2026-07-31

How to Set Up a Raspberry Pi 5 as a Network-Wide Ad Blocker with Pi-hole and Unbound

A Raspberry Pi 5 running Pi-hole with Unbound as a recursive DNS resolver gives every device on your network ad blocking and DNS privacy without relying on upstream resolvers like Google or Cloudflare. This guide walks through the exact setup I built and measured, from hardware to a working recursive DNS stack.

My Exact Hardware

The NVMe is wildly overkill for Pi-hole — DNS queries are tiny. But I already had this drive in the system for other homelab services, and the fast random I/O (16K+ IOPS) means the gravity database and query logging never become a bottleneck, even with millions of entries.

Hardware You'll Need

If you're starting from scratch, you need a Raspberry Pi 5 4GB (4GB is plenty for Pi-hole/Unbound alone), a case with cooling, and a boot medium.

I tested with the Fanxiang NVMe above, but if you want a simpler setup, a SanDisk Extreme microSD 64GB is a perfectly reasonable boot drive for a dedicated DNS box. I haven't benchmarked that specific card myself — based on published specs, it should deliver around 90–160 MB/s sequential reads, which is more than enough for this workload.

For cooling, I'm using an active setup that keeps my SoC at 48–49°C even under load. The GeeekPi Pi 5 Heatsink Kit and Argon ONE V3 Pi 5 Case are popular options — I haven't tested those specific products, but reports suggest either will keep a Pi 5 well under thermal throttling at 85°C.

Step 1: Prepare the Pi

Flash Raspberry Pi OS (Lite is sufficient) using rpi-imager. Enable SSH during imaging. Boot, connect via Ethernet (not Wi-Fi — you want a stable IP for DNS), and run:

sudo apt update && sudo apt upgrade -y

Set a static IP. Edit /etc/dhcpcd.conf or your router's DHCP reservation — either works. I use a DHCP reservation on my router so the Pi config stays clean.

Step 2: Install Pi-hole

curl -sSL https://install.pi-hole.net | bash

Follow the interactive installer. Key choices:

• Upstream DNS: Pick anything temporarily — we'll replace it with Unbound.
• Blocklists: Accept the default StevenBlack list. You can add more later.
• Web admin interface: Install it. It's useful.
• Logging: Enable, unless you have privacy concerns about local query logs.

Note the admin password displayed at the end, or reset it:

pihole -a -p

Step 3: Install and Configure Unbound

sudo apt install unbound -y

Create the Pi-hole-specific configuration:

sudo nano /etc/unbound/unbound.conf.d/pi-hole.conf

Paste this configuration:

server:
    verbosity: 0
    interface: 127.0.0.1
    port: 5335
    do-ip4: yes
    do-udp: yes
    do-tcp: yes
    do-ip6: no
    prefer-ip6: no
    harden-glue: yes
    harden-dnssec-stripped: yes
    use-caps-for-id: no
    edns-buffer-size: 1232
    prefetch: yes
    num-threads: 1
    so-rcvbuf: 1m
    private-address: 192.168.0.0/16
    private-address: 169.254.0.0/16
    private-address: 172.16.0.0/12
    private-address: 10.0.0.0/8

Download the root hints file:

sudo wget -O /var/lib/unbound/root.hints https://www.internic.net/domain/named.cache

Restart and test:

sudo systemctl restart unbound
dig google.com @127.0.0.1 -p 5335

You should get an A record back with NOERROR status. The first query will be slow (200–800ms) as Unbound walks the DNS tree from root servers. Subsequent queries for the same domain will be cached and return in under 1ms.

Step 4: Point Pi-hole at Unbound

Open the Pi-hole web admin (http://<your-pi-ip>/admin). Go to Settings → DNS. Uncheck all upstream servers. Under "Custom 1 (IPv4)," enter:

127.0.0.1#5335

Save. Pi-hole now sends all non-blocked queries to your local Unbound instance, which resolves them recursively — no third-party resolver sees your full query stream.

Step 5: Point Your Network at Pi-hole

In your router's DHCP settings, set the DNS server to your Pi's static IP. Renew DHCP leases on clients (or reboot them). Confirm it works:

nslookup doubleclick.net <your-pi-ip>

This should return 0.0.0.0 — blocked by Pi-hole.

DNSSEC Validation

Unbound handles DNSSEC validation natively. Test it:

dig sigfail.verteiltesysteme.net @127.0.0.1 -p 5335

This should return SERVFAIL (bad signature). That confirms DNSSEC is working.

Step 6: Keep It Updated

Set a cron job to refresh root hints quarterly and keep Pi-hole's gravity updated weekly:

sudo crontab -e

0 3 1 */3 * wget -O /var/lib/unbound/root.hints https://www.internic.net/domain/named.cache && systemctl restart unbound
0 4 * * 0 pihole -g

Performance on My Build

On my Pi 5 with the Fanxiang NVMe, Pi-hole's gravity database (with ~170K domains blocked) loads in under a second. The web dashboard is snappy. SoC temperature with Pi-hole and Unbound running alongside other services sits at 49.4°C idle — essentially no thermal concern.

If you're running this as a headless box, a Tri-Fold Bluetooth Keyboard – Wireless Foldable for Headless Servers is handy for initial setup or emergency console access when SSH isn't cooperating.

For those who'd rather not dedicate hardware, you can run Pi-hole + Unbound in Docker on a small VPS from Hetzner Cloud or DigitalOcean for a few dollars a month — though you lose the "runs even when your internet is flaky" resilience of a local device, and your DNS queries travel to the VPS instead of resolving locally.

Who Should NOT Do This

• If you just want ad blocking on one device, use uBlock Origin. Pi-hole is for network-wide coverage.
• If your household relies on services that break with DNS-level blocking (some smart TVs, specific IoT devices), expect to spend time whitelisting domains. Pi-hole's query log helps, but it's ongoing maintenance.
• If you don't have a stable Ethernet connection to your router, a Wi-Fi-connected DNS server introduces a fragile single point of failure for your entire network.

Verdict

A Pi 5 with Pi-hole and Unbound is the most cost-effective way to get network-wide ad blocking with genuine DNS privacy. The hardware is overpowered for the task — my build idles at 49°C with headroom to spare — which means it'll run for years without complaint. Budget 30 minutes for setup, and block a week for fine-tuning your whitelists.