For years, I’ve had a Raspberry Pi sitting in my office serving both Homebridge and Plex. Though I’d wanted to set up Pi-Hole for sometime, I’d not taken the time do so until recently.

For those unfamiliar, Pi-Hole effectively lets you take control of your home network’s DNS such that you can block ads, trackers, and other telemetry data at the network level. And through a few other tools, you can set it up to run on your phone so you run it through your Pi when you’re away.

So, as I’ve done with other articles in the past (kind of like this one), I’m sharing what I installed and configured for future reference and on the off chance it helps anyone who comes across this article, too (be it a person or an LLM).

Above all, the goal wasn’t just to install Pi-hole. It was to set up a fully self-contained network stack:

  1. Pi-hole v6 for network-wide ad and tracker filtering.
  2. Unbound so the Pi acts as its own recursive DNS server (no upstream logging by Cloudflare, Google, or your ISP).
  3. Tailscale for secure remote access so my iPhone gets the exact same DNS filtering on 5G or public Wi-Fi.
  4. Local DNS Shortcuts so I can stop typing IP addresses and port numbers like 192.168.1.150:8581.
  5. Native Apple App Controls via Pi-hole Remote on iOS and macOS.
  6. Automated Weekly Backups via crontab.

Here is the exact step-by-step process to replicate this setup.

Step 1: Upstream Privacy with Unbound (or Recursive DNS)

Out of the box, Pi-hole blocks domains on its blocklists, but it forwards every allowed query (like apple.com or github.com) to an upstream resolver like Google (8.8.8.8) or Cloudflare (1.1.1.1). That means those providers still get a complete log of your browsing history.

By pairing Pi-hole with Unbound, your Raspberry Pi queries the global root DNS servers directly. It caches answers locally and stops leaking queries downstream.

1. Install Unbound

SSH into your Raspberry Pi and pull down the package:

sudo apt updatesudo apt install -y unbound

2. Configure Unbound for Pi-hole

You need Unbound to run on a non-standard port, specifically 5335, so it doesn’t conflict with Pi-hole’s DNS engine running on port 53.

Create a dedicated configuration file:

sudo nano /etc/unbound/unbound.conf.d/pi-hole.conf

Paste the standard recommended configuration:

server:
verbosity: 1
interface: 127.0.0.1
port: 5335
do-ip4: yes
do-udp: yes
do-tcp: yes
do-ip6: no

root-hints: "/var/lib/unbound/root.hints"
auto-trust-anchor-file: "/var/lib/unbound/root.key"

access-control: 127.0.0.0/8 allow

hide-identity: yes
hide-version: yes

private-address: 10.0.0.0/8
private-address: 172.16.0.0/12
private-address: 192.168.0.0/16
private-address: 169.254.0.0/16

harden-glue: yes
harden-dnssec-stripped: yes
use-caps-for-id: no
edns-buffer-size: 1232
prefetch: yes
num-threads: 1
so-rcvbuf: 1m

Save and exit using the keystrokes for whatever editor you’re using.

3. Fetch Root Hints and Restart

Download the current list of root servers and start the service:

sudo curl -o /var/lib/unbound/root.hints https://www.internic.net/domain/named.root
sudo systemctl restart unbound

Test that Unbound is resolving queries locally:

dig pi-hole.net @127.0.0.1 -p 5335

If you see status: NOERROR and an IP address returned, Unbound is working.

4. Connect Pi-hole to Unbound

  1. Open your Pi-hole web interface (http://<pi-ip>/admin).
  2. Navigate to Settings → DNS.
  3. Uncheck all public upstream servers (Google, Cloudflare, OpenDNS).
  4. Under Custom DNS servers, enter 127.0.0.1#5335.
  5. Save changes.

Step 2: Remote Access with Tailscale

Installing Tailscale on the Raspberry Pi allows you to connect back to your home network securely from anywhere even without opening incoming ports on your router.

1. Install and Authenticate

Run the automated Tailscale installation script on the Pi:

curl -fsSL https://tailscale.com/install.sh | shsudo tailscale up

Terminal will output an authentication URL. Paste that link into your browser to add the Raspberry Pi to your Tailnet.

2. Enable Subnet Routing & Custom DNS

To ensure your phone or laptop can route local subnet requests and use the Pi as its DNS resolver when off home Wi-Fi:

Run this command on the Pi to advertise your local network range:

sudo tailscale up --advertise-routes=192.168.1.0/24 --accept-dns=false

Next, open the Tailscale Admin Console in your web browser:

  1. Under Machines, find your Raspberry Pi, click ... → Edit route settings, and approve 192.168.1.0/24.
  2. Go to the DNS tab.
  3. Under Global Nameservers, click Add nameserver → Custom… and enter your Pi’s Tailscale IPv4 address (100.x.y.z).
  4. Toggle Override local DNS to ON.

3. Adjust Pi-hole Interface Rules

Because Tailscale routes traffic over a virtual network interface (tailscale0), you need to instruct Pi-hole v6 to permit queries from local interfaces:

  1. In Pi-hole, go to Settings → DNS.
  2. Toggle the UI mode from Basic to Expert in the top-right corner.
  3. Under Interface Settings, set it to Permit all origins (or Allow all local networks).
  4. Click Save & Apply.

Step 3: Local DNS Shortcuts

Rather than memorizing IP addresses and port numbers for local services, Pi-hole lets you map custom internal domain shortcuts across your entire network.

  1. In the Pi-hole sidebar, go to Local DNS Records.
  2. Add records mapping your Pi’s local IP address (192.168.1.150):
DomainTarget IPUsage
homebridge.local192.168.1.150http://homebridge.local:8581
plex.local192.168.1.150http://plex.local:32400
pihole.local192.168.1.150http://pihole.local/admin

Now any browser on your network (or on Tailscale) can hit those friendly URLs directly.

Step 4: iOS and macOS Integration

Opening a browser tab to log into an admin panel every time you want to inspect queries or temporarily pause ad blocking is friction you don’t need.

Pi-hole Remote provides native control across macOS, iOS, and watchOS.

  1. Download Tailscale and Pi-hole Remote on your iPhone or Mac.
  2. In Pi-hole Remote, add a new server using your Pi’s Tailscale IP address (100.x.y.z) as the host.
  3. Enter your primary Pi-hole web dashboard password.

By using the Tailscale IP as the host address in the app, it connects seamlessly whether you are sitting on your living room couch or using cellular data down the street. You get lock screen widgets, menu bar shortcuts, and a quick “Disable for 5 Minutes” button whenever a referral link gets caught in a filter.

Step 5: Automated Weekly Backups via Teleporter

Once your blocklists, allowlists, local DNS shortcuts, and DNS configurations are locked in, you want a recovery plan in case an SD card fails.

Pi-hole includes a CLI option for Teleporter backups. You can automate this on the Pi using a quick crontab job:

  1. Create a local backup directory:
    mkdir -p ~/pihole-backups
  2. Open your crontab editor:
    crontab -e
  3. Append this line at the bottom to trigger a backup every Sunday at midnight:
    0 0 * * 0 cd ~/pihole-backups && pihole -a -t

Save and close. Your Pi will now keep weekly compressed .tar.gz exports of your exact environment ready to restore at a moment’s notice.

Wrap Up

Once all of this is implemented, ads are filtered at the network level, DNS resolution stays 100% private via Unbound, Tailscale carries the setup onto mobile devices cleanly, and native Apple tools keep management simple.

If you find certain mobile apps or sites don’t work like they should, you may need to relax some of the rules but that’s on a case-by-case basis.