Pi-hole and AdGuard Home Setup: Network-Wide Ad Blocking

Pi-hole and AdGuard Home are self-hosted solutions that provide DNS-based ad and tracker blocking for all devices on your network. Unlike browser extensions, they work network-wide, blocking ads in smart TVs, game consoles, and mobile apps as well.

Pi-hole vs AdGuard Home Comparison

Feature	Pi-hole	AdGuard Home
Interface	Classic, functional	Modern, user-friendly
DoH/DoT	Requires plugin	Built-in
DHCP	Supported	Supported
Regex Rules	Limited	Advanced
Setup	Easy	Very easy
Performance	Good	Very good
Recommended for	Experienced users	Beginners

System Requirements

Server or Raspberry Pi with Docker and Docker Compose
Minimum 512 MB RAM
Static IP address (important for DNS server)
Port 53 must be available

Pi-hole Docker Installation

hljs yaml

# docker-compose.yml
version: '3.8'

services:
  pihole:
    image: pihole/pihole:latest
    container_name: pihole
    restart: unless-stopped
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "127.0.0.1:8080:80"
    environment:
      TZ: 'Europe/London'
      WEBPASSWORD: 'strong-password'
      PIHOLE_DNS_: '1.1.1.1;8.8.8.8'
      DNSSEC: 'true'
      DNSMASQ_LISTENING: 'all'
    volumes:
      - ./pihole/etc-pihole:/etc/pihole
      - ./pihole/etc-dnsmasq.d:/etc/dnsmasq.d
    cap_add:
      - NET_ADMIN

hljs bash

# Stop the service using port 53 (Ubuntu)
sudo systemctl stop systemd-resolved
sudo systemctl disable systemd-resolved

# Update /etc/resolv.conf
echo "nameserver 8.8.8.8" | sudo tee /etc/resolv.conf

# Start Pi-hole
docker compose up -d

On Ubuntu, systemd-resolved uses port 53. You need to stop this service before starting Pi-hole.

AdGuard Home Docker Installation

hljs yaml

version: '3.8'

services:
  adguardhome:
    image: adguard/adguardhome:latest
    container_name: adguardhome
    restart: unless-stopped
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "127.0.0.1:3000:3000"  # Initial setup
      - "127.0.0.1:8080:80"    # Web interface
      - "853:853/tcp"           # DNS-over-TLS
      - "443:443/tcp"           # DNS-over-HTTPS
    volumes:
      - ./adguard/work:/opt/adguardhome/work
      - ./adguard/conf:/opt/adguardhome/conf

hljs bash

docker compose up -d
# Initial setup: http://SERVER_IP:3000

DNS Configuration

Setting DNS on Router (Recommended)

The easiest method for all network devices is to change DNS on the router:

Router Admin Panel → DHCP Settings
Primary DNS: SERVER_IP (Pi-hole/AdGuard IP)
Secondary DNS: 1.1.1.1 (backup)

Per-Device DNS Configuration

hljs bash

# Linux
sudo nano /etc/resolv.conf
nameserver SERVER_IP

# Windows (PowerShell)
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses SERVER_IP

Blocklist Management

Adding Pi-hole Blocklists

Group Management → Adlists → Add

Popular lists:
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://adaway.org/hosts.txt
https://v.firebog.net/hosts/Easylist.txt
https://v.firebog.net/hosts/Easyprivacy.txt
https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/spy.txt

hljs bash

# Update gravity (refresh lists)
docker exec pihole pihole -g

AdGuard Home Filter Lists

Filters → DNS blocklists → Add blocklist

Recommended lists:
- AdGuard DNS filter (default)
- EasyList
- EasyPrivacy
- Malware Domains
- AdAway Default Blocklist

Whitelist and Blacklist

Pi-hole

hljs bash

# Add to whitelist
docker exec pihole pihole -w example.com

# Add to blacklist
docker exec pihole pihole -b ads.example.com

# Regex blacklist
docker exec pihole pihole --regex '(^|\.)ads\..*'

# View lists
docker exec pihole pihole -q example.com

AdGuard Home

Filters → Custom filtering rules

# Block
||ads.example.com^

# Allow (whitelist)
@@||example.com^

# Regex block
/^ads\..*/

DHCP Server

You can use Pi-hole or AdGuard Home as a DHCP server:

Pi-hole: Settings → DHCP
- DHCP server enabled: On
- Range: 192.168.1.100 - 192.168.1.200
- Router: 192.168.1.1
- Lease time: 24 hours

AdGuard Home: Settings → DHCP settings
- Enable DHCP server
- IP range: 192.168.1.100 - 192.168.1.200
- Gateway: 192.168.1.1

Disable DHCP on your router before enabling it on Pi-hole/AdGuard. Two DHCP servers cause network issues.

DoH and DoT Configuration

AdGuard Home with DoH/DoT

hljs yaml

# AdGuard Home supports this natively
# SSL certificate required

Settings → Encryption settings:
- Enable encryption: On
- Server name: dns.example.com
- HTTPS port: 443
- DNS-over-TLS port: 853
- Certificate: /opt/adguardhome/conf/cert.pem
- Private key: /opt/adguardhome/conf/key.pem

Pi-hole with DoH (Cloudflared)

hljs yaml

# Add to docker-compose.yml
cloudflared:
  image: cloudflare/cloudflared:latest
  container_name: cloudflared
  restart: unless-stopped
  command: proxy-dns --port 5053 --upstream https://1.1.1.1/dns-query
  network_mode: host

Pi-hole → Settings → DNS
Custom DNS: 127.0.0.1#5053

Statistics Dashboard

Pi-hole Dashboard: http://SERVER_IP/admin
- Total queries
- Blocked queries (%)
- Top blocked domains
- Most active clients
- Time-based graph

AdGuard Home Dashboard: http://SERVER_IP:8080
- DNS query statistics
- Blocking rate
- Top blocked domains
- Client statistics

By installing Pi-hole or AdGuard Home on REXE VPS servers, you can filter all your server traffic. DNS-based filtering is especially effective in environments running multiple containers.

Pi-hole and AdGuard Home Setup: Network-Wide Ad Blocking

Table of Contents