Prerequisites

You will need:

• Ubuntu 24.04 LTS server with a static IP address (or DHCP reservation on your router)
• SSH access to the server (or direct console access)
• sudo privileges on the account you are using
• Access to your router’s admin panel for DNS configuration changes later

Fix the systemd-resolved Port 53 Conflict

This is the step that catches everyone. Ubuntu 24.04 runs a local DNS stub resolver called systemd-resolved by default. It listens on port 53, which is the standard DNS port. Pi-hole also needs port 53. Two services cannot bind to the same port, and the Pi-hole installer will either fail or produce a broken installation if you skip this step.

I have seen people waste hours debugging this. It is documented in the Pi-hole FAQ, it is mentioned in every Pi-hole subreddit thread about Ubuntu, and people still miss it. Do not be one of them.

Step 1: Confirm the conflict exists

sudo ss -lntp | grep ':53 '

If you see systemd-resolve in the output, port 53 is occupied and you need to free it.

Step 2: Disable the DNS stub listener

sudo nano /etc/systemd/resolved.conf

Find the [Resolve] section and set these values:

[Resolve]
DNSStubListener=no
DNS=1.1.1.1
FallbackDNS=8.8.8.8

Step 3: Fix the resolv.conf symlink

This is the step people forget. Even after disabling the stub listener, Ubuntu still points /etc/resolv.conf at the old stub address (127.0.0.53). You need to update the symlink:

sudo rm /etc/resolv.conf
sudo ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf

Step 4: Restart the service and verify

sudo systemctl restart systemd-resolved
sudo ss -lntp | grep ':53 '

The second command should return nothing. Port 53 is now free for Pi-hole.

Install Pi-hole

With port 53 clear, the installation itself is straightforward. Pi-hole provides a single-command installer:

curl -sSL https://install.pi-hole.net | bash

Yes, piping curl to bash makes security people uncomfortable. If you want to review the script first:

curl -sSL https://install.pi-hole.net -o pihole-install.sh
less pihole-install.sh
sudo bash pihole-install.sh

The installer walks you through several choices. Here is what to select:

• Upstream DNS provider: Cloudflare (1.1.1.1) or Google (8.8.8.8) are fine starting points. You can change this later. If you care about DNS privacy, Cloudflare is the better choice as they have committed to not selling query data. Google has not made the same commitment.
• Blocklists: Accept the default Steven Black list. You will add more later.
• Admin web interface: Yes. You want this.
• Web server (lighttpd): Yes, unless you already have a web server running on port 80. If you are running Nginx or Apache, say no here and configure a reverse proxy manually.
• Query logging: Yes. The logs are what make Pi-hole educational, not just functional.
• Privacy mode: Show everything, at least initially. You can lock this down later once you understand what your network is doing.

At the end of the installation, the script displays your admin password. Write this down or change it immediately:

pihole -a -p

This prompts you to set a new web interface password.

Configure Upstream DNS

Pi-hole is not a recursive DNS resolver by default. It forwards queries to an upstream provider. The installer asked you to pick one, but you can change or add more via the web interface at Settings > DNS.

My recommendations:

• Primary: Cloudflare (1.1.1.1) — fast, privacy-focused, WARP-compatible
• Secondary: Quad9 (9.9.9.9) — blocks known malicious domains at the resolver level, good second layer

Avoid using your ISP’s DNS servers. They are typically slower, they log everything, and some ISPs inject ads or redirect failed lookups to search pages. The entire point of running Pi-hole is to control your DNS. Sending queries to your ISP undermines that.

Point Your Network at Pi-hole

Pi-hole is running, but right now only the server itself is using it. You need every device on your network to send DNS queries to Pi-hole. There are three ways to do this, in order of preference.

Option 1: Change DNS in your router’s DHCP settings (best)

Log into your router’s admin panel and find the DHCP settings. Set the DNS server that gets handed to devices via DHCP to your Pi-hole server’s IP address. This way, every device that connects to your network automatically uses Pi-hole without any per-device configuration.

The advantage of DHCP-level DNS assignment is that Pi-hole sees each device’s individual queries. If you change the router’s own DNS settings instead (Option 2), all queries appear to come from the router’s IP, and you lose per-device visibility in the logs.

Option 2: Change the router’s DNS servers

If your router does not expose DHCP DNS settings separately (many consumer routers hide this), change the router’s own DNS servers to your Pi-hole IP. This works but means Pi-hole sees all queries coming from the router rather than from individual devices.

Option 3: Per-device manual configuration

If you have a locked-down ISP router that will not let you change DNS settings at all (looking at you, BT Home Hub and Sky Q), you can manually set DNS on each device. This is tedious but it works.

After changing your DNS settings, renew DHCP leases on your devices. The quickest way is to disconnect and reconnect to Wi-Fi, or restart the device. Within a few minutes, queries should start appearing in the Pi-hole dashboard.

The Gravity Database and Blocklist Management

Pi-hole’s blocklist database is called Gravity. When you add a blocklist URL, Pi-hole downloads the list and imports the domains into the Gravity database. This is a local SQLite database, not a text file, which is why Pi-hole can handle millions of blocked domains without performance degradation.

To add blocklists, go to Adlists in the web interface. Here are the lists I run:

• Steven Black Unified Hosts: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts — the default, well-maintained, covers the basics
• OISD Full: https://big.oisd.nl/ — aggressive but well-curated, catches a lot of telemetry
• Hagezi Pro: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/pro.txt — excellent balance of coverage and false positive avoidance

After adding lists, update Gravity to pull them in:

pihole -g

Or use the web interface: Tools > Update Gravity. Gravity updates automatically on a weekly cron schedule, but always run it manually after adding new lists.

Group Management for Family Members

Pi-hole 5 and later supports group management, which is genuinely useful if you share a network with other people. The concept is simple: you can assign devices to groups, and each group can have different blocklists and whitelist rules.

Why this matters: your filtering needs are probably different from your children’s. You might want aggressive blocking on the kids’ devices but more relaxed rules on your own machine where you need access to ad-supported tools for work.

To set this up:

1. Go to Group Management > Groups and create groups (e.g., “Adults”, “Kids”, “IoT Devices”)
2. Go to Group Management > Clients and assign devices to groups by their IP or MAC address
3. Go to Group Management > Adlists and assign blocklists to specific groups
4. Go to Group Management > Domains and assign whitelist entries to specific groups

A practical example: I have an “IoT” group with the most aggressive blocklists applied. Smart TVs, smart speakers, and home automation devices do not need access to advertising or analytics networks. They get blocked hard. My personal machines are in a group with more permissive rules because I occasionally need to access sites that aggressive lists would break.

Whitelisting False Positives

Things will break. It is not a question of if. Someone in your household will try to do something and it will not work, and the cause will be Pi-hole blocking a domain that the service depends on.

The diagnostic process:

1. Open the Pi-hole query log (Query Log in the web interface)
2. Filter by the device having problems
3. Look for blocked entries (shown in red) that correspond to the service that is broken
4. Click the blocked domain and add it to the whitelist

Common domains you will likely need to whitelist:

• s.youtube.com — YouTube history and watch later
• clients4.google.com — Android connectivity checks
• captive.apple.com — Apple Wi-Fi portal detection
• outlook.office365.com — Microsoft 365 email
• Your bank’s CDN and authentication domains (these vary)

The community maintains a whitelist of common false positives at https://github.com/anudeepND/whitelist. Review it, but do not blindly import the whole thing. Some entries will re-enable tracking you specifically wanted blocked.

Keeping Pi-hole Updated

Native Pi-hole installations update through the built-in updater:

pihole -up

This updates Pi-hole core, the web interface, and FTL (the DNS engine). Run it periodically. Pi-hole does not auto-update, and running old versions means missing security patches and new features.

For the underlying Ubuntu system:

sudo apt update && sudo apt upgrade -y

If a kernel update requires a reboot, Pi-hole will come back automatically since it installs as a systemd service. Your network will lose DNS for the thirty seconds or so that the server is rebooting, which most devices handle gracefully by retrying.

Verifying Pi-hole Is Working

After setup, run these checks:

# Test DNS resolution through Pi-hole
dig @localhost google.com

# Test that blocking is working
dig @localhost ads.google.com
# Should return 0.0.0.0 or NXDOMAIN

# Check Pi-hole status
pihole status

# View recent stats
pihole -c

Then open the web interface at http://YOUR-SERVER-IP/admin and watch the query log for a few minutes. You should see queries from your devices appearing and a percentage of them being blocked.

If the dashboard shows zero queries, your devices are not using Pi-hole as their DNS server. Go back to the router configuration section and double-check your settings.

Related Guides

If you found this useful, these guides continue the journey:

• Pi-hole Docker Setup — Run Pi-hole in Docker for network-wide ad blocking.
• Pi-hole vs AdGuard Home — A hands-on comparison of the two most popular DNS ad blockers.
• Pi-hole on Windows via WSL2 — Test Pi-hole on your Windows machine using WSL2.
• Linux Fundamentals — Core Linux skills every self-hoster needs.
• Install Docker on Ubuntu 24.04 — Get Docker installed and running on Ubuntu 24.04 LTS.

ReadTheManualTech

ReadTheManual is run, written and curated by Eric Lonsdale.

Eric has over 20 years of professional experience in IT infrastructure, cloud architecture, and  cybersecurity, but started with PCs long before that.

He built his first machine from parts bought off tables at the local college campus, hoping they worked. He learned on BBC Micros and Atari units in the early 90s, and has built almost every PC he’s used between 1995 and now.

From helpdesk to infrastructure architect, Eric has worked across enterprise datacentres, Azure environments, and security operations. He’s managed teams, trained engineers, and spent two decades solving the problems this site teaches you to solve.

ReadTheManual exists because Eric believes the best way to learn IT is to build things, break things, and actually read the manual. Every guide on this site runs on infrastructure he owns and maintains.

Enjoyed this guide?

New articles on Linux, homelab, cloud, and automation every 2 days. No spam, unsubscribe anytime.

Get new guides straight to your inbox:

New articles every 2 days. No spam, unsubscribe anytime.