Why Self-host Pi-hole on a VPS
Most Pi-hole guides assume a Raspberry Pi on your local network. A VPS completely changes the equation: your DNS blocker is reachable from any device, anywhere in the world. Configure your smartphone on the go to point to your VPS, and ads disappear even on mobile networks and public Wi-Fi.
Concrete benefits of Pi-hole on a VPS
- Universal protection: covers all your devices (PCs, phones, tablets) without per-device configuration
- Bandwidth reduction: blocked requests consume zero download bytes
- Centralized DNS logs: full visibility on domains contacted by each device
- ISP independence: your DNS no longer transits through your ISP's resolver
- IoT tracker blocking: connected devices cannot contact their telemetry servers
- Customizable: add your own rules, whitelist what you need, choose your lists
Pi-hole v5 vs Pi-hole v6: What Changed
Pi-hole v5 vs v6
Scroll the table
| Feature | Pi-hole v5 | Pi-hole v6 (2025) |
|---|---|---|
| Web interface | PHP + lighttpd | Built into FTL, no lighttpd needed |
| DNS engine | Separate dnsmasq | Unified FTL (Faster Than Light) embeds DNS |
| API | Limited API, key in URL | Full REST API with token authentication |
| Configuration | Files in /etc/pihole/* | Single TOML file pihole.toml |
| Installation | curl | bash script | curl | bash script (identical, same URL) |
| Docker | pihole/pihole image | pihole/pihole image (updated, same name) |
Migration from v5 to v6 is done via the standard installation script run on an existing v5 system: Pi-hole detects the existing version and offers the upgrade. Configuration is automatically converted to TOML format. If starting from scratch, install v6 directly.
Technical Requirements
What you need
- A VPS running Ubuntu 22.04/24.04 or Debian 12 with at least 512 MB RAM (1 GB recommended)
- A static IPv4 address and ideally an IPv6 address
- Root or sudo SSH access
- Port 53 (TCP and UDP) open in the VPS firewall and at your hosting provider
- Port 80 or 443 for the web interface (optional but recommended with HTTPS)
Deploy Pi-hole Step by Step
Full installation on Ubuntu/Debian
Disable the systemd-resolved stub resolver
Install Pi-hole
Configure the firewall
Verify operation
Point your devices to the VPS
Access the web interface
Adding Recommended Blocklists
Pi-hole ships with a basic list. For effective blocking, add proven community lists from the Adlists menu in the web interface (Group Management → Adlists).
Recommended lists
- StevenBlack Unified (ads + trackers): https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts — the reference, ~100,000 domains
- OISD Big: https://big.oisd.nl — aggressive list but few false positives, ~500,000 domains
- Firebog Ticked (green checkmark only): visit firebog.net and only add green-ticked lists to minimize false positives
- HaGeZi Multi PRO: https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/pro.txt — excellent malware coverage
- Perflyst Smart-TV: to block telemetry from smart TVs
After adding lists, click Tools → Update Gravity (or run pihole -g via SSH) to download and compile all lists. The operation can take 1 to 3 minutes depending on the number of lists. Pi-hole remains functional during the update.
Managing False Positives and Whitelisting
Overly aggressive blocking eventually breaks legitimate services. Pi-hole provides precise diagnostic tools to identify and fix false positives without weakening your protection.
Diagnosing and fixing a false positive
Identify the blocked domain
Add to whitelist
Whitelist from the command line
Common false positive cases
Resolving Docker and Port 53 Conflicts
If your VPS runs Docker containers, you'll encounter a second problem: Docker creates its own internal DNS resolver that may also listen on port 53. Here's how to coexist.
Resolving Docker DNS conflicts
Disable Docker's host-level DNS
Pi-hole itself in Docker
Verify no other process is listening
Pi-hole + Unbound: Full DNS Recursion Without a Third Party
By default, Pi-hole forwards unblocked queries to a public resolver (Cloudflare 1.1.1.1, Google 8.8.8.8). That resolver then sees all your DNS queries. Unbound solves this by querying root and authoritative servers directly — no intermediary.
Installing and configuring Unbound
Install Unbound
Create the Pi-hole + Unbound configuration
Point Pi-hole to Unbound
Verify recursion
Monitoring Pi-hole Metrics
The Pi-hole v6 dashboard shows key metrics in real time. Here's how to interpret them and what to watch.
Important metrics and reference values
- Blocking rate (Ads blocked today): between 10% and 30% is normal. A rate below 5% suggests your lists are incomplete. A rate above 40% may indicate too many false positives.
- Queries/24h: gives an idea of the load. A family network typically generates 5,000 to 50,000 queries per day.
- Top Blocked Domains: if an ad domain tops the list every day, the corresponding app is particularly intrusive.
- Top Clients: identify the most talkative devices — IoT objects are often at the top.
- DNS cache size: in v6, FTL manages the internal cache. A high hit rate (>60%) reduces perceived latency.
- Query Types: an abnormal volume of PTR (reverse resolution) queries may indicate a network scan or misconfigured software.
To export metrics to Grafana or Prometheus, Pi-hole v6 exposes a REST API at /api/metrics. A community exporter (pihole-exporter) lets you integrate Pi-hole into an existing dashboard without modifying Pi-hole's configuration.
Backing Up and Restoring Pi-hole Configuration
Regular Pi-hole backups are essential: they preserve your custom lists, whitelist, groups and DNS configuration, which you won't want to manually reconfigure after a migration or reinstall.
Backup and restore
Create a Teleporter backup
Automate backups
Restore from backup
Back up Unbound configuration
Store your backups off the VPS: copy them to an S3 bucket, a remote server, or your local machine. If your VPS becomes inaccessible, you can reconfigure Pi-hole on a new server in minutes by simply importing the Teleporter file.
