Pi-hole on Raspberry Pi Zero 2 W: A Network-Wide Ad Blocker
Pi-hole is one of the most popular Raspberry Pi projects, and a Pi Zero is a natural home for it. It runs all day using very little power, needs no screen, and can hide behind the router. Once it is running, every phone, laptop and smart TV on your network gets ad and tracker blocking without installing anything on the devices themselves.
In this tutorial you will give the Zero a fixed IP address, install Pi-hole, point your network's DNS at it, check that blocking works, and learn the maintenance commands. You will also see what Pi-hole cannot block, so your expectations are realistic.
How DNS-Based Blocking Works
Before a device can load anything from ads.example.com, it asks a DNS server to translate that name into an IP address. Normally the router forwards that question to your internet provider. With Pi-hole, devices ask the Pi instead. Pi-hole checks the name against its blocklists, collectively called gravity. If the domain is listed, it replies with an unroutable address such as 0.0.0.0, so the ad request goes nowhere. If not, it forwards the query to an upstream DNS server, caches the answer and returns it.
Because blocking happens at the name lookup, it works for every application on every device. The cost is that Pi-hole becomes a critical part of your network: if the Pi is off and devices have no backup DNS, name lookups fail and the internet appears to be down.
| Component | Role |
|---|---|
| pihole-FTL | The DNS server, built on dnsmasq, that answers and logs queries |
| Gravity database | The combined blocklist built from adlist URLs |
| Web interface | Dashboard, query log and settings at /admin |
| Upstream DNS | The resolver Pi-hole forwards allowed queries to |
Step 1: Give the Pi a Fixed Address
Devices will be told to use the Pi's IP address for DNS, so that address must never change. The cleanest method is a DHCP reservation in your router's settings, which ties an IP to the Pi's MAC address. If your router does not support that, set a static address on the Pi with NetworkManager. Choose an address outside the router's DHCP range.
# Find the Wi-Fi connection name; Imager-created profiles are often called 'preconfigured'
nmcli connection show
# Show the current address and gateway
ip -4 addr show wlan0
ip route | grep default
# Set a fixed address, gateway and temporary upstream DNS
sudo nmcli connection modify preconfigured \
ipv4.method manual \
ipv4.addresses 192.168.1.50/24 \
ipv4.gateway 192.168.1.1 \
ipv4.dns 1.1.1.1
# Apply (your SSH session will drop; reconnect to the new address)
sudo nmcli connection up preconfiguredStep 2: Install Pi-hole
Pi-hole provides an installer script. Piping a script from the internet into bash runs it without inspection, so the safer habit is to download it, look through it and then run it.
sudo apt update && sudo apt full-upgrade -y
# Download the installer, read it, then run it
curl -sSL https://install.pi-hole.net -o basic-install.sh
less basic-install.sh
sudo bash basic-install.sh
# After installation, set the web interface password (Pi-hole v6)
sudo pihole setpassword
# Check that the DNS service is running
pihole statusThe text-based installer asks you to confirm the static IP, choose an upstream DNS provider, accept the default blocklist and enable the web interface and query logging. The defaults are sensible for a first install. When it finishes, it prints the address of the admin page, which is http://192.168.1.50/admin in this example.
Step 3: Point Your Network at Pi-hole and Verify
Log in to your router and set its DHCP server to hand out the Pi's address as the DNS server. Devices pick up the change when they renew their lease; reconnecting to Wi-Fi forces it. If your router does not allow changing DNS, set the DNS manually on individual devices, or disable the router's DHCP and enable Pi-hole's own DHCP server in its settings.
# Ask Pi-hole directly for a commonly blocked advertising domain
nslookup doubleclick.net 192.168.1.50
# Expected: Address: 0.0.0.0 (blocked)
# A normal domain should resolve to a real address
nslookup raspberrypi.com 192.168.1.50Open the admin dashboard and browse a few websites. The query count and percentage blocked rise as your devices start using Pi-hole. The query log shows each lookup, which is also a useful way to see what your smart TV or phone apps are contacting.
pihole -g # rebuild gravity from the configured adlists
pihole -up # update Pi-hole itself
pihole disable 5m # pause blocking for 5 minutes when a site breaks
pihole enable # resume blocking
sudo apt update && sudo apt upgrade -y # keep the OS patchedLimits and Troubleshooting
- YouTube and similar ads still appear: these are served from the same domains as the videos, so DNS blocking cannot separate them.
- Some devices bypass Pi-hole: browsers or apps using DNS over HTTPS, or devices with hard-coded DNS servers, never ask Pi-hole. Disable secure DNS in the browser to test.
- A website or app breaks: find the blocked domain in the query log and add it to the allowlist from the web interface.
- Whole network loses internet when the Pi is off: expected. Keep the Pi on a reliable supply, and consider the read-only filesystem tutorial to protect the SD card.
- Dashboard shows no queries: devices are still using the router for DNS. Check the DNS server shown in a device's Wi-Fi details.
Summary
Pi-hole turns a Pi Zero 2 W into a DNS server that blocks advertising and tracking domains for the whole network. The essential steps are a fixed IP address, the official installer, and pointing the router's DHCP DNS setting at the Pi. Verify with nslookup, maintain it with pihole -g and pihole -up, and remember that DNS blocking cannot stop ads served from the same domain as the content.