You can also configure encrypted DNS between Pi-hole and an upstream service using a separate resolver such as cloudflared or an encrypted DNS proxy. This prevents the local network path from seeing ordinary DNS requests after they leave Pi-hole, although it does not make the destination invisible to every network observer. Keep the design understandable before adding extra components.

Start with Pi-hole’s default lists. Large collections of community blocklists can look impressive, but overlapping or poorly maintained lists may block legitimate services. A website might fail because a payment provider, content delivery network or login domain was added to a broad list. Add reputable lists gradually and watch the query log for false positives.

When something breaks, use the Pi-hole dashboard to identify the blocked hostname. You can allow a specific domain rather than disabling filtering entirely. The same principle applies to household services: an online banking site, a school portal or an Australian streaming service may need a carefully chosen allowlist entry. Make narrow exceptions and remove them if the service later works without one.

Check Browsers, Applications And IPv6

Modern browsers and operating systems can bypass the DNS server supplied by DHCP. Firefox may use DNS over HTTPS, and Chromium-based browsers can also enable secure DNS. If a browser sends requests directly to an external resolver, Pi-hole will not see or block them. Review the browser’s privacy settings and disable its independent secure-DNS mode if network-wide filtering is the priority.

IPv6 can create a similar bypass. If your router advertises an IPv6 DNS server while Pi-hole only handles IPv4, devices may prefer the IPv6 route. Check the Pi-hole documentation for IPv6 configuration, ensure the host has a stable IPv6 address, or disable IPv6 only when you understand the consequences. Many Australian broadband services support IPv6 inconsistently, so test rather than assuming the setting is active.

Some applications use hard-coded DNS servers, VPN tunnels or their own encrypted connection methods. Streaming sticks, games consoles and smart televisions can be particularly opaque. Pi-hole remains useful, but it is not a universal firewall. A VPN configured on a device may intentionally bypass local DNS, while a work laptop may be controlled by company policy.

On elementary OS, desktop notifications can tell you that a connection has changed or that a network service has restarted. If you want to tune those alerts while testing DNS, this notifications guide explains relevant notification controls. Keeping connection notices visible can help identify whether a test involved Wi-Fi, Ethernet or a VPN.

Troubleshoot Common DNS Problems

The most common failure is an incorrect Pi-hole address. Confirm the host’s current lease in the router, then compare it with the DNS address distributed to elementary OS. A typo, a changed DHCP reservation or a second router running its own DHCP service can send clients to the wrong place. Only one device should normally provide DHCP on a simple home network.

If web pages stop loading after changing DNS, temporarily restore automatic DNS on the elementary OS connection. Then test the Pi-hole host itself with ping or ssh, followed by a direct DNS query using dig. This separates a network reachability problem from a filtering problem. The Pi-hole dashboard’s query log can reveal whether requests are arriving and whether a blocklist is responsible.

A local cache can make changes appear slower than they are. Restart the browser, reconnect the network and clear only the relevant cache when necessary. Avoid repeatedly adding domains to the allowlist without checking the log, because modern websites often contact several related domains during a single page load.

You can also use Pi-hole’s command-line diagnostics on its host. Commands such as pihole status, pihole -g and pihole -up report service state, update gravity lists and apply Pi-hole updates. Run maintenance when the network is quiet, and keep a backup of your settings before making substantial list changes. A short maintenance record can be useful in a household where several people rely on the connection for work, study and streaming.

Maintain Privacy And Everyday Reliability

The dashboard provides a useful view of DNS activity, but the query log may contain sensitive information about everyone using the network. Review the retention settings and restrict dashboard access to the local network. Do not expose the Pi-hole administration page directly to the public internet. If remote access is necessary, use a properly secured VPN rather than forwarding the admin port.

Create separate expectations for trusted and guest devices. A guest network can use Pi-hole if you want consistent malware filtering, but some visitors may rely on their own VPN or encrypted DNS. Internet-of-things devices can generate a large number of requests, so monitor them before applying aggressive blocking. A smart speaker or security camera that loses access to its service may need a specific exception.

Keep the Pi-hole host updated, give it reliable power and consider using Ethernet rather than a weak Wi-Fi connection. A small uninterruptible power supply can help in areas affected by short outages or summer storms. If your home network includes a mesh system, confirm that its satellite nodes and guest network use the same DNS policy instead of silently handing out another resolver.

Pi-hole data can also help explain why a page feels slow or why an application is making unexpected connections. If you are documenting your home server configuration or publishing a technical walkthrough, this blog-building guide can help organise notes into a readable format. Clear records of the host address, router settings, upstream resolver and allowlist entries make future troubleshooting much easier.

A practical setup is simple: run Pi-hole on an always-on host with a reserved address, point elementary OS to it, test filtering with dig, then update the router only after the single-device trial works. Keep blocklists moderate, watch for DNS bypasses and allow only the domains that a real service needs. That approach gives an Australian home a quieter, more controlled network without turning everyday browsing into a maintenance project.