How to Use a Raspberry Pi to Block Ads Network-Wide with Pi-hole

Project Overview & Hardware Spec Sheet

Using a Raspberry Pi to block ads via a network-wide DNS sinkhole is one of the most practical embedded projects you can deploy. By running Pi-hole, your Pi intercepts DNS queries and drops requests to known ad-serving domains before they ever reach your devices. This stops ads on smart TVs, mobile games, and IoT devices that don't support browser extensions.

While you can run this on any Pi, the Raspberry Pi 4 Model B (2GB RAM) remains the optimal balance of cost, thermal performance, and network throughput for a dedicated 24/7 DNS server in 2026. The Pi 5 is overkill for simple DNS resolution and draws more idle power, while the Pi Zero 2 W relies on USB-to-Ethernet adapters or WiFi, which introduces latency and reliability risks for a primary network service.

Parts List & Exact Variants

GPIO Pin Mapping Table

To ensure the Pi doesn't become a "black box" when headless, we will wire a physical status LED and a safe-shutdown button. This code targets the standard 40-pin header on the Raspberry Pi 4 Model B (and is fully backward/forward compatible with the Pi 5).

Step-by-Step: Installing Pi-hole to Block Ads

Before wiring the GPIO components, flash Raspberry Pi OS Lite (64-bit) to your microSD card using the Raspberry Pi Imager. Use the OS customization menu to enable SSH, set your hostname to pihole, and configure your WiFi (though Ethernet is strongly recommended).

1. Assign a Static IP: SSH into your Pi and run sudo nano /etc/dhcpcd.conf. Add the following lines at the bottom (adjust IP and gateway to match your router):

   interface eth0
   static ip_address=192.168.1.10/24
   static routers=192.168.1.1
   static domain_name_servers=1.1.1.1 8.8.8.8

2. Reboot and Install: Run sudo reboot, then SSH back in. Execute the official install script: curl -sSL https://install.pi-hole.net | bash.
3. Follow the TUI Prompts: Select eth0 as your interface. Choose your preferred upstream DNS provider (e.g., Cloudflare or Quad9). Select the default blocklists.
4. Configure Router DHCP: Log into your router's admin panel. Change the primary DNS server handed out by DHCP to your Pi's static IP (192.168.1.10). Leave the secondary DNS blank or point it to a backup Pi-hole instance to force all traffic through the sinkhole.

Python GPIO Monitor Script (With Error Handling)

Headless servers are notorious for failing silently. This Python script uses the gpiozero library to poll the pihole-FTL systemd service. If the DNS engine crashes, the LED blinks. If you need to cut power safely, hold the tactile button for 3 seconds to trigger a graceful shutdown.

#!/usr/bin/env python3
import time
import subprocess
import sys
from gpiozero import LED, Button
from signal import pause

# Pin Definitions for Raspberry Pi 4/5 (BCM Numbering)
STATUS_LED_PIN = 17
SHUTDOWN_BTN_PIN = 27

# Initialize Hardware
led = LED(STATUS_LED_PIN)
btn = Button(SHUTDOWN_BTN_PIN, hold_time=3, bounce_time=0.2)

def check_pihole_status():
    """Checks if the pihole-FTL DNS service is active."""
    try:
        result = subprocess.run(
            ['systemctl', 'is-active', 'pihole-FTL'],
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,
            text=True,
            check=False
        )
        return result.stdout.strip() == 'active'
    except FileNotFoundError:
        print("Error: systemctl not found. Are you running a systemd OS?", file=sys.stderr)
        return False
    except Exception as e:
        print(f"Subprocess error checking service: {e}", file=sys.stderr)
        return False

def shutdown_pi():
    """Triggers a safe system halt when the button is held."""
    print("Shutdown button held for 3s. Halting system...")
    led.blink(0.2, 0.2)  # Rapid blink to indicate shutdown sequence
    try:
        subprocess.run(['sudo', 'shutdown', '-h', 'now'], check=True)
    except Exception as e:
        print(f"Failed to execute shutdown command: {e}", file=sys.stderr)

# Bind button hold event
btn.when_held = shutdown_pi

if __name__ == "__main__":
    print("Starting Pi-hole GPIO Hardware Monitor...")
    try:
        while True:
            if check_pihole_status():
                led.on()  # Solid ON = DNS Engine Healthy
            else:
                led.blink(1, 1)  # Slow Blink = FTL Service Down
            time.sleep(5)
    except KeyboardInterrupt:
        print("\nMonitor interrupted by user. Cleaning up GPIO.")
        led.off()
        sys.exit(0)

Save this as pihole_monitor.py and set it to run on boot via a systemd service or crontab using @reboot /usr/bin/python3 /home/pi/pihole_monitor.py &.

Debugging: "Address already in use" and DNS Failures

The most common point of failure when setting up a Raspberry Pi to block ads is a port conflict. If Pi-hole fails to start after installation or a reboot, check the FTL logs using sudo journalctl -u pihole-FTL.

Ranked Causes and Fixes

1. Cause: systemd-resolved is hijacking port 53. Modern Raspberry Pi OS releases sometimes enable local DNS stub listeners.
   Fix: Run sudo nano /etc/systemd/resolved.conf. Uncomment and change #DNSStubListener=yes to DNSStubListener=no. Then restart the service: sudo systemctl restart systemd-resolved.
2. Cause: A stale pihole-FTL process is hung in the background. This happens if the Pi lost power during a write operation.
   Fix: Force kill the orphaned process with sudo killall -9 pihole-FTL, then start it cleanly with sudo systemctl start pihole-FTL.
3. Cause: Another DNS server (like bind9 or dnsmasq) is installed.
   Fix: Identify the culprit using sudo lsof -i :53 and uninstall or disable the conflicting package.

The First Three Things to Check When Network Ad-Blocking Fails

If the Pi-hole dashboard shows queries, but ads are still appearing on your devices, check these three vectors immediately:

1. Router DHCP Override: Many modern mesh routers (like Eero or Orbi) hardcode their own DNS and ignore your custom DHCP settings. You may need to disable "Secure DNS" or "DNS Rebinding Protection" in the router's advanced settings, or manually set the DNS on individual devices.
2. Hardcoded Device DNS: Smart TVs and gaming consoles often ignore DHCP DNS assignments and query 8.8.8.8 directly. To force them through the Pi, create a firewall rule on your router blocking outbound port 53 (UDP/TCP) from all IPs except your Pi's static IP.
3. IPv6 Leaks: If your ISP uses IPv6 and your Pi-hole isn't configured with a global IPv6 address, devices will bypass the Pi and use the router's IPv6 DNS. Assign a static IPv6 ULA address to your Pi and distribute it via DHCPv6.

Extending and Simplifying Your Ad-Blocker

How to Extend: For maximum privacy, pair Pi-hole with Unbound. By default, Pi-hole forwards your unblocked DNS queries to a third party like Google or Cloudflare. Installing Unbound turns your Raspberry Pi into a recursive DNS resolver, querying the root servers directly. This eliminates third-party logging of your browsing habits. Follow the official Unbound integration guide to set it up on port 5335.

How to Simplify: If you don't want to dedicate a $45 Pi 4 to this task, you can simplify the build by deploying Pi-hole inside a Docker container on a Raspberry Pi 5 that is already running Home Assistant or a media server. Alternatively, use a Raspberry Pi Zero 2 W ($15) if you are willing to accept WiFi latency and lower query-per-second limits (the Zero 2 W caps out around 2,500 QPS, which is still sufficient for a household of 4).

Frequently Asked Questions

Can a Raspberry Pi block ads on YouTube and Twitch?

No. DNS-level ad blocking works by blacklisting specific domains that serve ad payloads (e.g., ads.doubleclick.net). However, platforms like YouTube, Twitch, and Instagram serve ads from the exact same domains as their core video content (e.g., googlevideo.com). If you block the ad domain, you block the video. To block ads on these specific platforms, you must use client-side browser extensions like uBlock Origin or modified apps like ReVanced.

Does using a Raspberry Pi to block ads slow down my internet?

It actually speeds up your perceived browsing experience. Because the Pi drops requests to ad and tracker domains before they resolve, your devices never waste bandwidth downloading megabytes of video ads or tracking pixels. The Raspberry Pi 4's gigabit Ethernet and ARM Cortex-A72 CPU can process over 10,000 DNS queries per second, meaning the hardware latency is measured in microseconds—far faster than your ISP's default DNS servers.

What happens to my network if the Raspberry Pi crashes?

If the Pi loses power or the OS panics, your network will lose DNS resolution, effectively taking your internet "offline" even though the physical connection is fine. To prevent this, always use a high-quality official power supply to prevent brownouts. For redundancy, configure a secondary DNS server in your router pointing to a cloud provider (like 1.1.1.1), though be aware that some devices will randomly use the secondary DNS, bypassing your ad-blocker.

Do I need to update the blocklists manually?

No. Pi-hole includes a built-in cron job that automatically pulls updates for your subscribed blocklists once a week (typically on Sunday mornings). You can manually trigger a gravity update at any time by SSHing into the Pi and running pihole -g. It is highly recommended to stick to the default lists; adding massive, unvetted "mega-lists" from GitHub often results in false positives that break legitimate websites and smart home APIs.