Pi-hole blocks ads and trackers network-wide by filtering DNS requests before they reach known ad/tracker domains — running it on a VPS gives you network-wide ad blocking accessible from anywhere, not just your local network.
How DNS-Based Ad Blocking Works
Pi-hole acts as your DNS resolver — when a device requests a domain known to serve ads/trackers, Pi-hole returns a blocked response instead of resolving it, preventing the ad/tracker content from ever loading, network-wide, without needing per-device browser extensions.
Why Run Pi-hole on a VPS Instead of Locally
- Accessible from anywhere (mobile devices on cellular data, not just your home WiFi)
- Always-on, unlike a home device that might be powered off
- Doesn't consume resources on your home network hardware
Prerequisites
- Ubuntu 22.04/24.04 VPS: 1 vCPU, 1 GB RAM (genuinely lightweight)
Step 1 — Install Pi-hole
curl -sSL https://install.pi-hole.net | bashFollow the interactive installer — select your upstream DNS provider and confirm installation settings.
Step 2 — Access the Web Admin Interface
http://YOUR_SERVER_IP/adminThe installer displays your admin password at the end of installation — note it, or reset it if needed:
sudo pihole -a -pStep 3 — Allow DNS Traffic Through the Firewall
sudo ufw allow 53/tcp
sudo ufw allow 53/udpStep 4 — Configure Your Devices to Use Pi-hole as DNS
On each device (or your router, for network-wide coverage), set the DNS server to your VPS's IP address — the exact configuration steps vary by device/OS.
Step 5 — Secure DNS Access to Trusted Clients Only
sudo ufw delete allow 53/tcp
sudo ufw delete allow 53/udp
sudo ufw allow from YOUR_TRUSTED_IP to any port 53Important: an open DNS resolver reachable by anyone can be abused for DNS amplification attacks — restrict access specifically to your own known devices/IPs, not left open to the entire internet.
Using Pi-hole with a VPN for Mobile Coverage
For genuinely reliable mobile device coverage (where your IP changes constantly), combine Pi-hole with a VPN (see How to Set Up a VPN Server with WireGuard) — route mobile traffic through the VPN, then configure the VPN to use Pi-hole for DNS, avoiding the open-resolver security concern entirely.
Adding Custom Blocklists
Pi-hole supports adding additional blocklist sources beyond the defaults, under Group Management → Adlists in the web interface — various community-maintained lists exist for different blocking focuses (ads, trackers, malware domains).
Whitelisting Domains That Get Incorrectly Blocked
Occasionally a legitimate domain gets caught by a blocklist — use the web interface's whitelist function to override this for specific domains you've verified are safe and needed.
Common Errors
DNS resolution fails entirely after switching to Pi-hole — verify Pi-hole's service is actually running (sudo systemctl status pihole-FTL) and that firewall rules genuinely allow your device's IP to reach port 53.
Continue Reading
- How to Set Up a VPN Server with WireGuard
- DNS Fundamentals: A, AAAA, CNAME, MX, TXT & NS Records Explained
- How to Set Up a Site-to-Site VPN Between Two VPS Servers
Browse more articles in Networking & DNS.
