Pi-hole Project

🎯 Project Objectives

Deploy a network-level ad blocker that protects all devices automatically
Improve network privacy by blocking tracking and telemetry domains
Enhance DNS security with DNS-over-HTTPS (DoH) support
Reduce bandwidth usage and improve page load times
Gain hands-on experience with Raspberry Pi, Linux, and network administration

⚙️ Technical Specifications

Hardware Raspberry Pi Zero 2 WH
MicroSD Card (16GB+)
Power Supply (5V/2.5A)

Software Raspberry Pi OS (Debian-based)
Pi-hole v5.x
NetworkManager

Network Config Static IP: 10.0.0.153
Gateway: 10.0.0.1
DNS: Cloudflare (1.1.1.1)

Access SSH enabled
Web interface: http://10.0.0.153/admin
mDNS: raspberrypi.local

🔧 Installation Process

1Initial System Preparation

After flashing Raspberry Pi OS and enabling SSH, connect from your workstation:

# Discover Raspberry Pi on the network
sudo nmap -sn 10.0.0.0/24

# Connect via SSH (default password: raspberry)
ssh pi@10.0.0.153

2System Update and Security

First, secure the system and update all packages:

# Change default password
passwd

# Update system packages
sudo apt update && sudo apt full-upgrade -y
sudo apt autoremove -y

# Install essential tools
sudo apt install -y curl git htop vim net-tools

3Configure Static IP Address

⚠️ Important

Modern Raspberry Pi OS uses NetworkManager instead of dhcpcd. If you see dhcpcd.service not found, use the NetworkManager method below.

Method 1: NetworkManager (Recommended for newer Pi OS)

# Open network configuration interface
sudo nmtui

# Navigate: Edit a connection → eth0 → IPv4 Configuration → Manual
# Set:
#   Address: 10.0.0.153/24
#   Gateway: 10.0.0.1
#   DNS servers: 1.1.1.1, 8.8.8.8

# Restart networking
sudo systemctl restart NetworkManager

# Verify IP configuration
ip -4 addr show eth0

Method 2: dhcpcd (Legacy method)

# Edit DHCP configuration
sudo nano /etc/dhcpcd.conf

# Add the following lines:
interface eth0
static ip_address=10.0.0.153/24
static routers=10.0.0.1
static domain_name_servers=1.1.1.1 8.8.8.8

# Restart DHCP client
sudo systemctl restart dhcpcd

4Verify System Resources

Ensure sufficient disk space and system health:

# Check disk space (should have 1-2GB free minimum)
df -h

# Clean up if needed
sudo apt-get clean
sudo apt-get autoremove -y
sudo journalctl --vacuum-size=100M

# Check system status
uptime
free -h

5Install Pi-hole

Run the official Pi-hole installer:

curl -sSL https://install.pi-hole.net | bash

📋 Installation Wizard Choices

✅ Network interface: eth0 (or wlan0 for Wi-Fi)
✅ Upstream DNS: Cloudflare (1.1.1.1) - fast and privacy-focused
✅ Blocklists: Use default StevenBlack list
✅ Admin Web Interface: Yes
✅ Web Server: Lighttpd (default)
✅ Logging: Enable query logging
✅ Privacy Mode: Show everything (can adjust later)

6Configure Router DNS

Point your router's DHCP server to use Pi-hole as the DNS server:

Access your router admin panel (usually http://10.0.0.1)
Navigate to DHCP settings
Set Primary DNS to: 10.0.0.153
Save and reboot router (or renew DHCP leases on devices)

✅ Result

All devices on the network will now use Pi-hole for DNS resolution, automatically blocking ads and tracking domains without any per-device configuration.

🖥️ Web Interface Configuration

Access the Pi-hole admin dashboard at:

http://10.0.0.153/admin
# or
http://raspberrypi.local/admin

Setting/Changing Admin Password

pihole -a -p
# Enter new password when prompted

Key Dashboard Features

Total Queries: Real-time view of DNS requests
Queries Blocked: Percentage and count of blocked domains
Blocklist: Currently blocking domains from selected lists
Top Allowed/Blocked Domains: Analytics on network traffic patterns
Query Log: Detailed logs for troubleshooting and monitoring

📊 Results and Performance

🎉 Immediate Impact

✅ Network-wide ad blocking active across all devices
✅ Mobile apps, smart TVs, and IoT devices protected
✅ Reduced bandwidth consumption
✅ Faster page load times (no ad resources loaded)
✅ Enhanced privacy (blocked tracking pixels and analytics)

📸 Project Screenshots

Pi-hole installation process - network detection

Pi-hole installation - upstream DNS selection

Pi-hole installation - blocklist configuration

Pi-hole installation - web interface setup

Pi-hole admin dashboard showing blocked queries

Query log showing DNS requests and blocks

🔒 Security Hardening (Optional)

Enable HTTPS for Web Interface

sudo apt install lighttpd openssl -y
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout /etc/lighttpd/server.pem \
  -out /etc/lighttpd/server.pem

Install Fail2Ban for Brute-Force Protection

sudo apt install fail2ban -y
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Update Pi-hole Blocklists

# Update gravity (blocklists)
pihole -g

# View available commands
pihole -h

🧪 Testing and Verification

Test DNS Resolution

# From any device on your network
nslookup google.com 10.0.0.153

# Should return a response (DNS working)

Test Ad Blocking

# Watch queries in real-time
pihole -t

# Or visit test pages:
# https://pi-hole.net/pages-to-test-ad-blocking-performance/

Monitor Query Logs

Check the Query Log in the web interface to see which domains are being blocked in real-time. You can whitelist or blacklist domains as needed.

🐛 Troubleshooting

DNS Not Working

Verify Pi-hole is running: pihole status
Check FTL (Faster Than Light) DNS service: sudo systemctl status pihole-FTL
Restart Pi-hole: pihole restartdns

Cannot Access Web Interface

Verify lighttpd is running: sudo systemctl status lighttpd
Check firewall rules if enabled
Verify IP address: hostname -I

Some Sites Breaking

Check Query Log for blocked domains
Whitelist necessary domains: pihole -w domain.com
Temporarily disable blocking: pihole disable 5m (5 minutes)

💡 Key Takeaways

DNS-Level Filtering: Understanding how DNS sinkholes work to block unwanted content at the network level
Linux System Administration: Hands-on experience with package management, service configuration, and system hardening
Network Configuration: Practical application of static IP assignment, DHCP configuration, and router DNS settings
Security & Privacy: Enhanced understanding of online tracking mechanisms and privacy protection techniques
Monitoring & Analytics: Real-time visibility into network DNS traffic and patterns

🚀 Future Enhancements

Integrate Threat Intelligence FeedsConnect Pi-hole with public threat intelligence sources(eg,AlienVault OTX)to automatically block known malicious domains.
Machine Learning–Based Domain ClassificationImplement a lightweight ML model or Python script that analyzes new DNS queries and classifies them as benign or suspicious using entropy and WHOIS data.
Centralized Logging and SIEM IntegrationBuild dashboards for DNS anomaly detection and threat hunting in a SOC-style workflow
Network Segmentation & VLAN IntegrationIntegrate Pi-hole within a segmented network topology (e.g., IoT VLAN) using pfSense or OPNsense for improved isolation and monitoring.

ZSec.io

🛡️ Network-Wide Ad Blocker with Pi-hole