News: 1741426207

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

Stuff a Pi-hole in your router because your browser is about to betray you

(2025/03/08)


A new, lightweight version of Pi-Hole is here. Just how easy is it to block advertising on your home network?

[1]Pi-Hole 6 appeared a few weeks ago. Since then, there have been a few small bug fixes and it's now up to [2]version 6.0.5 . The new release is lighter weight and has fewer external dependencies: it no longer needs PHP or an external web server. If you run the Docker container version on top of another Linux OS, it's lighter still, as the container is now based on Alpine Linux instead of Debian. Is it really worth setting up a dedicated ad-blocker on your own network? We decided it was high time to try.

Why now?

In the last year, you could be forgiven for feeling that web browser suppliers are actively working to make us trust them less. Last year, Mozilla [3]bought an ad company ; this month, it [4]removed its promise not to sell your info .

Meanwhile, Google is nearing the end of the process of [5]turning off the extension system that uBlock Origin uses . It's gone from [6]Chrome 134 , which came out the same day as [7]Firefox 136 . Once Chrome updates, you must either switch to the less-capable [8]uBlock Origin Lite or an equivalent, or lose ad-blocking altogether. This also goes for anything based on this or subsequent versions of Chrome, such as Microsoft Edge. While downstream vendors may be able to keep the older Manifest V2 around for a while, sooner or later, they face the choice of updating to a newer version of Chromium and dropping it, or forking Chromium's [9]45-million-line codebase.

[10]

Pi-Hole 6 has a good-looking web-management screen to show what it's doing – click to enlarge

Enter [11]Pi-hole (a play on [12]pie hole , which is the American English for the British [13]cake hole – mainly used when telling someone to close it). Pi-hole takes over as your network's name server, and silently redirects all web requests to known ad-server addresses to a [14]DNS sinkhole . Everything else is passed upstream to the public DNS server of your choice. Only requests for ads silently fail, and the rest of the page loads as normal. The result is you see fewer ads.

What you need

In terms of the computer power it needs, this is a very simple task. It's like putting up a diversion sign, rather than a bridge. The Pi-hole doesn't carry traffic, it merely diverts some of it. As a result, the requirements for the system running the Pi-hole software are very modest.

The snag, however, is that there are other external requirements. The documentation says that you really want a machine with a wired Ethernet connection into your router, not Wi-Fi, and that machine needs to have a static IP address. A permanent DHCP lease is enough, but this means you must be willing and able to log into your router and adjust its settings. It doesn't need any inbound access from the outside world, so there's no significant additional security risk.

As the name implies, Pi-hole can run on a very low-end computer such as a Raspberry Pi. This includes old models, but not the Pi Zero, as these budget models lack Ethernet ports. An older full-size Pi is probably cheaper, easier, and more reliable than trying to add Ethernet to a Pi without it. A 32-bit machine should be fine.

[15]

If you are the sort of techie who already has a Linux box running on your network somewhere, such as a NAS server, Pi-hole is [16]also available as a Docker container , which some commercial dedicated NAS boxes can run. Failing that, a very elderly laptop, even one with a clapped-out battery and a broken screen, would suffice.

[17]

Pi-hole 6 has remarkably frugal resource usage: a passively cooled Pi 3B is overkill for the job – click to enlarge

We decided to try it on an old [18]Raspberry Pi 3B that had been sitting in a box for a few years. A 64-bit quad-core is overkill for this job. A [19]Raspberry Pi 2 would do fine, but we sold ours when we bought the Pi 3. The [20]system requirements are so modest that even a Pi 1 might do. In use, our Pi used about 12 percent of its 1 GB of RAM, and single-digit CPU usage if that.

How to do it

Pi-hole doesn't come as a complete distro. It's a small collection of software that you install onto an existing Linux box. The [21]supported list is the Raspberry Pi OS, Armbian, Ubuntu, Debian, Fedora, and CentOS Stream. We decided to take the path of least resistance, and used the Raspberry Pi Imager to write the [22]latest Raspberry Pi OS Lite onto a 16 GB microSD card. We should have gone with a smaller one: it's only using 2.2 GB, and an 8 GB card would have been enough.

[23]Big browsers are about to throw a wrench in your ad-free paradise

[24]Revamped Raspberry Pi OS boasts Wayland desktop and improved imager tool

[25]Smart ovens do really dumb stuff to check for Wi-Fi

[26]I spy with my little Pi: Upgraded cameras for single board computer

Using a Wi-Fi connection, we updated Pi OS, rebooted, then started the [27]Pi-hole installation process . You can opt to continue, but the setup routine defaults to quitting until you confirm that you've set up a static IP. So we did. We cabled the Pi into a switch, gave it a static IP address on the router, then restarted setup. The next step is to [28]choose an upstream DNS server . We went with the default here, but some of the alternatives offer stricter blocking of their own.

Once Pi-hole is installed and you've rebooted the machine, you can test it by manually setting one computer's DNS server to the Pi-hole address. If it works, there's only one mandatory setup step left: [29]change the router's DHCP settings and set the DNS server to the Pi-hole's address. The Pi-hole's hostname doesn't matter much.

[30]

[31]

In case your router won't let you change its DHCP settings, another option is to turn the router's DHCP off and use Pi-hole's built-in DHCP instead.

Is it worth it?

So far, so good, and a definite affirmative. Comparing notes, some other vultures at The Register are also running Pi-hole. Ads consume a surprising amount of the bulk of some sites these days, so there are both speed gains and data usage reductions to be had. If you're on a metered connection, it's definitely worth a try.

Whether this sounds worth the effort depends on your personal preferences. For us, the setup and configuration process was considerably quicker than the time it took to find the Pi and a suitable power supply, plus a spare SD card, and hook it into the switch on our server shelf. (We also [32]configured the unattended-upgrades tool to keep Pi OS fresh.)

As it happens, our home NAS servers run FreeBSD, not Linux, so running a Pi-hole VM would take more resources than our geriatric HP Microservers could really spare – and of course, a NAS box uses a lot more electricity, as well as emitting heat and noise. If you have a Linux box that's always running anyway, though, your mileage may vary.

[33]

We found the setup process easy and quick, but you do need to tweak your router settings. We've yet to find anything that isn't working right.

A small potential snag is that because the same system runs on multiple distros, Pi-hole lacks its own repository, so [34]updates must be performed manually – although we may investigate scheduling that.

Alternatives

There are other ways. For instance, it is possible to run an OS-level ad blocker. Most Linux distributions include [35]Privoxy , for instance, and you can also install it on Windows or macOS, where it runs in the background, filtering requests from your browsers. Download and [36]install it , then go into your network settings and set your web proxy to localhost:8118 for both HTTP and HTTPS, and that's about it.

Privoxy has pros and cons. Advantages include that it works for all your browsers, and for road warriors, it travels with you and filters any network you happen to use. (The exceptionally dedicated could configure a VPN and [37]access their home Pi-hole from elsewhere , but that definitely sounds like too much work for our tastes.)

The main drawback of a filtering proxy is that you need to run copies on all your computers – and it won't help with phones, tablets, smart TVs, and other devices on which you can't do that. ®

Bootnote

If any loyal Reg readers have built a [38]Pi-hole allow-list to whitelist El Reg and its sister sites, do please let us know in the comments.

Get our [39]Tech Resources



[1] https://pi-hole.net/blog/2025/02/18/introducing-pi-hole-v6/

[2] https://github.com/pi-hole/pi-hole/releases/tag/v6.0.5

[3] https://www.theregister.com/2024/06/18/mozilla_buys_anonym_betting_privacy/

[4] https://www.theregister.com/2025/03/02/mozilla_introduces_terms_of_use/

[5] https://www.theregister.com/2025/02/24/google_v2_eol_v3_rollout/

[6] https://developer.chrome.com/release-notes/134

[7] https://www.theregister.com/2025/03/04/firefox_136/

[8] https://github.com/uBlockOrigin/uBOL-home

[9] https://openhub.net/p/chrome/analyses/latest/languages_summary

[10] https://regmedia.co.uk/2025/03/06/pi-hole_6_ui.jpg

[11] https://pi-hole.net/

[12] https://www.merriam-webster.com/dictionary/piehole

[13] http://www.freewordfinder.com/dictionary/cakehole/

[14] https://www.catchpoint.com/network-admin-guide/dns-sinkhole

[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Z8wjU8-50EBNIS38RKtJoQAAAZc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[16] https://github.com/pi-hole/docker-pi-hole

[17] https://regmedia.co.uk/2025/03/06/pihole_usage.jpg

[18] https://www.theregister.com/2018/03/14/happy_pi_day_raspberry_pi_model_3b_plus/

[19] https://www.theregister.com/2015/02/02/raspberry_pi_model_2/

[20] https://pihole-docs.netlify.app/main/prerequisites/

[21] https://docs.pi-hole.net/main/prerequisites/#supported-operating-systems

[22] https://www.raspberrypi.com/software/operating-systems/#raspberry-pi-os-64-bit

[23] https://www.theregister.com/2024/10/21/ublock_firefox_chrome_issues/

[24] https://www.theregister.com/2023/11/03/raspberry_pi_os_5/

[25] https://www.theregister.com/2023/01/26/smart_ovens_do_dumb_stuff/

[26] https://www.theregister.com/2023/01/10/raspberry_pi_camera_module_3/

[27] https://docs.pi-hole.net/main/basic-install/

[28] https://docs.pi-hole.net/guides/dns/upstream-dns-providers/

[29] https://docs.pi-hole.net/main/post-install/

[30] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z8wjU8-50EBNIS38RKtJoQAAAZc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[31] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z8wjU8-50EBNIS38RKtJoQAAAZc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[32] https://wiki.debian.org/UnattendedUpgrades

[33] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z8wjU8-50EBNIS38RKtJoQAAAZc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[34] https://docs.pi-hole.net/main/update/

[35] https://www.privoxy.org/

[36] https://www.privoxy.org/user-manual/installation.html

[37] https://docs.pi-hole.net/guides/vpn/openvpn/

[38] https://docs.pi-hole.net/guides/misc/allowlist-denylist/

[39] https://whitepapers.theregister.com/



Lazy slacker...

keithpeter

...uses an /etc/hosts file with a fair range of ad servers pointed at 0.0.0.0.

This is a per-machine ploy and no good for phones.

Interesting article.

Re: Lazy slacker...

TonyHoyle

Hosts doesn't scale.. it's a text file searched linearly. There are better solutions these days.

Mashed

Lon24

Version 6 mashed my server. The server that also performs some other essential LAN tasks that require a Nginx - like to control all my smart switches.

I've used Pi-hole for years and updates just worked. Unsuspectingly - there was no warning - it upgraded to version 6 and everything stopped. It even required sudo to try and sort. I also tried the fixes that other panic struck Admins had posted but losing your DNS and other LAN functions is not a nice feeling. Of course I had a cloned backup which I chucked at it and have resisted upgrading until I know the issues are fixed and it will either work with other software again or whether I need to spin it off onto a dedicated server.

New versions of software are invariably more buggy than the last. For vital apps a warning is really necessary so the unbrave can await the hiccup reports of the brave which alphas, betas and RCs don't reveal.

But devs, I still love you!

Re: Mashed

malfeasance

I suspect it’s that the settings from /etc/dnsmasq.d are no longer read and are directly embedded in the Pihole toml config.

There’s a env var you can set to revert the behaviour (FTLCONF_misc_etc_dnsmasq_d)

When I upgraded I had switchable terraform config based on the docker image (2024.07.0 used v5 config etc) while I was testing it out.

A couple of weeks later I’m finding it exactly the same functionally for DNS but the HTTP api has changed massively so if you have tooling that uses that I would still hold off until the tooling catches up.

Re: Mashed

Anonymous Coward

There was supposed to have been a warning during update, but I was one of many that didn't appear for. And sod's law I skipped the backup on this update. Doh!

What also didn't appear was the warning to disable lighttpd.

A fix here:

https://discourse.pi-hole.net/t/pi-hole-update-caused-web-to-stop-and-no-resolution/76412/3

Also need to carefully read the scrolling text of the update as there is an easy to miss line in there with your new webpage admin password.

Of course, trying to diagnose the network and read online details is tricky when you have no network. LOL. Which meant I had to do some research via my phone's 4G to get this fixed.

All running lovely again now. Have use a PI and PI-Hole for many years.

Definitely worth it

Anonymous Coward

... Is it really worth setting up a dedicated ad-blocker on your own network?

Yes, definitely so.

I have been running Pi-hole as a recursive DNS server on a VM in my Linux box (Devuan) for over three years now and it performs quite well.

Had no issues updating to v6.

Kudos to the Pi-hole devs for their work.

.

TonyHoyle

I have a pair of adguard servers (they don't sync but are on physically separate machines) plus my normal dns. I've been thinking of collapsing it all into a bind9 dlz adblock (https://github.com/Trellmor/bind-adblock) as I don't need a UI most of the time, except when I need to temporarily disable it.

Individualists unite!