Pi-hole Setup on a Raspberry Pi: Block Ads Across Your NZ Home Network

Pi-hole is a free, network-wide ad blocker you run on your own hardware — most people put it on a Raspberry Pi — and once it is set up it strips ads and trackers from every device on your home network, including phones, smart TVs and in-app ads that browser extensions can never reach. A tidy build costs well under NZ$100 all-in and roughly NZ$2 a year to run. This guide walks through the hardware, the install, how to point a New Zealand router at it, and the local quirks worth knowing before you start.

What Pi-hole is and how it blocks ads

Pi-hole works as a DNS filter for your whole network, not a browser plug-in. DNS (the Domain Name System) is the “phone book” that turns a name like ads.example.com into an IP address a device can connect to. Pi-hole becomes your home’s phone book: when a device asks for a known ad or tracking domain, Pi-hole answers with a dead address so the ad never loads, and passes every normal request through untouched.

Because the filtering happens at the network level, it covers things a browser extension cannot: smart TVs, streaming sticks, phone apps, game consoles and Internet-of-Things gadgets. One small computer protects every device on the network, and there is nothing to install on each phone or laptop.

Pi-hole also gives you a web dashboard showing every DNS query on your network in real time, how many were blocked, and which device asked for what. That visibility alone is a reason many people run it.

Do you actually need Pi-hole?

Pi-hole suits you if you want ad and tracker blocking on devices you cannot install software on, or you like seeing what your network talks to. It is a strong fit for households tired of ads on a smart TV, parents who want a basic layer of content control, and tinkerers who already own a spare Raspberry Pi.

You probably do not need it if a browser ad blocker on one or two computers already covers everything you care about, or if no one in the house will maintain it. Pi-hole does not block ads baked into a video stream (such as those inside some YouTube or Twitch streams), and it occasionally blocks something you did want, so it needs an owner who will add the odd exception. It is a set-and-mostly-forget tool, not a zero-effort one.

What hardware you need

Almost any Raspberry Pi will run Pi-hole, because the software is deliberately lightweight — the official requirement is just 512 MB of RAM and about 2 GB of free storage. The job is answering small DNS lookups, which barely loads the processor, so you do not need a powerful board. If you are weighing up boards in general, our guide to what a Raspberry Pi can do is a good primer.

Which Raspberry Pi is best for Pi-hole?

For a box that only runs Pi-hole, the Raspberry Pi Zero 2 W is the sweet spot: it is the cheapest board Raspberry Pi makes, sips about 0.6 watts, and handles a typical household’s DNS traffic without breaking a sweat. Its only catch is that it has Wi-Fi but no built-in Ethernet port, so you either run it over Wi-Fi or add a USB Ethernet adapter for a rock-solid wired link. If you want to understand the trade-offs between the Pi and other maker boards, see our breakdown of the Raspberry Pi, Arduino and ESP32.

Is a Raspberry Pi 4 overkill for Pi-hole?

Yes — a Raspberry Pi 4 or 5 is far more than Pi-hole alone needs, and it draws more power doing nothing. Buy one only if the same board will also run other jobs: a media server, backups, or a home server. A Pi 4 or Pi 5 handling Pi-hole plus a few containers is money well spent; a Pi 5 doing nothing but Pi-hole is not. If you already own a Pi 3, 4 or 5, use it — there is no need to buy anything new.

The other bits you need

• A microSD card (16–32 GB is plenty). A good-quality card matters more than a big one, since a cheap card is the most common cause of a Pi that stops working.
• A power supply matched to the board (a Zero 2 W needs little; a Pi 5 wants the 27 W USB-C power supply).
• A case to keep dust and curious fingers out.
• Your Wi-Fi password and a computer to flash the card — you will not need a monitor or keyboard for the Pi itself.

How to install Pi-hole on a Raspberry Pi

The whole setup is done “headless” — meaning without a screen or keyboard on the Pi — by flashing the card on your main computer and then connecting over the network. There are five steps.

Step 1: Flash Raspberry Pi OS Lite

Start by writing the operating system to the microSD card with the official Raspberry Pi Imager, a free tool for Windows, macOS and Linux. Choose Raspberry Pi OS Lite (64-bit) — the “Lite” version has no desktop, which is exactly what you want for a device that runs in the background.

Before writing, open Imager’s settings (the gear or edit icon) and pre-configure the device: set a hostname such as pihole, tick Enable SSH (SSH is a way to control the Pi from your computer’s terminal), set a username and a strong password, and enter your Wi-Fi name and password. This means the Pi joins your network and is ready to log into the moment it boots.

Write the card, put it in the Pi, and power it on. Give it a couple of minutes, then connect from your computer’s terminal with ssh [email protected] (or the Pi’s IP address). Once in, update the system with sudo apt update && sudo apt full-upgrade -y.

Step 2: Give the Pi a fixed IP address

Pi-hole must keep the same local IP address, because every device on your network will be told to send its DNS lookups to that exact number. If the address changes, your internet appears to break. The cleanest way to lock it is a DHCP reservation in your router: find the Pi in the router’s list of connected devices and tell the router to always hand that same device the same address. Pi-hole’s own documentation accepts a DHCP reservation as a valid static IP, and it survives an OS reinstall, so it is the method to prefer over editing files on the Pi.

Step 3: Run the Pi-hole installer

Pi-hole installs with a single official command, run on the Pi over SSH:

curl -sSL https://install.pi-hole.net | bash

This downloads and launches an interactive wizard. Step through it: confirm the static IP, pick an upstream DNS provider (Cloudflare on 1.1.1.1, Quad9 on 9.9.9.9 and Google on 8.8.8.8 are all solid choices — Quad9 adds free malware and phishing filtering), accept the default blocklist, and leave the web interface and query logging enabled. At the end the installer shows a randomly generated admin password — note it down. You can set your own any time with sudo pihole setpassword, the password command in Pi-hole v6.

One thing worth knowing about the current release: Pi-hole v6, out since February 2025, builds its web server straight into the software, so there is no separate web server to install or break, and it serves the dashboard on the normal web port with an automatic fallback if that port is busy.

Step 4: Point your network at Pi-hole

Nothing is filtered until your devices actually use Pi-hole for DNS, and the best way to switch the whole house at once is through your router. Log into your router’s admin page, find the DHCP or LAN settings, and change the DNS server handed out to devices to the Pi-hole’s fixed IP address. Reconnect your devices (or wait for their leases to renew) and they will all route DNS through Pi-hole. If your router will not allow this — common in New Zealand — see the section below for the workarounds. Setting DNS at the router is also just good practice; our notes on the best router settings cover where these options usually live.

Step 5: Open the dashboard and test it

Confirm it is working by opening http://pi.hole/admin (or http://your-pi-ip/admin) in a browser and logging in. Within a minute of normal browsing you should see the query count climbing and a percentage of those queries blocked. Load an ad-heavy website or app on a phone and the ads should thin out noticeably. If the dashboard shows zero queries, your devices are not using Pi-hole yet — recheck Step 4.

What are the best Pi-hole blocklists?

Start with the single default list and resist the urge to pile on dozens more. Pi-hole installs with one blocklist already set up, which is enough for most homes on its own. The widely trusted StevenBlack “unified hosts” list, which Pi-hole uses as one of its sources, merges several well-curated feeds and blocks tens of thousands of advertising and malware domains.

If you want more, add lists one at a time and test for a few days before adding the next. The common mistake is stacking huge, overlapping lists until legitimate sites and app logins start failing, then being unable to work out which list caused it. For most people, the default plus perhaps one reputable extra list is the right amount. After adding or changing lists, update the filters from the dashboard (or run pihole -g) so the changes take effect.

The New Zealand angle: routers, Starlink and ISP quirks

Pi-hole behaves the same everywhere, but a few things trip up New Zealand households specifically, mostly because of the routers local providers supply.

When your router won’t let you change DNS

Many ISP-supplied routers in New Zealand hide or lock the DNS field, so you cannot tell the router to hand out Pi-hole’s address. You have three options. The simplest is to set the DNS manually on the devices you care about — each phone, laptop and TV — pointing them at the Pi-hole IP. The second is to let Pi-hole act as your network’s DHCP server (turn off the router’s DHCP and enable Pi-hole’s), which then controls what DNS every device receives. The third is to replace the ISP router, or put it in modem mode behind a router you control; our guide to how to set up a home network walks through that layout.

IPv6 can let devices slip past Pi-hole

If your connection uses IPv6 (the newer internet addressing system, which many NZ fibre and mobile connections now run), devices can quietly bypass Pi-hole. The reason is that the router can advertise its own IPv6 DNS server directly to devices, separate from the IPv4 settings Pi-hole controls, so some lookups go around the filter. The fixes are to point the router’s IPv6 DNS at Pi-hole as well, to use Pi-hole as the router’s upstream resolver so everything funnels through it, or — if you do not need IPv6 on the local network — to disable it on the router. If ads sneak through on a phone that looked blocked earlier, IPv6 is the usual culprit.

Does Pi-hole work on Starlink or a CGNAT connection?

Yes. Pi-hole runs entirely inside your own network, so it does not care whether your internet comes from fibre, fixed wireless or satellite — and it works fine on Starlink and on connections behind CGNAT (Carrier-Grade NAT, where your home shares a public address with other customers). The one thing to check on a Starlink or similar setup is that you are changing DNS on the router that actually hands out addresses to your devices, not on a piece of kit upstream of it.

What Pi-hole costs to run in New Zealand

Running costs are tiny, which is a big part of the appeal. A Raspberry Pi Zero 2 W running Pi-hole draws roughly 0.6 watts around the clock. That works out to about 5 kWh a year — and assuming a typical New Zealand power rate of around 40 cents per kWh, that is only about NZ$2 for the whole year. (We have used 40 cents as a round working figure; your own rate may be a little higher or lower.)

Step up to a Pi 4 or Pi 5 and the board idles at around 2.5–3 watts, so on the same assumption the yearly cost rises to roughly NZ$9–11 — still trivial. The figure only becomes worth thinking about if you repurpose an old desktop PC: those can draw 30–50 watts even when idle, which can mean roughly NZ$100–170 a year just to keep a DNS filter running. For a dedicated Pi-hole, a low-power Pi almost always wins on running cost.

Common mistakes to avoid

• Leaving the Pi on a changing IP address. Without a DHCP reservation the Pi can grab a new address and the whole network appears to lose internet. Lock the IP first.
• Never setting devices to use it. Installing Pi-hole does nothing until your router or devices point their DNS at it. An empty dashboard means this step was missed.
• Ignoring IPv6. Blocking on IPv4 while IPv6 quietly bypasses the filter is the classic “why are there still ads?” trap.
• Over-blocking. Piling on blocklists until a banking login or a shopping cart breaks, with no idea which list did it. Add lists slowly.
• No fallback DNS plan. If the Pi is your only DNS and it goes down, the house loses internet. Either keep a second DNS entry in the router or be ready to swap it back quickly.
• Running it on hardware that costs more to power than it saves. A spare Pi is ideal; a full-size PC left on 24/7 is not.

Is Pi-hole still worth setting up?

Yes — Pi-hole remains one of the most useful single projects for a home network, and it is actively developed, with the major v6 release landing in 2025. Browser extensions still cannot touch smart TVs, consoles or app ads, and newer filtering options have not made a network-wide DNS blocker redundant. It will not block every ad — nothing does — but for a one-off cost under NZ$100 and a couple of dollars a year, it quietly cleans up every device in the house and shows you exactly what your network is talking to. If you want to go further, the same board or a bigger one can run it inside a container alongside other services using Proxmox.