Pi-hole and AdGuard Home Docker installation, DNS configuration, blocklist management, DHCP server, whitelist/blacklist, statistics and DoH/DoT support.
Pi-hole and AdGuard Home are self-hosted solutions that provide DNS-based ad and tracker blocking for all devices on your network. Unlike browser extensions, they work network-wide, blocking ads in smart TVs, game consoles, and mobile apps as well.
| Feature | Pi-hole | AdGuard Home |
|---|---|---|
| Interface | Classic, functional | Modern, user-friendly |
| DoH/DoT | Requires plugin | Built-in |
| DHCP | Supported | Supported |
| Regex Rules | Limited | Advanced |
| Setup | Easy | Very easy |
| Performance | Good | Very good |
| Recommended for | Experienced users | Beginners |
# docker-compose.yml
version: '3.8'
services:
pihole:
image: pihole/pihole:latest
container_name: pihole
restart: unless-stopped
ports:
- "53:53/tcp"
- "53:53/udp"
- "127.0.0.1:8080:80"
environment:
TZ: 'Europe/London'
WEBPASSWORD: 'strong-password'
PIHOLE_DNS_: '1.1.1.1;8.8.8.8'
DNSSEC: 'true'
DNSMASQ_LISTENING: 'all'
volumes:
- ./pihole/etc-pihole:/etc/pihole
- ./pihole/etc-dnsmasq.d:/etc/dnsmasq.d
cap_add:
- NET_ADMIN
# Stop the service using port 53 (Ubuntu)
sudo systemctl stop systemd-resolved
sudo systemctl disable systemd-resolved
# Update /etc/resolv.conf
echo "nameserver 8.8.8.8" | sudo tee /etc/resolv.conf
# Start Pi-hole
docker compose up -d
On Ubuntu, systemd-resolved uses port 53. You need to stop this service before starting Pi-hole.
version: '3.8'
services:
adguardhome:
image: adguard/adguardhome:latest
container_name: adguardhome
restart: unless-stopped
ports:
- "53:53/tcp"
- "53:53/udp"
- "127.0.0.1:3000:3000" # Initial setup
- "127.0.0.1:8080:80" # Web interface
- "853:853/tcp" # DNS-over-TLS
- "443:443/tcp" # DNS-over-HTTPS
volumes:
- ./adguard/work:/opt/adguardhome/work
- ./adguard/conf:/opt/adguardhome/conf
docker compose up -d
# Initial setup: http://SERVER_IP:3000
The easiest method for all network devices is to change DNS on the router:
Router Admin Panel → DHCP Settings
Primary DNS: SERVER_IP (Pi-hole/AdGuard IP)
Secondary DNS: 1.1.1.1 (backup)
# Linux
sudo nano /etc/resolv.conf
nameserver SERVER_IP
# Windows (PowerShell)
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses SERVER_IP
Group Management → Adlists → Add
Popular lists:
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://adaway.org/hosts.txt
https://v.firebog.net/hosts/Easylist.txt
https://v.firebog.net/hosts/Easyprivacy.txt
https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/spy.txt
# Update gravity (refresh lists)
docker exec pihole pihole -g
Filters → DNS blocklists → Add blocklist
Recommended lists:
- AdGuard DNS filter (default)
- EasyList
- EasyPrivacy
- Malware Domains
- AdAway Default Blocklist
# Add to whitelist
docker exec pihole pihole -w example.com
# Add to blacklist
docker exec pihole pihole -b ads.example.com
# Regex blacklist
docker exec pihole pihole --regex '(^|\.)ads\..*'
# View lists
docker exec pihole pihole -q example.com
Filters → Custom filtering rules
# Block
||ads.example.com^
# Allow (whitelist)
@@||example.com^
# Regex block
/^ads\..*/
You can use Pi-hole or AdGuard Home as a DHCP server:
Pi-hole: Settings → DHCP
- DHCP server enabled: On
- Range: 192.168.1.100 - 192.168.1.200
- Router: 192.168.1.1
- Lease time: 24 hours
AdGuard Home: Settings → DHCP settings
- Enable DHCP server
- IP range: 192.168.1.100 - 192.168.1.200
- Gateway: 192.168.1.1
Disable DHCP on your router before enabling it on Pi-hole/AdGuard. Two DHCP servers cause network issues.
# AdGuard Home supports this natively
# SSL certificate required
Settings → Encryption settings:
- Enable encryption: On
- Server name: dns.example.com
- HTTPS port: 443
- DNS-over-TLS port: 853
- Certificate: /opt/adguardhome/conf/cert.pem
- Private key: /opt/adguardhome/conf/key.pem
# Add to docker-compose.yml
cloudflared:
image: cloudflare/cloudflared:latest
container_name: cloudflared
restart: unless-stopped
command: proxy-dns --port 5053 --upstream https://1.1.1.1/dns-query
network_mode: host
Pi-hole → Settings → DNS
Custom DNS: 127.0.0.1#5053
Pi-hole Dashboard: http://SERVER_IP/admin
- Total queries
- Blocked queries (%)
- Top blocked domains
- Most active clients
- Time-based graph
AdGuard Home Dashboard: http://SERVER_IP:8080
- DNS query statistics
- Blocking rate
- Top blocked domains
- Client statistics
By installing Pi-hole or AdGuard Home on REXE VPS servers, you can filter all your server traffic. DNS-based filtering is especially effective in environments running multiple containers.
Another service may be using port 53. On Ubuntu, stop systemd-resolved: sudo systemctl stop systemd-resolved. Check /etc/resolv.conf and temporarily add 8.8.8.8. Verify the Pi-hole container is running with docker ps. Update the DNS setting on your router to the Pi-hole IP.
The site may be accidentally blocked. In Pi-hole, find which domain is blocked from Query Log and add it to the whitelist: pihole -w domain.com. In AdGuard Home, add @@||domain.com^ to Filters → Custom filtering rules. If using very aggressive blocklists, try disabling some of them.
Blocking rate varies by network usage. 20-30% is considered normal for ad-heavy usage. Add more blocklists to increase the rate. Make sure devices are using Pi-hole/AdGuard as DNS (some apps use their own DNS). Apps using encrypted DNS (DoH/DoT) may not be filterable.
Make sure DHCP on the router is completely disabled. Check that the Pi-hole DHCP range doesn't overlap with the router's old range. Renew network connection on affected devices: ipconfig /release && ipconfig /renew (Windows) or dhclient -r (Linux). Check Pi-hole DHCP logs.
Upload an SSL certificate from the Encryption settings section in AdGuard Home. DNS-over-HTTPS URL: https://dns.example.com/dns-query. Add this URL as a DoH server on devices. Windows 11, Android 9+, and iOS 14+ have built-in DoH support. In Firefox, use about:config → network.trr.uri setting.
Running both on the same server is not possible because both use port 53. You can run them on different servers or different IPs. Alternatively, you can use one as primary and the other as secondary DNS. For most users, choosing one of them is sufficient.
Coolify installation, Docker and Git integration, application deployment, database management, SSL certificates, environment variables, and self-hosted PaaS alternative to Heroku/Netlify.
Nextcloud installation with Docker, Apache/Nginx configuration, database setup, SSL certificate, file synchronization, app store, and performance optimization.
Portainer CE installation, Docker and Kubernetes management, stack deployment, volume/network management, user authorization, webhook and GitOps integration.