> TAKE IT BACK STEP 02 / 06
root@takeitback:~/guide/02-pihole$ cat readme.md
STEP 02

Block ads & trackers network-wide

Instead of installing an ad blocker on every device, you turn your box into the network's DNS server and have it refuse to look up ad and tracking domains. One install protects every phone, TV, and laptop in the house.

DIFFICULTYBeginner
TIME30–45 min
COST$0
REPLACESPer-device ad blockers · some ISP tracking

How this actually works

Every time a device loads a page, it first asks a DNS server "what's the address for this domain?" Pi-hole sits in that path. When the domain is an ad network or tracker, it answers "nowhere" and the junk never loads. Because it works at the DNS layer, it covers apps and smart devices that browser extensions can't touch.

Install Pi-hole

Pi-hole targets Linux. How you run it depends on what your box runs — the tabs below give the right path for each.

The official installer runs directly. Accept the defaults unless you have a reason not to, and note the admin password it prints at the end.

root@box:~$ curl -sSL https://install.pi-hole.net | bash
// piping to bashIf you'd rather read the installer before running it, download it, open it, then execute — a good habit for every install in this guide.

Pi-hole doesn't run natively on macOS, so run it in a container with Docker Desktop (install from docker.com, or brew install --cask docker). This is the officially supported way on a Mac:

docker-compose.yml (excerpt) services:
pihole:
image: pihole/pihole:latest
ports: ["53:53/udp","53:53/tcp","80:80"]
environment: { TZ: "Europe/London" }
volumes: ["./etc-pihole:/etc/pihole"]
you@mac:~$ docker compose up -d

Same as macOS: run Pi-hole in Docker Desktop (which uses your WSL2 engine) with the identical compose file. Don't try to make Windows itself a DNS server.

$ docker compose up -d
# same pihole/pihole image and ports as the macOS tab
// port 53Windows sometimes reserves DNS port 53. If the container won't start, stop the "Internet Connection Sharing" service, which squats on it.

Point your network at it

Pi-hole only works if devices actually ask it. The cleanest way is once, centrally: in your router's DHCP settings, set the DNS server to your box's IP. Every device picks it up as it connects. This step is the same whatever OS the box runs:

router admin → DHCP / LAN settings DNS server: 192.168.1.50 # your box's fixed IP

If your router won't allow it, set DNS manually on individual devices instead — less tidy, but it works.

Check it's working

Open http://192.168.1.50/admin in a browser. You should see live queries scrolling and a "percent blocked" figure climbing. Load a news site on your phone — the ad slots should come up empty.

// if a site breaksOccasionally a blocklist is too aggressive and breaks a login or checkout. The dashboard's query log shows exactly what was blocked; whitelisting that one domain takes two clicks.

Before you move on