Pi-hole VPN Ad Blocking: network-wide filtering on any network

Note: this guide was written for OpenVPN (interface tun0, subnet 10.8.0.0/24). If you run WireGuard instead, follow the WireGuard guide and install Pi-hole with wg0 as the listening interface.

Ads follow you everywhere — laptop, phone, smart TV. Pi-hole is a DNS sinkhole that blocks ad-serving and tracking domains at the network level, so every device benefits without needing a browser extension. Combine it with OpenVPN and you route your phone’s traffic through your home network while on mobile data, blocking ads wherever you go. This Pi-hole VPN ad blocking guide walks through setting up both services and wiring them together.

How Pi-hole VPN ad blocking works

When a device resolves a hostname, Pi-hole checks it against a blocklist of known ad and tracking domains. Blocked queries never leave your network — they get a null response instantly. OpenVPN creates an encrypted tunnel from your remote device back to your home Pi, so all DNS queries go through Pi-hole regardless of where you are.

Step 1 — Install OpenVPN

wget https://raw.githubusercontent.com/Nyr/openvpn-install/master/openvpn-install.sh -O openvpn-install.sh
sudo chmod a+x openvpn-install.sh
sudo ./openvpn-install.sh

Enter your Pi’s local IP when prompted. When asked which DNS to use, choose option 1 (current system resolvers) — you will point it at Pi-hole in the next step. Accept the remaining defaults.

Step 2 — Install Pi-hole

curl -sSL https://install.pi-hole.net | bash

When asked which network interface to listen on, select tun0 — the virtual interface created by OpenVPN. If you select your physical interface (eth0) instead, Pi-hole will not receive DNS queries from VPN clients. Accept all other defaults.

Step 3 — Point OpenVPN at Pi-hole

Find the tun0 IP address (typically 10.8.0.1):

ip addr show tun0

sudo nano /etc/openvpn/server.conf

Update the DNS push directive:

push "dhcp-option DNS 10.8.0.1"

sudo systemctl restart openvpn

Step 4 — Create a VPN client profile

sudo ./openvpn-install.sh

Select “Add a new client”, give it a name, and a .ovpn file will be created in your home directory. Import it into an OpenVPN client app on your device. Once connected, all DNS traffic flows through Pi-hole and ads are blocked everywhere — on every device, on every network.

For more on Pi-hole’s features and blocklist management, visit pi-hole.net. More Raspberry Pi tutorials on the blog.