Kill every ad on your network
Ad blockers live in your browser. That means they protect exactly one app on exactly one device, and they do nothing for your TV, your phone apps, your thermostat, or your mother's laptop when she's on your couch.
There's a better place to do it. Every device on your network has to ask a question before it can load anything: what's the address for this name? If you own the thing that answers, you decide which names get an answer. Ad server asks, ad server gets nothing, page loads without it. One box, whole house, every device, nobody has to install anything.
That's all Pi-hole is. It's a phone book that refuses to look up certain numbers.
What it runs on
Mine started on a small single board computer that had been sitting in a drawer doing nothing for months. That's the right kind of hardware for this. It uses almost no power, it makes no noise, and the job is genuinely tiny. An old laptop works. A spare desktop works. If you already run containers on something that stays on, it works there too, which is where mine ended up.
The two decisions nobody explains
Where does it send the questions it doesn't block? Pi-hole isn't a full phone book, it's a filter in front of one. For the requests it allows, it has to ask somebody for the real answer. Pick a public resolver. I use Cloudflare at 1.1.1.1 and stopped thinking about it.
The one thing that matters: do not point it at your router. Because later you're going to point your router at Pi-hole, and then the two of them will sit there asking each other the same question until the heat death of the universe.
What happens if it dies? Once your whole network asks Pi-hole for everything, Pi-hole is a single point of failure. Nothing browses until it's back.
The obvious fix is to add a second resolver as a backup. Don't. Devices don't politely fall back, they ask whoever answers fastest, so a random slice of your traffic skips Pi-hole entirely and ads leak through. You trade real blocking for resilience you probably don't need.
I run it with no backup. If it goes down I change one field in the router back to 1.1.1.1 and I'm online in thirty seconds. A thirty second manual fix beats a system that half works on purpose.
Wiring it up
Install it, pick your upstream, load the blocklists. Then go into your router's DHCP settings and change the DNS server it hands out to your new box's address. That single field is the whole thing. Every device that reconnects picks it up automatically. No apps, no per device setup, nothing for anyone else in the house to learn.
Give it a day and go look at the dashboard. Watching the count climb is genuinely satisfying, and seeing which of your own devices are the chattiest is educational in a way that will annoy you.
Now the part where I broke it
This is the useful half of the log, so I'm not going to skip it.
I gave that box a fixed address by typing the address into the box itself. Felt right at the time. Then I changed routers, and the whole network moved to a new address range. Then it moved again. The box didn't know, because nobody told it. It booted up, put on an address that no longer existed anywhere, and sat there deaf.
It looked dead for days. Power cycling did nothing, and it took me longer than I want to admit to understand why: rebooting just made it put the same wrong address back on. There was never anything wrong with the hardware. It was shouting into a room that had been demolished.
Getting back in was the fun part. I gave a machine that was still working a second address in the old dead range, so for a minute there were two networks living on one wire. That let me reach the stranded box, and I armed a job to undo my change automatically after three minutes in case the fix didn't take and I locked myself out for good. Then I switched it to pulling its address automatically and it came right back.
The lesson, and it applies to every machine you own: never type a fixed address into the machine. If you need a device to always have the same address, set that in the router instead. The router knows when the network changes. The box in the closet does not, and it will happily wait forever at an address that stopped existing eight months ago.
Network-wide ad blocking on any always-on box: an 8GB single-board computer, an old laptop, or a container on something you already run. The whole thing is one install and one field in your router. Replace every value in angle brackets with your own.
1. Install Pi-hole
Use the project's official installer on a machine that stays on. The wizard asks which upstream resolver to use and offers to set a static address, say no to that second part, it's the trap in step 4.
# pick a PUBLIC upstream resolver when the wizard asks,
# e.g. 1.1.1.1. do NOT point it at your router.
# when it's done it prints an admin URL + a one-time password.2. Hand out Pi-hole as the network's DNS
This is the one field that flips the whole house. In your router's DHCP settings, set the DNS server it hands out to Pi-hole's address. Every device picks it up on its next reconnect. No per-device setup, no apps.
# Router admin -> LAN / DHCP settings
DHCP DNS server: <pi-hole-address>
# reconnect a phone, load an ad-heavy page, watch the query log fill.3. One resolver, no backup (on purpose)
Do not add a second DNS server as a fallback. Devices race the two and ask whichever answers fastest, so a slice of traffic skips Pi-hole and ads leak. If Pi-hole ever goes down, the recovery is one field:
# temporary bypass while you fix Pi-hole:
DHCP DNS server: 1.1.1.1 # back online in ~30s, set it back after4. THE MISTAKE, do not repeat it
Do not type a fixed address into the Pi itself. If you hard-code a static IP on the box and your network's address range later changes (new router, new subnet), the box boots with an address that no longer exists and goes deaf. Rebooting just re-applies the same dead address. Instead, leave the box on automatic (DHCP) and pin its address in the ROUTER as a reservation, keyed to the box's MAC.
# Router admin -> DHCP reservations
reserve: <box-MAC> -> <fixed-address>
# the router knows when the network changes. the box in the closet does not.Recovery, if you already stranded one
Give a working machine a second address in the old dead range so it can reach the stranded box, fix the box back to automatic, then remove the temporary address. Arm an auto-undo (a timed job that reverts your change after a few minutes) before you start, so a wrong move doesn't lock you out for good.