Pi-hole setup starts with one client: install on a dedicated LAN host, point only your test computer at it, and verify filtering and DNS recovery before expanding.

Key Takeaways:

Keep the router's DNS and DHCP service unchanged.

A dashboard password protects administration; firewall rules restrict DNS clients.

Check query arrival, blocking, exceptions, bypass paths, and rollback separately.

Restore the client's original DNS before stopping the Pi-hole host.

What does this Pi-hole setup require?

Use a fresh native Ubuntu 24.04 LTS x64 host and one authorized Windows 11 LAN client. Version references: Core v6.4.3, FTL v6.7.1, and Web v6.6; compare the installer's stable combination. These official-documentation instructions have not undergone complete end-to-end testing.［1］［2］［3］

Assess always-on DNS responsibilities with the self-hosting maintenance framework. Pi-hole filters domain lookups, without removing every advertisement; see the DNS filtering limits.

Prepare sudo, a local console, stable LAN addressing, and saved client DNS. Stop on managed clients, shared production hosts, or unauthorized networks. Before upgrades, use Settings → Teleporter → Export plus a compatible host backup; copying databases backward is not supported downgrade recovery.［14］

Step 1: Record the original configuration

In Windows Settings → Network & internet, select active Ethernet/Wi-Fi. Save automatic/manual DNS, every IPv4/IPv6 server, encrypted-DNS settings, and browser Secure DNS. Preserve IP/gateway assignment; browser DNS may bypass Windows.［5］

Record Ubuntu's address, LAN interface, resolver, and firewall rules. Reserve host and IP-identified test-client addresses in existing router DHCP, or use administrator-approved static addresses without lease conflicts. Pi-hole does not take over DHCP.［4］

Save /etc/resolv.conf including its symlink target, resolved configuration, and whether /etc/systemd/resolved.conf.d/90-pi-hole-disable-stub-listener.conf already exists; preserve any existing contents. Record baseline:

readlink -f /etc/resolv.conf
resolvectl status
getent hosts example.com

Save an offline recovery sheet with original DNS, host/client addresses, admin path, and added rules. Logs reveal domains and client identities; collect only the test interval locally, never publish logs or backups.

Step 2: Restrict DNS and management access

Inspect Ubuntu listeners:

sudo ss -lntup
sudo ufw status numbered

Pi-hole needs TCP and UDP 53; administration normally uses 80/443, with possible fallbacks. Stop for unrelated port conflicts. The installer handles systemd-resolved by disabling only its Stub Listener, leaving the service running; host DNS can fail until FTL starts. Do not disable the resolver yourself. DHCP and NTP are excluded.［4］［15］

Preserve loopback, approved SSH rules, and local-console rescue access under an inbound-deny policy. These additions assume an already reviewed UFW policy; replace the interface and both addresses:

LAN_IF='enp1s0'
CLIENT_V4='192.168.1.25'
ADMIN_V4='192.168.1.10'
sudo ufw allow in on "$LAN_IF" from "$CLIENT_V4" to any port 53 proto udp
sudo ufw allow in on "$LAN_IF" from "$CLIENT_V4" to any port 53 proto tcp
sudo ufw allow in on "$LAN_IF" from "$ADMIN_V4" to any port 443 proto tcp
sudo ufw status numbered

Remove only conflicting broad allows you own. If UFW is inactive or lacks inbound denial, the administrator must establish it before client connection. Allow the actual HTTPS port; keep HTTP closed.［6］

Apply equivalent IPv6 restrictions, or deny IPv6 DNS for an IPv4-only trial. No port forwarding, public DNS, or guest access is needed. Retain Allow only local requests, which permits the local subnet; narrow it with firewall rules. Never choose Permit all origins to troubleshoot.［7］

Step 3: Perform the Pi-hole installation

Download and review the official installer before running it with sudo:

wget -O basic-install.sh https://install.pi-hole.net
less basic-install.sh
sudo bash basic-install.sh
pihole version
pihole status
sudo pihole setpassword

Select the intended LAN interface and policy-approved upstream DNS; keep DHCP disabled. The installer manages service identity: do not substitute your administrator account or change ownership to bypass errors. Interactive password entry avoids secrets in command arguments.［8］［9］

Compare installed versions with the references; review differences without mixing old components. On installation failure, leave Windows DNS unchanged. If host DNS fails after the Stub Listener change, use the local console. Only when the drop-in was absent before installation and now contains only the installer's [Resolve] / DNSStubListener=no settings, run:

sudo systemctl stop pihole-FTL
sudo rm -- /etc/systemd/resolved.conf.d/90-pi-hole-disable-stub-listener.conf
sudo systemctl restart systemd-resolved
getent hosts example.com

Run one line at a time; stop on errors. A pre-existing or modified drop-in requires administrator recovery from saved configuration. Check resolvectl status, the saved /etc/resolv.conf target, and ordinary host lookups before retrying. Keep rescue access if recovery fails; never overwrite resolver configuration blindly.［15］［16］

For first HTTPS login, use Firefox about:profiles on the approved Windows admin device: record the original default, create a test profile, and launch it in a new browser.［18］ Pi-hole's generated certificate initially lacks browser trust. At the host console, record the CA fingerprint:

sudo openssl x509 -in /etc/pihole/tls_ca.crt -noout -fingerprint -sha256

Copy only tls_ca.crt through an existing trusted administration path, never tls.pem or private keys. In Firefox Settings → Privacy & Security → Certificates → View Certificates → Authorities → Import, select that CA, compare its fingerprint with the console record, and enable website trust only if they match. CA trust covers every certificate it signs, so keep it in this test profile.［17］

Use the hostname matching the certificate and webserver.domain in /etc/pihole/pihole.toml. If admin DNS cannot resolve it, record then temporarily add LAN_IP hostname (replace both) to Windows C:\Windows\System32\drivers\etc\hosts with administrator permission. Open that hostname over the allowed HTTPS port; stop on name or trust warnings instead of bypassing verification. Authenticate, confirm listening mode and blocking, and enable temporary query logging; login alone proves no DNS access boundary.［10］［17］

Step 4: Point only Windows at Pi-hole

Set the active connection's DNS server assignment to manual, preferring Pi-hole's LAN IPv4 address. Preserve IP assignment and omit public alternate DNS to avoid bypass. Port 53 serves ordinary DNS, without a DoH template; router DNS remains unchanged.［5］［11］［13］

Check IPv6 DNS separately. An active alternate resolver limits the result to IPv4. Dual-stack testing requires stable Pi-hole IPv6 addressing, rules permitting only the designated client's IPv6 source, and that resolver configured. Stop if any active path is unidentified.

Temporarily disable bypassing browser Secure DNS only on this authorized test profile; record it and preserve VPN, proxy, and organization policies. Pre-existing Windows failures need device troubleshooting; host failures need Ubuntu resolver diagnosis.

Step 5: Prove blocking and a single exception

Open the query log on the admin device. From Windows, query example.com explicitly against Pi-hole, then through the default resolver. Replace the example host address:

nslookup example.com 192.168.1.53
nslookup example.com

Match log time, client, domain, and allowed status. In Domains, add a commented test example.com exact deny entry, without wildcards or regex. Repeat both queries; check blocking status, without requiring a particular returned address because blocking modes differ.［9］

Add exact allow for the same domain; it overrides exact deny. Both rules must apply to the client's group, normally the default group on fresh installations. Verify allowance, delete only the temporary allow and verify renewed blocking, then delete the temporary deny and verify normal resolution. Preserve pre-existing rules.［12］

DNS decisions do not prove page appearance: cached pages, first-party ads, and browser DNS can leave advertisements. To change the public exit, compare DNS-based access tools and full traffic tunnels; Pi-hole does not provide that function.

Step 6: Check the boundaries before expanding

This acceptance sheet gives reader instructions, not author test results. Check unauthorized sources with another owned device; without one, record the check unperformed and make no tested-boundary claim.

Check method	Expected observation	If it fails
Explicit and default fresh lookups	Matching client/domain entries reach Pi-hole	Check address, adapter, port rules, and alternate resolvers
Normal and exact-denied domain	Normal lookup allowed; test domain logged blocked	Check enabled rules, groups, and upstream resolution
Add then remove exact allow	Allowed with exception; blocked again after removal	Inspect rule priority and client group
Review IPv4, IPv6, and browser DNS	Each claimed path uses Pi-hole	Narrow the claim or configure the missing path
Query from an unlisted owned device	Neither UDP nor TCP DNS is served	Correct broad firewall rules before proceeding
Try management from unlisted device	Admin interface unavailable	Restrict actual web ports, including IPv6
Restore original client DNS	Fresh default lookup works independently of Pi-hole	Recheck saved DNS mode and addresses

Timeout does not prove rejection: compare both sources while Pi-hole runs. Test TCP separately with set vc in interactive Windows nslookup; no outside scan is needed.

If you outgrow one device and need different upstream resolvers per domain, AdGuard Home with split upstreams is the next step.

Step 7: Complete the Pi-hole DNS rollback

Restore Windows' saved automatic mode or complete manual DNS list and encryption settings, plus browser DNS. Before stopping Pi-hole, verify a fresh default lookup and previously working page. Microsoft's reset uses DHCP servers; it cannot restore a manual list.［11］

Check identities before removing temporary domain entries and firewall additions; restore logging. Retire with the official uninstaller only after clients no longer depend on Pi-hole. Keep backups private and rescue access until recovery is confirmed.［9］

Remove only the matching CA in Firefox Authorities, restore the original default profile and temporary hosts entry. The uninstaller removes this resolved drop-in; verify host DNS afterward. Incomplete installations require Step 3's conditional recovery.［16］［17］［18］

Summary

Install on a dedicated, supported host and change one client's DNS.
Separate admin authentication, DNS access, and filtering checks.
Treat IPv6 and browser DNS as independent paths to verify.
Restore DNS first, then remove only the trial's configuration.

FAQ

Can I install Pi-hole without changing router DNS?

Yes. Point one authorized client at Pi-hole's LAN DNS while preserving router DNS distribution and DHCP.

Does Pi-hole need a Raspberry Pi?

No. Supported Ubuntu x64 hosts can use this native installation without Raspberry Pi hardware.

Why can I sign in but not resolve names?

Dashboard and DNS have separate ports and access controls. Check DNS service and TCP/UDP 53; keep authentication intact.

Why are ads still visible after blocking works?

Matching domains are blocked, not every advertisement within allowed domains. Browser DNS and cached content can change visible results.

Should I add public DNS as a backup?

Avoid it in this trial: alternate resolvers bypass filtering. Restore the original DNS configuration when recovery is needed.

Can I ignore IPv6 if IPv4 works?

IPv4-only trials are valid if labeled accordingly. Other IPv6 resolvers remain outside the demonstrated filtering coverage.

Must I uninstall Pi-hole to undo the client change?

No. Restore and verify client DNS first. Uninstallation is a separate host action after removing every dependency.

Disclaimer: These documentation-based steps are not a claim of completed device testing. Use only authorized devices and keep a working recovery path.

Sources:

Pi-hole Core v6.4.3 — https://github.com/pi-hole/pi-hole/releases/tag/v6.4.3
Pi-hole FTL v6.7.1 — https://github.com/pi-hole/FTL/releases/tag/v6.7.1
Pi-hole Web v6.6 — https://github.com/pi-hole/web/releases/tag/v6.6
Pi-hole Prerequisites — https://docs.pi-hole.net/main/prerequisites/
Microsoft Essential Network Settings and Tasks in Windows — https://support.microsoft.com/en-us/windows/experience/connectivity-networking/essential-network-settings-and-tasks-in-windows
Ubuntu Firewall — https://ubuntu.com/server/docs/how-to/security/firewalls/
Pi-hole Interface Binding Behavior — https://docs.pi-hole.net/ftldns/interfaces/
Pi-hole Installation — https://docs.pi-hole.net/main/basic-install/
The pihole Command — https://docs.pi-hole.net/main/pihole-command/
Pi-hole Configuration — https://docs.pi-hole.net/ftldns/configfile/
Microsoft Set-DnsClientServerAddress — https://learn.microsoft.com/en-us/powershell/module/dnsclient/set-dnsclientserveraddress
Pi-hole Domain Database — https://docs.pi-hole.net/database/domain-database/
Pi-hole Post-Install — https://docs.pi-hole.net/main/post-install/
Pi-hole Web v6.6 Teleporter — https://github.com/pi-hole/web/blob/v6.6/settings-teleporter.lp
Pi-hole Core v6.4.3 Installer — https://github.com/pi-hole/pi-hole/blob/v6.4.3/automated%20install/basic-install.sh
Pi-hole Core v6.4.3 Uninstaller — https://github.com/pi-hole/pi-hole/blob/v6.4.3/automated%20install/uninstall.sh
Pi-hole TLS/SSL — https://docs.pi-hole.net/api/tls/
Firefox Profile Manager — https://support.mozilla.org/en-US/kb/profile-manager-create-remove-switch-firefox-profiles

Sources checked 11 October 2026.

Related Articles:

Pi-hole Setup: Test DNS Filtering on One Device First