Block ads on phones, laptops, and your office network with Pi-hole and WireGuard

Pi-hole blocks ads and trackers at the DNS level. When a device looks up an ad domain, Pi-hole answers with an empty address, so the ad never loads. This works in every app, not just the browser.

On AwanCerah, Pi-hole is installed together with WireGuard. The DNS port is deliberately not open to the internet so the server cannot be abused, which means devices use Pi-hole through a WireGuard VPN. Ads are blocked wherever you are, including on mobile data. We tested the steps in this guide, and Pi-hole blocks tens of thousands of ad and tracker domains with its default list.

Install Pi-hole

1. Open Create server in the console. At the operating system step, switch to the Apps tab and choose Pi-hole.
2. Pick a plan. Pi-hole needs at least 1 vCPU and 1 GB RAM, so the cheapest plan is enough.
3. Fill in Domain (optional) to open the Pi-hole panel over HTTPS, then point the domain's A record to the server IP.
4. Create the server. About 4 minutes later, the Pi-hole card on the server page shows the sign-in details.

If the server uses a firewall, open port 51820/UDP for WireGuard.

Connect phones and laptops

1. Open the WireGuard panel, enter the Username and WireGuard panel password, and click Sign In.
2. Click New, enter a Name (for example phone-budi), and click Create Client.
3. Install the WireGuard app on the device: Android and iPhone from Google Play or the App Store, Windows and macOS from wireguard.com.
4. On a phone, add a tunnel by scanning the QR code from the QR icon next to the client name. On a laptop, click the download icon to get the configuration file and import it into the WireGuard app.
5. Turn the tunnel on. All DNS on that device now goes through Pi-hole.

Create one client per device. If a device gets lost, delete its client without affecting the others.

DNS only or all traffic

By default, all of the device's traffic goes through the VPS. That suits you if you also want to protect your connection on public Wi-Fi. If blocking ads is all you need, send only DNS through the VPN so the rest of your internet traffic stays direct and fast:

1. In the WireGuard panel, open the Admin Panel and then Config.
2. Under Allowed IPs, remove 0.0.0.0/0 and ::/0, add 10.8.1.2/32 (the Pi-hole address), and save.
3. Download the configuration file again or rescan the QR code on every device, because this setting is stored on the device.

To change a single client, open it with the edit icon and add 10.8.1.2/32 under Allowed IPs on that page.

Connect a whole network through MikroTik

To block ads on every device in an office or home without installing apps one by one, connect a MikroTik router (RouterOS v7) as a WireGuard client and point the router's DNS to Pi-hole.

1. In the WireGuard panel, create a new client such as office-router and click the download icon. The configuration file contains PrivateKey, Address, PublicKey, PresharedKey, and Endpoint.
2. Open Terminal in Winbox and run the commands below with the values from that file. 10.8.0.3 is an example, use the IPv4 address from the Address line.

/interface wireguard add name=pihole private-key="PRIVATE-KEY-FROM-FILE"
/interface wireguard peers add interface=pihole public-key="PUBLIC-KEY-FROM-FILE" preshared-key="PRESHARED-KEY-FROM-FILE" endpoint-address=SERVER-IP endpoint-port=51820 allowed-address=10.8.1.2/32 persistent-keepalive=25s
/ip address add address=10.8.0.3/32 interface=pihole
/ip route add dst-address=10.8.1.2/32 gateway=pihole
/ip dns set servers=10.8.1.2 allow-remote-requests=yes

1. Make sure devices on the network use the router as their DNS server. With MikroTik's default configuration, the DHCP server already hands out the router address as DNS.

Only DNS goes through the VPN, and all other internet traffic still leaves the router directly.

Manage Pi-hole

Sign in to the Pi-hole panel with the Address and Password from the console. The dashboard shows total queries, blocked queries, and the number of domains on your block lists.

• Query Log: the domains requested and which ones were blocked. Devices connected through WireGuard appear as a single client, the WireGuard panel.
• Domains: allow a domain that was blocked but is needed, or block extra domains.
• Lists: add more block lists, then run Update Gravity from the Tools menu.
• Disable Blocking: pause blocking for a short time, such as 30 seconds, to check whether a site breaks because of Pi-hole.

Tips

• Browsers such as Chrome and Firefox have a secure DNS feature (DNS over HTTPS) that can bypass Pi-hole. Turn it off if ads still appear in the browser.
• The WireGuard panel is served over plain HTTP, so open it from networks you trust.
• Delete clients you no longer use from the WireGuard panel.
• Pi-hole and WireGuard run as Docker containers on your server. To update them, sign in over SSH and run:

cd /opt/pihole
docker compose pull
docker compose up -d