Run Pi-hole on a VPS: Network-Wide Ad Blocking You Can Use Anywhere

The One Rule: Never Run an Open Resolver

A DNS server that answers anyone on the internet will be abused for amplification attacks within hours, and your provider will get abuse reports. So we do not expose Pi-hole's DNS port to the world. Instead, Pi-hole listens only on a private WireGuard interface, and your devices reach it through the VPN tunnel.

If you already followed our WireGuard guide, you have the tunnel. If not, set that up first. This post assumes WireGuard is running and your server has a wg0 interface at 10.8.0.1.

Step 1: Install Docker

curl -fsSL https://get.docker.com | sh

Step 2: Run Pi-hole Bound to the VPN Only

The key is binding the DNS ports to the WireGuard address, not 0.0.0.0. Save as docker-compose.yml:

services:
  pihole:
    image: pihole/pihole:latest
    restart: always
    environment:
      TZ: Europe/Amsterdam
      FTLCONF_webserver_api_password: change-this-password
      FTLCONF_dns_listeningMode: all
    ports:
      - "10.8.0.1:53:53/tcp"
      - "10.8.0.1:53:53/udp"
      - "10.8.0.1:8080:80/tcp"
    volumes:
      - etc-pihole:/etc/pihole
      - etc-dnsmasq:/etc/dnsmasq.d
    cap_add:
      - NET_ADMIN

volumes:
  etc-pihole:
  etc-dnsmasq:

Because every port is bound to 10.8.0.1, Pi-hole is unreachable from the public internet, only devices on the VPN can talk to it. Bring it up:

docker compose up -d

Step 3: Point Your Devices at It

On each device's WireGuard config, set the DNS to the Pi-hole address:

[Interface]
DNS = 10.8.0.1

Reconnect the tunnel. Now every DNS lookup from that device goes through Pi-hole and gets filtered, ads and trackers blocked system-wide, in every app, not just the browser.

Step 4: The Admin Panel

The dashboard is on 10.8.0.1:8080/admin, reachable only while you are on the VPN. Log in with the password you set, then add a couple of well-maintained blocklists under Adlists. The defaults are conservative, and a good curated list blocks far more.

Step 5: Verify and Maintain

Check that filtering works from a connected device:

nslookup doubleclick.net 10.8.0.1

A blocked domain resolves to 0.0.0.0. Update Pi-hole with docker compose pull && docker compose up -d, and update blocklists from the dashboard occasionally.

What It Costs

Pi-hole is tiny, DNS filtering barely touches CPU or RAM, so the smallest plan runs it easily. On NoctHost you pay hourly from a prepaid balance and top up with crypto, so a personal ad-blocking DNS plus VPN endpoint costs about $10 a month on the Micro plan (1 vCPU, 1 GB), with a dedicated IPv4 that is yours alone.