I saw a few posts and each one didn't work for me. I wanted to post my setup and what I needed to whitelist to make it work. I am using two lists, may be overkill but:

https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts;https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts

https://raw.githubusercontent.com/r0xd4n3t/pihole-adblock-lists/main/pihole_adlists.txt

As others have found out, disabling the lists and Paramount works. For me I found this to be blocked, I added to the whitelist:

imasdk.googleapis.com

Paramount worked after that. I was getting Error 131 in my browser. Hope this helps someone else.

I recently shared my small frontend for managing two Pi-hole installations from one interface. The first version was only available in Danish, but version 1.1.004 now includes both Danish and English.

A clarification, because this was misunderstood in my previous post:

This is **not a failover or high-availability solution**. It does not create a virtual IP, designate a primary and secondary Pi-hole, monitor availability or automatically replicate the complete configuration.

The purpose is simpler: I run two independent Pi-hole installations and want an easy way to view, compare and maintain the relevant configuration on both, without opening two separate administration interfaces and repeating every change manually.

The dashboard provides:

- Combined statistics and graphs from both Pi-hole installations

- A combined query log with filtering by client and query type

- Management of allowed and blocked domains

- Local DNS records with clear warnings when the two installations differ

- Named clients used throughout the interface instead of only IP addresses

- Management of adlists

- Gravity updates on either installation

- Actions that can be applied to one or both installations

The two Pi-holes remain independent DNS servers. How they are presented to clients, whether through DHCP, separate networks or another redundancy setup, is outside the scope of this project.

It is a frontend for keeping the configuration it manages consistent and making two installations easier to administer, not a replacement for keepalived, VRRP, Nebula Sync or another failover or replication solution.

The project consists primarily of a single HTML file and uses the Pi-hole v6 REST API through a simple nginx reverse proxy.

English support has just been added. A few minor interface labels are still shown in Danish, but these will be translated in a future update.

GitHub:

https://github.com/tursoe/Dobbelt-Pi-hole

Feedback and suggestions are welcome.

Hello,

I have been using a pihole and unbound DNS forever and everything works. Yesterday for the 1st time, I could not log into Prime Video on my Roku. It kept saying Error 0.28. Prime Video did work on all my other devices during this time just not on my Roku's.

Google searching just shows error .28 as a vague network error. Troubleshooting was to disable pihole and then I was able to login to Prime Video on my Roku. I re-enabled pihole blocker and Prime Video works perfectly fine.

I suspect that my cached credentials got lost or expired, on my Roku, and that it was trying to send something from my Roku to Amazon during the authentication process that Pihole didn't like.

I went through the logs to see what pihole was blocking and I did not see anything out of the ordinary. I went thru the logs before when everything was working and after. Everything recorded during my down time, just looked like normal traffic trying to authenticate but ultimately failing. During my down time, the traffic did not look like anything different before and after it was working. I even asked AI to verify my log findings before, during, and after and specifically note if anything was being blocked during the time I was logging in and getting the error .28. AI said nothing was unusual about my logs.

Everything works now, so I can't diagnose anymore. Does anyone have any ideas what to look at the next time it happens?

so I have a shitty spectrum modem + router, out of my control to replace it (means I have to set dns within the devices rather than my entire network, fml!)

i noticed theres an option in the spectrum app to enable/disable security shield. there's no info on what this does beyond dumbed down language. i tried enabling it to see what it does, and within a few days I get this. (pic)

Its all from various different IPs, doing an IP lookup shows some of them being data centers or alibaba related. What does this mean? I'm not super knowledgeable on this network stuff. are these IPs trying to connect to my Pi, or are these just the IPs being blocked by pihole? It only shows the IPs, not the domains, so I cant be sure if theyre on any of my block lists. Is this dangerous? I also use the same device to host a personal media server to access outside of my home, but that's the only way my device is exposed to the public internet. Is there more I should be doing to secure my device or am I paranoid for no reason?

Has anyone tried the new blocklist feature in UniFi Network 11? You can now add blocklists directly in UniFi, and I’m curious how well it works compared to running Pi-hole.

For those already using Pi-hole, do you think this is a replacement, or is Pi-hole still the better option?

https://blog.ui.com/article/introducing-unifi-network-11

I used to block around 2 million domains. My list auto update and I have noticed over the last few months that my total block likes keeps shrinking.

I am now down to just over 600K.

It is dead domains being removed from the list or are there and updated list you guys suggest?

I give them credit, making the unsubscribe links qualify to be blocked by adblockers is pretty sharp. But what is the best way to circumvent this? I've tried stopping the pihole to unsubscribe but it hasn't worked.

Just wanted to post to see if anyone else has experienced/solved this and make the solution searchable for others in the future.

*These are from sites where I've done business with or use as a service. I want to unsubscribe from their marketing emails, etc and the pihole is blocking the link.

I'm specifically talking about the wi-fi/network settings such as the following. I'm not sure what they should be set to in order to get the most out of pi-hole.

1.) Private Wi-Fi Address (OFF/FIXED/ROTATING)

2.) Limit IP Address Tracking (ON/OFF)

I finally found out that the culprit was pi-hole causing my siri and image playground not to work by disabling pi-hole for 5 minutes. Does anyone here know what settings or changes I need to make to get these features to work?

and as for what lists I am using. They are HaGeZI Multi Pro and HaGeZI TIF.

Hi all I've set up pihole trough tail scale since for my home server to keep it easier I just have it enabled 24/7 for all my family's devices. Everything was fine and it hardly used any battery % on the mobile devices but since I got pihole my partners phone will hardly make it trough half the day and battery usage shows yesterday tailscale drained 80%. Her iPhone has had a ridiculous amount of queries she's at 60k and the rest of the devices are at around 10 -15k queries. Is there a way to stop it sending so many requests? Very new to this

I built a single-file HTML and JavaScript frontend to manage my two Pi-hole instances from one interface and keep their settings in sync.

My original version worked for about four years, until the Pi-hole v6 update broke it last year. A couple of weeks ago, I finally had time to update it to work with v6.

The interface is currently in Danish, but I’m planning to add an English translation in a future version.

It requires a simple nginx reverse proxy to forward requests to both Pi-hole APIs and avoid CORS issues.

Sharing it here in case anyone else running two Pi-hole instances finds it useful!

New to pihole. Implemented one recently and very impressed. Works like a charm for most websites on phone and laptop. Any ad lists to block ads on prime video and disney+ on roku tv?

“This site doesn’t load, is it Pi-hole?” Now I check that on my watch. I built a small open-source app for Pebble smartwatches (made for the new Pebble Time 2) that uses the Pi-hole 6 REST API:

• Status: blocking on/off, queries and blocked queries of the last 24 h, active clients, blocklist size, last gravity update
• Pause blocking: 30 s, 5/15 min, 1 h or indefinitely, resume any time. The watch vibrates when the pause ends.
• Recently blocked: the latest blocked domains with client, time, count and reason (gravity, regex, denylist, CNAME). Allow a domain with one button and undo it just as fast. For CNAME blocks it allows the actual blocked target.

Technical notes:

• Uses an app password, so it also works with 2FA enabled.
• Reuses its API session, so it doesn’t eat up your API seats.
• Requires Pi-hole 6 (no v5 support).
• Use plain http:// in your LAN: the Pebble app rejects Pi-hole’s self-signed HTTPS certificate.

The app only talks to your own Pi-hole. Built with help from Claude (AI) and tested on my own setup. Free and MIT-licensed, bug reports and ideas welcome on GitHub. Not affiliated with Pi-hole.

GitHub: https://github.com/Zeichenfolge/pihole-pebble
Appstore: https://apps.repebble.com/b9dca9f19dcc4ea383652449

Changing the router's advertised DNS address does not prove that every device moved. Static clients, containers, guest networks, VPN profiles, IPv6 router advertisements, secondary DNS settings, and devices that cache DHCP leases can continue querying the old Pi-hole. A quiet source may only mean that a rarely used device is offline.

A useful cutover could keep the old instance running with query logging, compare client lists on both servers, search DHCP and router configuration for the old IPv4 and IPv6 addresses, test each VLAN and VPN, and temporarily block rather than delete the old path. The replacement should also have current gravity data, local DNS records, groups, custom lists, and a tested backup before the source is removed.

What observation window and checks do Pi-hole users rely on? Is there a practical way to distinguish clients that genuinely migrated from clients that silently fell back to public DNS or still have the old address cached?

Hello Everyone,
I am running a PI-Hole on my PI 4 8GB RaspiOS Lite with the following block lists:

https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/pro.plus.txt
https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/tif.txt
https://urlhaus.abuse.ch/downloads/hostfile/

Are these enough to protect my privacy or just I add a few more? IF that is the case, which one would you suggest to me?

Thank you in advance.

I had an issue where Wi-Fi Calling (VoWiFi) worked on other Wi-Fi networks but would not activate on my home network.

My setup:

• iPhone with Claro Colombia
• Omada gateway and access points
• Two Pi-hole instances handling DNS for the LAN
• No custom Omada Gateway ACL rules affecting outbound traffic

At first, I suspected a firewall issue: IPsec pass-through, UDP ports 500/4500, NAT, or an Omada ACL rule. However, the gateway had no deny rules and there was no evidence that outbound traffic was being blocked.

The actual problem was Pi-hole blocking a required DNS record.

How I found it

I opened the Pi-hole Query Log, filtered the results by my iPhone’s LAN IP address, and searched for epdg.

I found repeated blocked DNS requests for:

epdg.ims.mnc101.mcc732.pub.3gppnetwork.org

This is the Claro Colombia ePDG hostname. ePDG stands for Evolved Packet Data Gateway; the phone uses it to discover the carrier endpoint needed for Wi-Fi Calling.

Because Pi-hole blocked the DNS lookup, the iPhone could not establish VoWiFi while connected to my home network.

Fix

I added this exact domain to the allowlist on both of my Pi-hole servers:

epdg.ims.mnc101.mcc732.pub.3gppnetwork.org

In Pi-hole, I went to:

Domains → Add domain → Add to allowed domains

I used an exact allow entry, not a wildcard.

After allowing the domain, I reconnected the iPhone to Wi-Fi, toggled Airplane Mode/Wi-Fi, and Wi-Fi Calling activated immediately.

Troubleshooting advice

If Wi-Fi Calling works on other Wi-Fi networks but not at home, check Pi-hole before opening ports or changing firewall rules:

1. Find your phone’s LAN IP address.
2. Open Pi-hole Query Log.
3. Filter the log by that IP.
4. Search for epdg.
5. Also search for ims and 3gppnetwork.org.
6. If Pi-hole blocks an ePDG domain, allowlist the exact FQDN on every Pi-hole or DNS resolver the phone may use.

Do not copy my Claro Colombia hostname blindly. Each carrier may use a different ePDG hostname.

In my case, no port forwarding, firewall changes, Omada ACL rules, or timeout changes were needed. The entire issue was a blocked DNS query.

I wanted an easier way to manage backups for my Pi-hole instances, so I built Checkpoint Pi-hole.

It's a self-hosted web app that runs in Docker and uses the Pi-hole v6 Teleporter API to handle backups and restores.

Features:

- Automated backups: schedule hourly, daily, or weekly backups.

- One-click restore: restore a backup directly to your Pi-hole.

- Multiple instances: manage backups for multiple Pi-hole installations from one dashboard.

- Retention policies: automatically manage backups by age or count.

- Failure notifications: get notified through Home Assistant, Discord, Slack, Telegram, or Pushbullet if a backup fails.

- Prometheus metrics: monitor backup status and expose metrics for your existing monitoring stack.

Everything runs in a single Docker container, with backups and application data stored in mounted volumes.

It's open source under the MIT license.

GitHub: https://github.com/checkpoint-pihole/checkpoint-pihole

I'd love to hear what you think! What features would you want in a Pi-hole backup tool? I'm especially interested in feedback from people running multiple Pi-hole instances in their homelabs.

I have secondary Pihole docker instance running on a Debian system. A few times over the last few weeks Pihole stops working. The container reports that it is working. The web page reports it can't connect to pool.ntp.org Also I can not resolve any address on Debian
When I run host command I see

;; UDP setup with 192.168.1.2#53(192.168.1.2) for google.com failed: address in use.
;; no servers could be reached
;; UDP setup with 192.168.1.2#53(192.168.1.2) for google.com failed: address in use.
;; no servers could be reached

I tried restarting the container, docker and network services on Debian. Only fix is to reboot. Any suggestions as how to fix this without a reboot.

Yeah so, I literally can’t find any 2W’s so I was considering of getting like a pi 5, but yeah it’s probably a complete overkill for pihole, so I wanted to ask, is zero W (2017 model) enough to run it efficiently?

Thanks in advance.

I had to reset my router to default settings and I've given my Pihole a static IP. Set it as the DNS server in LAN settings and WAN settings the same as it was originally. Now my issue is I can see different IP addresses in Client activity unlike before and I noticed a lot of DNS queries are labeled as "other DNS queries" I have the impression requests are being bypassed where they weren't before. I have been at it for hours looking for solutions and videos but nothing seems to make it operate the same as it was before. I went through everything I could in the Asus documentation too but nothing seems to change a thing. Has anyone dealt with this before? I have no clue what I'm missing.