Run Pi-hole on a VPS — Network-Wide Ad Blocking You Can Use Anywhere

The One Rule: Never Run an Open Resolver

A DNS server that answers anyone on the internet will be abused for amplification attacks within hours, and your provider will get abuse reports. So we do not expose Pi-hole's DNS port to the world. Instead, Pi-hole listens only on a private WireGuard interface, and your devices reach it through the VPN tunnel.

If you already followed our WireGuard guide, you have the tunnel. If not, set that up first — this post assumes WireGuard is running and your server has a wg0 interface at 10.8.0.1.

Step 1: Install Docker

curl -fsSL https://get.docker.com | sh

Step 2: Run Pi-hole Bound to the VPN Only

The key is binding the DNS ports to the WireGuard address, not 0.0.0.0. Save as docker-compose.yml:

services:
  pihole:
    image: pihole/pihole:latest
    restart: always
    environment:
      TZ: Europe/Amsterdam
      FTLCONF_webserver_api_password: change-this-password
      FTLCONF_dns_listeningMode: all
    ports:
      - "10.8.0.1:53:53/tcp"
      - "10.8.0.1:53:53/udp"
      - "10.8.0.1:8080:80/tcp"
    volumes:
      - etc-pihole:/etc/pihole
      - etc-dnsmasq:/etc/dnsmasq.d
    cap_add:
      - NET_ADMIN

volumes:
  etc-pihole:
  etc-dnsmasq:

Because every port is bound to 10.8.0.1, Pi-hole is unreachable from the public internet — only devices on the VPN can talk to it. Bring it up:

docker compose up -d

Step 3: Point Your Devices at It

On each device's WireGuard config, set the DNS to the Pi-hole address:

[Interface]
DNS = 10.8.0.1

Reconnect the tunnel. Now every DNS lookup from that device goes through Pi-hole and gets filtered — ads and trackers blocked system-wide, in every app, not just the browser.

Step 4: The Admin Panel

The dashboard is on 10.8.0.1:8080/admin, reachable only while you are on the VPN. Log in with the password you set, then add a couple of well-maintained blocklists under Adlists — the defaults are conservative, and a good curated list blocks far more.

Step 5: Verify and Maintain

Check that filtering works from a connected device:

nslookup doubleclick.net 10.8.0.1

A blocked domain resolves to 0.0.0.0. Update Pi-hole with docker compose pull && docker compose up -d, and update blocklists from the dashboard occasionally.

What It Costs

Pi-hole is tiny — DNS filtering barely touches CPU or RAM, so the smallest plan runs it easily. On NoctHost you pay hourly from a prepaid balance and top up with crypto, so a personal ad-blocking DNS plus VPN endpoint costs a couple of dollars a month on the Micro plan (1 vCPU, 1 GB) — with a dedicated IPv4 that is yours alone.