An ad blocker that lives in your browser only protects that one browser on that one computer. A network-wide ad blocker protects everything - every phone, tablet, smart TV, and app on your home network - by filtering ads and trackers at the DNS level. You run a small piece of software on an always-on device, point your network's DNS at it, and it quietly refuses to look up known ad and tracking domains for every device at once. The two most popular tools for this are Pi-hole and AdGuard Home, and both are free. Here is how it works and how to set it up.

How DNS-based ad blocking works

Every time a device loads a page or opens an app, it makes dozens of DNS lookups - one for the content you actually want, and often many more for ad networks, trackers, and telemetry. A network-wide blocker acts as your DNS server and checks each lookup against blocklists of known ad and tracking domains. Ask for a normal site and it answers normally; ask for a domain on the list and it returns a null answer, so the ad or tracker simply never loads.

Because this happens at the DNS layer rather than inside a browser, it covers everything on the network - including devices you cannot install an ad blocker on, such as a smart TV or a game console. It also tends to speed pages up a little and cut data use, since the blocked content is never fetched at all.

What you need

Just one always-on device to run the resolver. It barely sips resources, so almost anything works:

  • A Raspberry Pi is the classic choice - even a low-cost Pi Zero 2 W is plenty, though a Pi 4 or Pi 5 is nice if it is doing other jobs too.
  • A mini PC or an old laptop left running headless.
  • A NAS or home server, usually as a Docker container.

The one firm requirement is that it stays on. Because your whole network will rely on it for DNS, anything that sleeps or reboots often will take your internet name resolution down with it.

Pi-hole or AdGuard Home?

Both do the same core job - DNS-level blocking with a web dashboard and a live query log - so you can pick either with confidence.

  • Pi-hole is the long-established option with the largest community and the most guides. The current major release, Pi-hole v6 (out since early 2025), folded its web interface and a REST API directly into the main service, so it no longer needs a separate web server, and it keeps its settings in a single file at /etc/pihole/pihole.toml.
  • AdGuard Home is a newer single-program alternative with a particularly polished interface. It stands out for having encrypted DNS (DoH, DoT, and DoQ) and a full DHCP server built in, which is handy if you want those without any extra setup.

Installing it

Set the device up with a fresh Linux install - Raspberry Pi OS, Debian, or Ubuntu are all fine - then run the project's installer.

  • Pi-hole: run the official one-line installer, curl -sSL https://install.pi-hole.net | bash, and follow the prompts. It asks you to choose an upstream resolver (Cloudflare, Google, or Quad9 - see the best DNS servers) and a starter blocklist, and it shows you an admin password at the end. Manage it afterward at http://pi.hole/admin or http://<device-ip>/admin.
  • AdGuard Home: run its install script, curl -s -S -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -v, then finish the setup wizard in your browser at http://<device-ip>:3000.

Both tools also publish official Docker images if you prefer containers. The exact commands and version numbers here are current as of 2026 - always copy the latest one from the project's own site.

Give the resolver a fixed address

Before you point anything at it, make sure the device's IP address will never change. If it moves, your whole network loses DNS. The cleanest way is a DHCP reservation on your router, which pins the same address to the device permanently. Write that address down - you are about to hand it to every device on the network.

Point your network at it

This is the step that switches blocking on for everyone. You want every device to use your new resolver for DNS, and there are two ways to do that:

  • Set it on your router (recommended). Log in to your router - see how to access your router settings - and under the Internet/WAN or DHCP section, replace the DNS server handed out to clients with the resolver's fixed IP. Because the router advertises DNS through DHCP, every device picks it up automatically.
  • Let the resolver run DHCP. Some stock ISP routers will not let you change the DNS they hand out. In that case, turn off the router's DHCP server and enable the one built into Pi-hole or AdGuard Home instead, so it controls both addressing and DNS.

Important: hand out only your resolver's address. If you also list a public DNS as a "secondary," devices will happily use it and skip your blocking whenever they choose. For redundancy, run a second Pi-hole or AdGuard Home instance rather than mixing in an unfiltered server.

Check that it is working

Open the dashboard and browse the web on another device for a minute. You should see the query log fill up in real time, with blocked domains flagged. Ad and tracker requests on many sites will simply vanish, and the dashboard will report what share of total queries it is blocking - typically somewhere around five to fifteen percent on a normal home network.

What it can and cannot do

Network-wide blocking is genuinely useful, but it is worth knowing its limits before you rely on it:

  • It cannot block ads served from the same domain as the content. YouTube, Twitch, and some sites deliver ads from the same address as the video or page, and DNS cannot tell the two apart. A browser-based blocker is still the tool for those.
  • Some devices ignore it. Many smart TVs and streaming sticks ship with their DNS hard-coded, or use their own encrypted DNS, and sail straight past your resolver. That same article covers how to force those devices back through your DNS by blocking the ports and servers they escape through.
  • It is a single point of failure. If the device is off or rebooting, name resolution stops for the whole network. Keep it on reliable hardware, and consider a second instance if uptime matters to you.
  • Occasionally it over-blocks. Every so often a blocklist breaks a login button or an app. When that happens, find the domain in the query log and add it to the allowlist. Start with the default lists and add more sparingly.

Round out your setup

A network-wide blocker pairs naturally with a few of the other steps on this site. Send its lookups to a trustworthy upstream over encrypted DNS, keep chatty gadgets on their own segment with a separate IoT network, and fold all of it into the best home network security plan. And if a device stops loading sites after you make the switch, our guide to WiFi connected but no internet will help you pin down why.