How to Set Up Network-Wide Ad Blocking and Private DNS with Pi-hole and Unbound

Browser based ad blockers only protect the browser they're installed in — your phone, your smart TV, and every other device on your network are still sending e…

Browser-based ad blockers only protect the browser they're installed in — your phone, your smart TV, and every other device on your network are still sending every DNS query to whatever resolver your ISP hands out, unfiltered and logged. Pi-hole solves this at the network level, blocking ads and trackers for every device on your Wi-Fi automatically, no per-device install required. Paired with Unbound as a recursive resolver, you also stop relying on any third-party DNS provider entirely. This guide sets up both from scratch.

Why Pi-hole + Unbound Together

Pi-hole alone still forwards allowed queries to an upstream DNS provider — Google, Cloudflare, whoever you configure — which means that provider still sees every domain you visit, filtered or not. Unbound removes that dependency by resolving DNS queries directly from the root servers itself, recursively, rather than asking someone else's resolver. Together: Pi-hole blocks known ad/tracker domains, and everything that passes through gets resolved privately rather than logged by a third party.

Prerequisites / What You'll Need

A small always-on machine — a Raspberry Pi, an old laptop, or a spare VM all work fine
A fresh Debian/Ubuntu-based OS on that machine
Admin access to your router (to change the network's DNS setting)
30–45 minutes

Step 1: Install Pi-hole

Pi-hole's official installer handles almost everything:

curl -sSL https://install.pi-hole.net | bash

Run through the interactive installer:

Choose your active network interface
When prompted for an upstream DNS provider, pick any option for now — we'll override it once Unbound is running
Enable the web admin interface when asked

At the end, the installer prints an auto-generated admin password — save it, or set your own:

pihole -a -p

Step 2: Verify Pi-hole Is Working

Visit the admin dashboard at http://<pi-hole-ip>/admin and confirm it loads. Point a single device's DNS at the Pi-hole's IP temporarily and browse a few sites — you should start seeing query counts climb on the dashboard.

pihole status

Step 3: Install Unbound

sudo apt update
sudo apt install -y unbound

Download the current root hints file, which Unbound needs to know where to start resolving from:

sudo wget https://www.internic.net/domain/named.root -O /var/lib/unbound/root.hints

Step 4: Configure Unbound

Create a Pi-hole-specific config file:

sudo nano /etc/unbound/unbound.conf.d/pi-hole.conf

server:
    verbosity: 0
    interface: 127.0.0.1
    port: 5335
    do-ip4: yes
    do-udp: yes
    do-tcp: yes
    do-ip6: no

    root-hints: "/var/lib/unbound/root.hints"

    harden-glue: yes
    harden-dnssec-stripped: yes
    use-caps-for-id: no
    edns-buffer-size: 1232
    prefetch: yes

    num-threads: 2
    so-rcvbuf: 1m

    private-address: 192.168.0.0/16
    private-address: 10.0.0.0/8
    private-address: 172.16.0.0/12

Key settings worth understanding:

port: 5335 — Unbound listens on a non-standard port, since Pi-hole itself needs port 53
harden-dnssec-stripped: yes — rejects responses where DNSSEC validation was expected but missing, protecting against a class of spoofing attacks
private-address ranges — prevents Unbound from returning private/internal IP ranges for public DNS queries, a basic protection against DNS rebinding attacks

Restart Unbound and confirm it's listening:

sudo systemctl restart unbound
sudo systemctl enable unbound
ss -tulpn | grep 5335

Step 5: Test Unbound Directly

Before wiring it into Pi-hole, confirm Unbound can actually resolve queries on its own:

dig @127.0.0.1 -p 5335 cloudflare.com

You should get a valid response with an ANSWER SECTION containing IP addresses. If this fails, don't move on — troubleshoot Unbound in isolation first, since a Pi-hole layer on top only adds complexity to debugging.

Step 6: Point Pi-hole at Unbound

In the Pi-hole admin dashboard:

Go to Settings → DNS
Under Upstream DNS Servers, uncheck any existing providers
Check Custom 1 (IPv4) and enter 127.0.0.1#5335
Save

From this point on, every query Pi-hole doesn't block gets resolved by your own Unbound instance, not a third-party DNS provider.

Step 7: Point Your Network at Pi-hole

The final step is making every device on your network actually use it. The cleanest approach is at the router level rather than per-device:

Log into your router's admin panel
Find the DHCP/DNS settings
Set the primary DNS server to your Pi-hole's IP address
Save and, if needed, reboot devices (or wait for DHCP leases to renew) to pick up the new setting

Tip: Give your Pi-hole machine a static IP (either via router DHCP reservation or a static config on the device itself) before doing this — if its IP changes later, every device on your network silently loses DNS resolution.

Step 8: Add Blocklists

Pi-hole ships with one default blocklist, but the community maintains much more comprehensive ones. In the admin dashboard:

Go to Group Management → Adlists
Add additional curated lists — firebog.net maintains a well-tested collection organized by category
Go to Tools → Update Gravity to apply them

Start with a moderate set rather than every list available — overly aggressive blocking breaks legitimate sites, and you'll spend more time whitelisting than the extra blocking was worth.

Common Pitfalls / Troubleshooting

A device bypasses Pi-hole entirely. Some phones and smart devices hardcode a DNS provider (like Google's 8.8.8.8) regardless of DHCP settings. Block outbound port 53 to everything except your Pi-hole at the router/firewall level to force compliance.
Unbound queries timing out. Usually a firewall or outbound connectivity issue — Unbound needs to reach the actual root DNS servers over the internet, unlike Pi-hole's simpler forwarding model. Confirm outbound UDP/TCP port 53 isn't blocked.
Legitimate sites breaking after adding blocklists. Check Query Log in the Pi-hole dashboard, find the blocked domain causing the issue, and whitelist it specifically rather than disabling entire lists.
Pi-hole becomes a single point of failure. If the Pi-hole machine goes down, DNS for your whole network goes with it. Add a fallback secondary DNS in your router config (even a public resolver) so a single outage doesn't take down internet access for everyone.
Forgetting to update Pi-hole and blocklists. Run pihole -up periodically for software updates, and keep gravity updates on a schedule (Pi-hole does this via cron automatically, but it's worth confirming with pihole -g).

Wrapping Up

Once this is running, every device on your network — TVs, phones, laptops, IoT gadgets that can't run their own ad blocker — gets protected automatically, and your DNS queries stop being handed to a third party to log. The two pieces complement each other well: Pi-hole for filtering, Unbound for privacy and independence from any single provider.

From here, reasonable next steps include enabling DNS-over-HTTPS on client devices that support it for encrypted queries to Pi-hole itself, setting up a second Pi-hole instance for redundancy using gravity-sync to keep both in sync, and reviewing the Pi-hole query log periodically to spot devices phoning home more than expected.