# How to set up your network protection with Pi-hole

## Introduction <a href="#introduction" id="introduction"></a>

These days, the internet is full of advertisements and malicious websites. It is getting increasingly cumbersome to browse online with constant messages suggesting you visit a certain website or purchase a specific product. In addition, it is difficult to verify the legitimacy of a website or a URL at first glance. It only takes one click of a suspicious link to infect your device with malware.

Many people resort to using third-party tools, such as ad blockers or [threat protection tools](https://nordvpn.com/features/threat-protection/), in order to overcome the sheer amount of danger online. One such tool that enthusiasts tend to use more than others is Pi-hole.

[Pi-hole](https://docs.pi-hole.net/) allows you to transform your device to a local DNS server, which can be used as a network-wide ad blocker. While advertisement blocking is Pi-hole’s main purpose, you can use it for a variety of other options, such as local DNS mapping and website blacklisting.

On its own, Pi-hole only functions on the local area network. However, with the power of [Meshnet](https://nordvpn.com/meshnet/), you can use Pi-hole to block unwanted ads or websites on your devices wherever you are in the world. Meshnet allows you to establish a secure and encrypted connection between your end device and the Pi-hole server.

While Pi-hole can be deployed on Windows and macOS inside a [Docker container](https://www.docker.com/resources/what-container/), this guide will walk you through the standard Pi-hole installation on a Linux machine and show you how to configure its Meshnet IP address as the DNS server on other devices to be used remotely.

## Before you begin

Ensure that the machine you will use for Pi-hole meets the following criteria:

* Linux distribution using Systemd or SysVinit
* 2 GB of free disk space or more
* 512 MB RAM or more
* Static LAN IP address
* [Meshnet is enabled on the Linux](https://meshnet.nordvpn.com/~/changes/Ppg3bMoVHwMks6LohjqQ/getting-started/how-to-start-using-meshnet/using-meshnet-on-linux) machine and all client devices that will be using Pi-hole

For more detailed information, refer to the [Pi-hole Prerequisites](https://docs.pi-hole.net/main/prerequisites/) documentation.

{% hint style="info" %}
**Note**

This setup cannot be used on mobile devices using cellular data. Changing the DNS addresses and keeping the Meshnet connection is not possible with such a connection method.
{% endhint %}

## Install Pi-hole <a href="#install-pi-hole" id="install-pi-hole"></a>

1. Open **Terminal** and run the following command to download and execute the Pi-hole installation script:<br>

   ```bash
   curl -sSL https://install.pi-hole.net | bash
   ```

   \
   For alternative installation methods, refer to the [Pi-hole installation](https://docs.pi-hole.net/main/basic-install/) page.
2. Enter the sudo password of your Linux machine.&#x20;
3. In the installation dialog, select **OK** until you reach the **Static IP needed** window. If your device already has a static LAN IP address configured, select **Continue**. Otherwise, complete the necessary IP adjustments in your network.
4. Choose the network interface that your device is using (for example, `eth0`, `wlan0`, `enp0s3`) and then choose **Select**.

   &#x20;

   <div align="left"><figure><img src="https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2FI1GxmUeYR4VoiQ1ml3hd%2Fimage.png?alt=media&#x26;token=f1306215-2773-42a4-9fe2-165fdc4116ff" alt="Available network interfaces listed in Pi-hole installation window."><figcaption><p><br></p></figcaption></figure></div>
5. Choose your preferred upstream DNS provider and select **OK**.
6. Complete the installation process by choosing the blocklist, installing the Admin Web Interface with the required modules, and configuring the query logging settings.
7. In the **Installation complete** window, note down the address and password for the Pi-hole web interface and select **OK**.<br>

   <div align="left"><figure><img src="https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2FkplY4xYC8sngb7R53wwW%2Fimage.png?alt=media&#x26;token=95b49ce5-f962-4edb-a430-3ae8735f445e" alt="Pi-hole web UI address and password highlighted in the installation window."><figcaption></figcaption></figure></div>

{% hint style="success" %}
**Tip**

Make sure to change the password of your Pi-hole web interface to a unique and secure one. You can do so by executing the following command in the terminal:

<pre class="language-bash"><code class="lang-bash"><strong>pihole -a -p
</strong></code></pre>

{% endhint %}

## Allow Meshnet connections in Pi-hole settings <a href="#allow-meshnet-connections-in-pi-hole-settings" id="allow-meshnet-connections-in-pi-hole-settings"></a>

The setup will not work with the default Pi-hole settings, because they only allow requests from the same local subnet of the host device (for example, 192.168.1.0/24). Since Meshnet IP addresses use a different subnet, Pi-hole will ignore the requests.

To prevent this, complete the following steps:

1. Open your browser, enter the URL of the Pi-hole web interface that was provided in the **Installation complete** window, and log in.
   * If you are accessing the web interface from the host device directly, you can use this URL:\
     `http://localhost/admin`
   * Otherwise, use the device’s local IP address instead of the `localhost` part.
2. Go to **Settings** and select the **DNS** tab.
3. In the **Interface** section, select the **Permit all origins** option.\
   \
   ![Permit all origins option selected in Pi-hole's interface settings.](https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2F7qhy2PRYxljIX1HP6knx%2Fimage.png?alt=media\&token=016d86b5-785e-4b1f-ad15-4c4746f03046)<br>
4. Click **Save**.

{% hint style="success" %}
**Tip**

If you want to change the upstream DNS addresses for your Pi-hole in the future, you can do so on the same **DNS** tab, under **Upstream DNS Servers**.
{% endhint %}

Pi-hole is now installed and prepared for use via Meshnet.&#x20;

## Import blocklists to Pi-hole <a href="#import-blocklists-to-pi-hole" id="import-blocklists-to-pi-hole"></a>

With the additional features Pi-hole offers, you can improve your network security even more. One example is to import custom website blocklists to protect your devices from malicious and dangerous URLs or phishing domains.&#x20;

For this guide, blocklists from the [firebog.net](https://firebog.net/) website will be used.

### Add URLs <a href="#add-urls" id="add-urls"></a>

To add blocklist URLs to Pi-hole:

1. Open your Pi-hole web interface.
2. Select **Adlists**.
3. In the **Address** field, enter your preferred blocklist URL. Click **Add**. <br>

   <div align="left"><figure><img src="https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2FNeJWAoFRqm5Q6LekUKih%2Fimage.png?alt=media&#x26;token=31f43d0d-beac-4157-b2e7-a4d2ab16e590" alt="Blocklist URL entered in Pi-hole settings."><figcaption></figcaption></figure></div>

You will see the newly added blocklist in the **List of adlists** section.

<div align="left"><figure><img src="https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2FI6k5hBKCKgP3KozMT9Z3%2Fimage.png?alt=media&#x26;token=d1e8613f-756e-45cf-8196-64a150e1a0fc" alt="Blocklist successfully added to Pi-hole."><figcaption></figcaption></figure></div>

### Update gravity script <a href="#update-gravity-script" id="update-gravity-script"></a>

To start using the newly imported blocklists, update Pi-hole’s [gravity script](https://docs.pi-hole.net/core/pihole-command/#gravity).

1. Open Pi-hole’s web interface and expand **Tools**.
2. Click **Update gravity**.\
   \
   ![Update gravity option highlighted in the Tools section of the Pi-hole web UI.](https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2FcpPUoGevPX52SIazzDQU%2Fimage.png?alt=media\&token=a1a752b4-d2af-4e2e-bee5-758dc2bef248)

   &#x20;
3. In the new window, press **Update** and wait for the process to finish.
4. Once done, you will see a success message.

Alternatively, you can run the following command in Terminal:&#x20;

```bash
pihole -g
```

## Use your Pi-hole DNS over Meshnet <a href="#change-dns-addresses" id="change-dns-addresses"></a>

The Pi-hole configuration is now finished. However, to use Pi-hole and all of its features, you need to set up its Meshnet IP address as the DNS server on each of your client devices.

{% tabs %}
{% tab title="Windows" %}

### Windows 11 <a href="#windows-11" id="windows-11"></a>

1. Right-click **Start**![](https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2FOtP5XWC64gJfapJxZksb%2Fwindows_start_11.svg?alt=media\&token=ba30bb06-e18d-4b98-890f-1a16c24b24db) and select **Network connections**.
2. Choose the network type your device is using (Wi-Fi or Ethernet).
3. Find the **DNS server assignment** option and click **Edit**.
4. Choose **Manual** from the dropdown menu and enable **IPv4**.
5. Fill in the DNS fields.

   * **Preferred DNS server**: the Meshnet IP of the Pi-hole device.
   * **Alternate DNS server**: the DNS address of another provider.

   ![Pi-hole and alternate DNS addresses entered in Windows settings.](https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2Fj12OVBv64jkwptE5CKIP%2Fimage.png?alt=media\&token=c362d7e9-a788-4383-9055-254afe36ffd9)

   &#x20;
6. Click **Save**.

### Windows 10 <a href="#windows-10" id="windows-10"></a>

1. Right-click **Start**![](https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2FVSqL9yfpIONQtu4tl0pI%2Fwindows_start_10.svg?alt=media\&token=9b75053d-e0d8-4a6e-8624-51f60b0fd3b2) and select **Network connections**.
2. Select **Change adapter options**.
3. Right-click your current network adapter (Wi-Fi or Ethernet) and choose **Properties**.
4. In the new window, select **Internet Protocol Version 4 (TCP/IPv4)** and click **Properties**.
5. Select **Use the following DNS server addresses** and fill in the fields underneath.

   * **Preferred DNS server**: the Meshnet IP of the Pi-hole device.
   * **Alternate DNS server**: the DNS address of another provider.

   &#x20;

   <div align="left"><figure><img src="https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2FnuJqdUzw289LIRPcvZsq%2Fimage.png?alt=media&#x26;token=d0165b59-5060-4dba-b822-45b482147d1b" alt="Pi-hole and alternate DNS addresses entered."><figcaption></figcaption></figure></div>
6. Click **OK** twice to apply the changes.
   {% endtab %}

{% tab title="Android" %}

1. Open the **Settings** menu.
2. Go to **Connections** and select **Wi-Fi**.
3. Find your current Wi-Fi network and tap the gear button.
4. Go to **Advanced**/**View more**.
5. Change the **IP settings** value to **Static**.
6. Fill in the required DNS addresses.\
   \
   **DNS 1**: the Meshnet IP of the Pi-hole device.\
   **DNS 2:** the DNS address of another provider.<br>

   ![Pi-hole and alternate DNS entered in Android settings.](https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2FCGYSQVo4rpWTJYAXg7Zw%2Fimage.png?alt=media\&token=67f7e47f-06ed-40db-bb99-19bbed5ef50a)

   &#x20;
7. Tap **Save** (if such a button is present).
   {% endtab %}

{% tab title="iOS" %}

1. Open **Settings**.
2. Tap **Wi-Fi**, find your current network and tap the Info<img src="https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2FwzE1Q17LTv7SC9DLtPaZ%2Finfo.svg?alt=media&#x26;token=3906cd76-81b4-4a74-bf22-1d7de4b5c8c5" alt="" data-size="line"> button.
3. Tap **Configure DNS** and choose **Manual**.
4. Select **Add server** and enter the Meshnet IP of the Pi-hole device.<br>

   ![Pi-hole Meshnet IP entered in iOS DNS settings.](https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2FhLqoIIENCSocHjMmBpxZ%2Fimage.png?alt=media\&token=5b80dff5-f17b-4ee8-ba86-b297f3c01df9)

   &#x20;
5. Ensure that the added IP address is at the top.
6. Tap **Save**.
   {% endtab %}

{% tab title="macOS" %}

### macOS Ventura 13 and newer <a href="#macos-ventura-version-13-and-newer" id="macos-ventura-version-13-and-newer"></a>

1. Go to **System settings** and click **Network**.
2. Select the network interface you use (Wi-Fi or Ethernet) and click **Details**.
3. Open the **DNS** tab and click the plus (+) button at the bottom to add the Meshnet IP address of the Pi-hole device.
4. Ensure that the added IP address is at the top.<br>

   <figure><img src="https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2Fc07NGJ99bM97mgMKYIMI%2Fimage.png?alt=media&#x26;token=ffb832ec-6211-4331-9a2e-d805515249fe" alt="Pi-hole DNS entered in macOS DNS settings."><figcaption><p><br></p></figcaption></figure>
5. Click **OK** to save the changes.

### macOS Monterey 12 and older <a href="#macos-monterey-version-12-and-older" id="macos-monterey-version-12-and-older"></a>

1. Go to **System preferences** and click **Network**.
2. Select the network interface you use (Wi-Fi or Ethernet) and click **Advanced.**
3. Open the **DNS** tab and add the Meshnet IP address of the Pi-hole device by clicking the plus (+) icon.
4. Ensure that the added IP address is at the top.

   &#x20;

   <figure><img src="https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2FwqSMP0h9WG5GTrq3K4D5%2Fimage.png?alt=media&#x26;token=36fbd3ab-107c-4e1a-8bd6-77e796ac70fc" alt="Pi-hole DNS entered in macOS DNS settings."><figcaption><p><br></p></figcaption></figure>
5. Click **OK** and then click **Apply**.
   {% endtab %}

{% tab title="Linux" %}

### Method 1: Using Network Manager <a href="#linux-gui" id="linux-gui"></a>

1. Open **Settings**, and then open either the **Network** or the **Wi-Fi** section (depending on your network type).

2. Click the gear button and go to the **IPv4** tab.

3. Next to **DNS**, disable the **Automatic** toggle.

4. Enter the Meshnet IP of the Pi-hole device and the DNS of another provider separated by a comma in the specified field.<br>

   <div align="left"><figure><img src="https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2FW43YYlrt8eaC1YFozXAH%2Fimage.png?alt=media&#x26;token=09497bbb-c5f4-4084-ac31-b3688f46ade1" alt="Pi-hole Meshnet IP and alternate DNS address entered in Linux network settings."><figcaption></figcaption></figure></div>

5. Click **Apply**.

6. Open **Terminal** and run the following command to restart the Network Manager daemon:<br>

   ```bash
   sudo systemctl restart NetworkManager
   ```

7. Enter your sudo password.&#x20;

### Method 2: Using Terminal <a href="#linux-cli" id="linux-cli"></a>

1. Open **Terminal** and run the following command:<br>

   ```bash
   sudo nano /etc/systemd/resolved.conf
   ```

2. Locate the `DNS` and `FallbackDNS` lines.

3. Uncomment the lines by removing the hash (#) symbols.

4. Enter the DNS addresses following the equals (=) sign.\
   \
   `DNS=<Meshnet IP of the Pi-hole device>`\
   `FallbackDNS=<DNS of another provider>`

   <div align="left"><figure><img src="https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2FZxsdvkik2lbv9GUVC1oW%2Flinux_dns_change.png?alt=media&#x26;token=2f75a20e-61d0-4695-b564-f89b54de1345" alt="Pi-hole Meshnet IP and alternate DNS address entered in the resolved.conf file."><figcaption></figcaption></figure></div>

5. Press **Ctrl** + **X**, **Y**, and **Enter** to exit and save the changes.

6. Run the following command to ensure that the network changes are applied:<br>

   ```bash
   sudo systemctl restart systemd-resolved
   ```

7. Enter your sudo password.&#x20;

{% hint style="info" %}
**Note**

Changes in the `/etc/systemd/resolved.conf` file have a higher priority than settings in the Network Manager. Due to this, ensure that there are no custom configurations in the previously mentioned`resolved.conf` file if you apply the DNS change directly via the Network Manager settings. Otherwise, the specified DNS addresses will not be used.
{% endhint %}
{% endtab %}
{% endtabs %}

{% hint style="success" %}
**Tip**

If you're looking for alternate DNS addresses, here are some of the most popular free DNS providers:

* Google — 8.8.8.8 and 8.8.4.4
* Cloudflare — 1.1.1.1 and 1.0.0.1
* Adguard — 176.103.130.130 and 176.103.130.131
* Quad9 — 9.9.9.9 and 149.112.112.112
* OpenDNS — 208.67.222.222 and 208.67.220.220

You can also use the same upstream DNS addresses from the Pi-hole configuration.
{% endhint %}

After changing the DNS server to the Pi-hole’s Meshnet IP address, the setup is finished. Now you will be able to safely use Pi-hole’s protection features while being far away from your home network.

&#x20;
