Browser extensions block ads on the browser — but ads still load on your smart TV, phone apps, streaming services, and IoT devices. Network-wide ad blocking works at the DNS layer: when any device tries to look up an ad server's domain, the DNS resolver says "doesn't exist" and the ad never loads. In 2026, you can set this up in under an hour with free software, and it covers everything on your network without touching individual devices.
What changed in 2026
- AdGuard Home 1.6+ added encrypted DNS (DoH, DoT, DNSCrypt) out of the box, closing a privacy gap Pi-hole had for years.
- Pi-hole v6 launched with a redesigned admin interface and native HTTPS support, significantly closing the UX gap with AdGuard Home.
- Raspberry Pi 5 availability improved, making the classic Pi-hole hardware setup more accessible.
- Many ISP routers now allow custom DNS entries, enabling DNS-based blocking without any additional hardware for light users.
The three approaches
| Method |
Blocks ads on all devices |
Requires hardware |
Difficulty |
| Pi-hole (self-hosted) |
Yes |
Yes (Pi or any Linux server) |
Medium |
| AdGuard Home (self-hosted) |
Yes |
Yes (Pi or any Linux server) |
Easy–Medium |
| NextDNS / ControlD (cloud DNS) |
Yes |
No |
Easy |
| Router custom DNS (basic) |
Partial |
No |
Easy |
Method 1: AdGuard Home (recommended for 2026)
Requirements: Raspberry Pi (any model), old PC, NAS, or a VPS running Linux.
- Install AdGuard Home:
curl -s -S -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -v
- Open
http://<your-server-ip>:3000 to complete setup via the web wizard.
- Set the admin interface port (default 3000) and DNS port (53).
- Point your router's DHCP DNS to the server's IP address. In your router admin panel: LAN → DHCP → DNS server → enter the IP of your AdGuard Home device.
- All devices on your network now use AdGuard Home for DNS — ads and trackers are blocked by the default blocklist.
Add blocklists: AdGuard Home dashboard → Filters → DNS Blocklists → Add blocklist. Recommended additions:
- OISD Full:
https://big.oisd.nl/
- StevenBlack Hosts:
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
Method 2: Pi-hole
Requirements: Same as AdGuard Home. Pi-hole is slightly older and more documented online.
- Install with the one-line installer:
curl -sSL https://install.pi-hole.net | bash
- Follow the interactive setup wizard — select your network interface and DNS upstream provider (Cloudflare 1.1.1.1 or Google 8.8.8.8).
- Set your router's DHCP DNS server to the Pi-hole's IP.
- Access the admin at
http://pi.hole/admin.
- Add additional blocklists under Settings → Blocklists.
Pi-hole v6 has a much improved interface. The feature set is comparable to AdGuard Home for most home users.
Method 3: NextDNS / ControlD (no hardware required)
If you do not want to maintain a server, cloud DNS blockers work similarly:
- Sign up at nextdns.io or controld.com (both have free tiers).
- Configure your router's DNS to use the provided NextDNS or ControlD addresses.
- Blocklists and analytics are managed in the cloud dashboard.
NextDNS free tier: 300,000 queries/month (a family of 4 typically uses 100,000–200,000/month). Beyond that, ~$2/month.
Choosing blocklists
| Blocklist |
What it covers |
Aggressiveness |
| Default Pi-hole/AdGuard lists |
Major ad networks |
Low (fewer false positives) |
| OISD Full |
Ads + trackers + malware domains |
Medium |
| StevenBlack |
Ads, malware, social trackers |
Medium |
| HaGeZi Multi Pro |
Comprehensive, well-maintained |
High |
Start with OISD + StevenBlack. If something breaks on a site you need, use the "Whitelist" feature to allow that specific domain.
How to pick
- Tech-comfortable, want the best local control? AdGuard Home on a Raspberry Pi 5.
- Already run Pi-hole and it works? Stick with it — Pi-hole v6 is solid.
- No interest in maintaining hardware? NextDNS free tier is excellent.
- Want ads blocked but cannot change router DNS? Install the AdGuard DNS app or NextDNS profile on each device individually.
Common mistakes
Not setting a static IP for your Pi/server. If the DNS server's IP changes (DHCP reassignment), all devices lose DNS and appear to lose internet. Assign a static IP in your router's DHCP settings before pointing DNS to it.
Overly aggressive blocklists from day one. Some lists block first-party CDNs and break legitimate sites. Start with the defaults and add lists incrementally.
Blocking too much on mobile. Apps on iOS and Android increasingly use CNAME cloaking and in-app ad networks that bypass DNS blocking. DNS blocking on mobile is effective but not 100%.
Not setting an upstream fallback DNS. If your Pi-hole/AdGuard Home goes down with no fallback, internet breaks for the whole house. Set a secondary DNS (e.g., 1.1.1.1) as backup in router settings.
Forgetting to enable HTTPS for the admin panel. The admin UI login over plain HTTP on your local network is acceptable, but enable HTTPS if the server is accessible beyond your local network.
What to skip
- Hosts-file ad blocking on each individual device when you have a network-level setup — redundant and harder to maintain.
- Extremely aggressive blocklists (like blocking all social media domains) unless you want frequent whitelist maintenance.
- Running Pi-hole on the same device as your NAS or Plex server without isolating the DNS port — port conflicts are common.
FAQ
Will this break any websites?
Occasionally — if a site uses the same domain for ads and content delivery, blocking it breaks the site. Use the whitelist/allow feature to fix specific domains. Most sites work without issue.
Does this block ads in YouTube or Spotify?
YouTube and Spotify serve ads from the same domains as their content, so DNS blocking cannot differentiate. You need a browser extension or a dedicated YouTube client for those.
How do I know it is working?
Open the AdGuard Home or Pi-hole dashboard — you will see DNS queries being blocked in real time. Visit a site with ads and check if the counters increase.
Can I use this with a VPN?
Yes — if you run both AdGuard Home and a VPN client on the router, the order of operations matters. Configure the VPN to use your AdGuard Home instance as its DNS resolver so blocking still applies through the tunnel.
Where to go next
See how to set up a VPN on a router in 2026, how to secure your router in 2026, and how to set up Pi-hole in 2026.