Pi-hole behind Tailscale

As I age, I become increasingly cautious about my privacy. The slope the world is sliding on is also a big, unfortunate incentive. I have been eying Pi-hole for some time: in this post, I want to explain what it does, how to install it on a .

My take on privacy

Privacy, or more specifically digital privacy, is the ability to protect oneself from the constant data collection by legitimate companies and malicious actors alike when online. Given that going online represents the bulk nowadays, if not the entirety, of one's activity on a digital system, it's a constant battle. Moreover, some places are more or less inclined to protect their people's privacy. I'm quite safe in the European Union, and my Californian friends enjoy a similar level of privacy by law.

Other countries range from the bad to the none. Worse, most companies located in non-regulated countries either don't know, don't care, or don't risk much.

I have been using ad blockers for ages, but they represent only a tiny bit of a larger picture. First, marketers have been using techniques that allow profiling people without cookies, using hardware and software data that browsers leak. Second, in this day and age, not all requests go through your browser. I'm using Claude Code and a couple of other coding assistants a lot. I'm working on is one of the many tools available that can improve your privacy. It operates as a DNS proxy, which points to a "real" DNS. You point your devices to it, and it filters out domains that are considered privacy threats.

The Pi-hole® is a DNS sinkhole that protects your devices from unwanted content, without installing any client-side software.

• 
  Easy-to-install: our versatile installer walks you through the process and takes less than ten minutes


• 
  Resolute: content is blocked in non-browser locations, such as ad-laden mobile apps and smart TVs


• 
  Responsive: seamlessly speeds up the feel of everyday browsing by caching DNS queries


• 
  Lightweight: runs smoothly with minimal hardware and software requirements


• 
  Robust: a command-line interface that is quality assured for interoperability


• 
  Insightful: a beautiful responsive Web Interface dashboard to view and control your Pi-hole


• 
  Versatile: can optionally function as a DHCP server, ensuring all your devices are protected automatically


• 
  Scalable: capable of handling hundreds of millions of queries when installed on server-grade hardware


• 
  Modern: blocks ads over both IPv4 and IPv6


• 
  Free: open-source software which helps ensure you are the sole person in control of your privacy

— is clear, and I won't paraphrase it.

However, we will use Tailscale later: don't configure your router to have DHCP clients use Pi-hole as their DNS server as is stated in the post-install section.

After a few days, you'll get something similar to the following dashboard:

, so you don't need to start from scratch. However, you can add other lists. The GitHub repository provides lists for several categories, i.e., at the time of this writing: fake news, gambling, porn, and social. This way, you can not only preserve your privacy, but also prevent the usage of certain categories. You can either replace the default list with a unified list to encompass all you want to block or add only deltas.

Note that Pi-hole doesn't use the list directly, but in a database named Gravity. I assume that it's an in-memory index used for performance reasons. Every time you change your block/allow lists, you must rebuild the database.

CODE Kopieren

  [✓] DNS resolution is available



  [i] Neutrino emissions detected...



  [✓] Preparing new gravity database

  [✓] Creating new gravity databases

  [✓] Pulling blocklist source list into range

  [i] Using libz compression



  [i] Target: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts

  [✓] Status: Retrieval successful

  [✓] Parsed 78995 exact domains and 0 ABP-style domains (blocking, ignored 1 non-domain entries)

      Sample of non-domain entries:

        - fe80::1%lo0



  [i] Target: https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-gambling-porn-only/hosts

  [✓] Status: Retrieval successful

  [✓] Parsed 84574 exact domains and 0 ABP-style domains (blocking, ignored 0 non-domain entries)



  [✓] Building tree

  [i] Number of gravity domains: 163569 (163557 unique domains)

  [i] Number of exact denied domains: 1

  [i] Number of regex denied filters: 0

  [i] Number of exact allowed domains: 0

  [i] Number of regex allowed filters: 0

  [✓] Optimizing database

  [✓] Swapping databases

  [✓] The old database remains available

  [✓] Cleaning up stray matter



  [✓] Done.

Pi-hole and Tailscale

As for Pi-hole, installing Tailscale on the Pi is

Bonus: Pi-hole in Home Assistant

I discovered by chance that an integration with Home Assistant is available via the

The card is

Conclusion

In this post, I showed how to make a step toward greater privacy by using Pi-hole behind Tailscale. It's only a small effort, but it yields me great benefits. Please share your own tricks!

To go further:

Originally published at A Java Geek on March 8^th, 2026.

Vollständiger Original-Bericht

Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf dev.to.

↗ Original-Artikel auf dev.to lesen