Pi-hole with Unbound in Podman

This guide runs Pi-hole and Unbound in two Podman containers on a dedicated network. Pi-hole blocks ads and trackers for the whole network, and Unbound resolves queries directly from the DNS root servers instead of forwarding them to an ISP or a third-party resolver.

Target audience

You want to block domains and ads network-wide with Pi-hole.
You want an extra layer of protection from malicious sites (ransomware, malware and known tracking domains).
You want to run your own recursive DNS resolver instead of relying on your ISP or third-party DNS providers.
You want DNSSEC validation and improved DNS privacy by resolving queries directly through the DNS hierarchy.
You want local DNS caching for faster repeated lookups.
You want to monitor and manage your network DNS traffic.

Prerequisites

Your network must already be set up to use static IP addresses, and the host PC must have a static IP address.
You need to know how to set static addresses on your router and how to change the IP and DNS settings of your PC.
The host PC running Pi-hole must run 24/7. Without it your network has no DNS server and the internet stops working.

Remove an existing Pi-hole container

If you already run Pi-hole, remove it first. This setup uses a different configuration.

Stop the container:
Terminal window
```
sudo podman stop YOUR_CONTAINER_NAME
```
Remove the container:
Terminal window
```
sudo podman rm YOUR_CONTAINER_NAME
```

Install Podman

After each command, press Enter. For security reasons the guide uses sudo for everything. If you show containers without sudo, they do not appear.

Install Podman:
Terminal window
```
sudo pacman -S podman
```
When the dialog asks which provider to use, select the crun option. It gives a lightweight Docker-like experience.
Enable the restart service. Podman has no daemon, so containers do not start again after a reboot on their own. podman-restart.service starts all containers with the --restart=always policy at boot:
Terminal window
```
sudo systemctl enable podman-restart.service
```

Create a Podman network

The network connects the Pi-hole and Unbound containers. You can use any private IP range. This guide uses dns-network with the gateway at .1, Unbound at .2 and Pi-hole at .3.

Create the network:

sudo podman network create \
  --subnet 10.80.0.0/24 \
  --gateway 10.80.0.1 \
  dns-network

Check the network:
Terminal window
```
sudo podman network inspect dns-network
```
The output shows all network information for the bridge.

Create the Unbound container

Create the Unbound configuration folder:

sudo mkdir -p /etc/unbound
mkdir -p ~/.local/bin/unbound

Go into the new unbound folder and create an empty file called unbound.conf. Paste the configuration below into it, then save and close the file.

The configuration logs DNS requests by default, so you can check that it works. To turn logging off, set log-queries and log-replies to no.

server:
    # ----- Logging -----
    # If no logfile is specified, syslog is used
    logfile: "/var/log/unbound/unbound.log"
    log-time-ascii: yes

    # General logging level
    # 0 = Only log critical errors.
    # 1 = Normal operating level. It gives useful startup/error information without filling the log.
    # 2 = Is useful when troubleshooting DNSSEC. You may see validation failures.
    verbosity: 2

    # DNSSEC validation logging
    val-log-level: 2

    # Disabled query logs to save disk I/O
    log-queries: yes
    log-replies: yes
    log-tag-queryreply: no

    # Use syslog instead of logfile (disable to use log file)
    use-syslog: no

    # ----- Networking & Interfaces -----
    # Interfaces Unbound will listen on
    ### CHANGE THIS: Match your server's specific local or VPN IP addresses
    #interface: 0.0.0.0
    interface: 10.80.0.2
    # Use this port so it does not clash with the network bridge which uses port 53
    port: 5335

    # Enable IPv4 and disable IPv6 processing
    do-ip4: yes
    do-udp: yes
    do-tcp: yes
    do-ip6: no

    # ----- Access Control -----
    # Only allow DNS queries from these networks
    ### CHANGE THIS: Adjust these ranges to match your own local or VPN subnets
    #access-control: 127.0.0.1 allow
    access-control: 127.0.0.0/8 allow
    #access-control: 127.0.0.0/24 allow
    access-control: 10.80.0.0/24 allow
    access-control: 0.0.0.0/0 refuse

    # Ensure privacy of local IP ranges
    private-address: 192.168.0.0/16
    private-address: 169.254.0.0/16
    private-address: 172.16.0.0/12
    private-address: 10.0.0.0/8
    private-address: fd00::/8
    private-address: fe80::/10

    # Ensure no reverse queries to non-public IP ranges (RFC6303 4.2)
    private-address: 192.0.2.0/24
    private-address: 198.51.100.0/24
    private-address: 203.0.113.0/24
    private-address: 255.255.255.255/32
    private-address: 2001:db8::/32

    # Path to the root hints file for recursive lookups
    #root-hints: "/usr/share/dns/root.hints"

    # ----- Privacy & Security Settings / Hardening -----
    # Hide server identity/version and prevent DNS spoofing
    hide-identity: yes
    hide-version: yes
    harden-glue: yes
    harden-dnssec-stripped: yes
    harden-below-nxdomain: yes
    harden-algo-downgrade: yes
    use-caps-for-id: yes

    # Keep compatibility with imperfect DNS servers
    qname-minimisation-strict: no

    # Validate: Adding the root key means DNSSEC validation is now active (Prevent bogus DNS).
    auto-trust-anchor-file: "/etc/unbound/root.key"

    # Aggressive NSEC uses cached NSEC records to synthesize NXDOMAIN
    aggressive-nsec: yes

    # Privacy: Send only minimum required domain part to upstream servers
    qname-minimisation: yes

    # ----- Cache Allocation -----
    # Memory allocated for messages and resource records (RRsets)
    ### NOTE: This profile requires min. 2GB RAM. Reduce values by half for 1GB or even more for smaller systems
    msg-cache-size: 128m
    rrset-cache-size: 256m

    # Minimum and maximum time (in seconds) to keep entries in cache
    cache-min-ttl: 300
    cache-max-ttl: 86400

    # Reduce EDNS reassembly buffer size.
    # IP fragmentation is unreliable on the Internet today, and can cause
    # transmission failures when large DNS messages are sent via UDP. Even
    # when fragmentation does work, it may not be secure, it is theoretically
    # possible to spoof parts of a fragmented DNS message, without easy
    # detection at the receiving end. Recently, there was an excellent study
    # >>> Defragmenting DNS - Determining the optimal maximum UDP response size for DNS <<<
    # by Axel Koolhaas, and Tjeerd Slokker (https://indico.dns-oarc.net/event/36/contributions/776/)
    # in collaboration with NLnet Labs explored DNS using real world data from the
    # the RIPE Atlas probes and the researchers suggested different values for
    # IPv4 and IPv6 and in different scenarios. They advise that servers should
    # be configured to limit DNS messages sent over UDP to a size that will not
    # trigger fragmentation on typical network links. DNS servers can switch
    # from UDP to TCP when a DNS response is too big to fit in this limited
    # buffer size. This value has also been suggested in DNS Flag Day 2020.
    edns-buffer-size: 1232

    # ----- Performance Tuning -----
    # Number of CPU threads
    ### CHANGE THIS: Must match your exact CPU core count (e.g., 1, 2, 4, 8)
    num-threads: 1

    # Core caching structures
    ### CHANGE THIS: All slabs MUST exactly match the 'num-threads' value above
    msg-cache-slabs: 1
    rrset-cache-slabs: 1
    infra-cache-slabs: 1
    key-cache-slabs: 1

    # Number of external nameservers to remember latencies for
    infra-cache-numhosts: 50000

    # Network socket buffers and concurrent query limits per thread
    num-queries-per-thread: 1024
    outgoing-range: 4096

    so-rcvbuf: 4m
    so-sndbuf: 4m

    # Speed & Lateness Optimization
    # Automatically refresh popular domains before they expire
    prefetch: yes
    prefetch-key: yes

    # Serve expired cache entries instantly while refreshing them in background
    serve-expired: yes
    serve-expired-ttl: 86400 # Allow expired data up to 24 hours old
    serve-expired-reply-ttl: 30 # Tell client to re-check in 30 seconds

    # Timeout for slow recursive queries
    jostle-timeout: 200

remote-control:
    # ----- Enable remote administration via unbound-control tool -----
    #control-enable: yes
    #control-interface: 127.0.0.1
    #server-key-file: "/etc/unbound/unbound_server.key"
    #server-cert-file: "/etc/unbound/unbound_server.pem"
    #control-key-file: "/etc/unbound/unbound_control.key"
    #control-cert-file: "/etc/unbound/unbound_control.pem"
# ----- -----

Create the log folder and set its owner and permissions. Replace YOUR_USER_NAME with your login name.
Terminal window
```
sudo mkdir -p /var/log/unbound
sudo chown YOUR_USER_NAME:YOUR_USER_NAME /var/log/unbound
sudo chmod 777 /var/log/unbound
```
Unbound creates the log file itself.

Pull the Unbound image:

sudo podman pull docker.io/alpinelinux/unbound:latest

Create the container with a fixed IP on dns-network. Replace YOUR_USER_NAME in the mount path with your login name.

sudo podman run -d --name unbound-container \
  --network dns-network \
  --ip 10.80.0.2 \
  -v /home/YOUR_USER_NAME/.local/bin/unbound/unbound.conf:/etc/unbound/unbound.conf:ro \
  -v /var/log/unbound:/var/log/unbound \
  -e TZ=Pacific/Auckland \
  --restart=always \
  docker.io/alpinelinux/unbound:latest

Do not give any container the IP ending in .1. That address belongs to the Podman gateway.

Check the container IP address:
Terminal window
```
sudo podman inspect unbound-container | grep -i ipaddress
```
The output should include "IPAddress": "10.80.0.2".
Check that Unbound started cleanly:
Terminal window
```
sudo podman logs unbound-container
```
Also check /var/log/unbound/unbound.log. It should show start of service (unbound 1.25.1).

Create the Pi-hole container

Pull the Pi-hole image:

sudo podman pull docker.io/pihole/pihole:latest

Find the IP address of the host:
Terminal window
```
ip -4 -br a
```

Create the container. Replace YOUR_MACHINES_IP_ADDRESS with the host address from the previous step, and YOUR_PASSWORD with a web admin password.

sudo podman run -d --name pihole-container \
  --network dns-network \
  --ip 10.80.0.3 \
  -v pihole_data:/etc/pihole \
  -v dnsmasq_data:/etc/dnsmasq.d \
  -p YOUR_MACHINES_IP_ADDRESS:53:53/udp \
  -p YOUR_MACHINES_IP_ADDRESS:53:53/tcp \
  -p YOUR_MACHINES_IP_ADDRESS:80:80/tcp \
  -p YOUR_MACHINES_IP_ADDRESS:443:443/tcp \
  -e TZ=Pacific/Auckland \
  -e FTLCONF_webserver_api_password=YOUR_PASSWORD \
  --restart=always \
  pihole/pihole:latest

List the containers:
Terminal window
```
sudo podman ps -a
```

Pi-hole and network configuration

Open the admin page in a browser and log in. Replace HOST_IP_ADDRESS with the host address.

http://HOST_IP_ADDRESS/admin/login

This guide does not cover SSH access to the host.
Go to Settings, then DNS. Untick both checkboxes in the IPv4 section.
In Custom DNS servers, enter the Unbound address with its port, 10.80.0.2#5335. Add any secondary servers below it in the same IP_ADDRESS#PORT format.
Click Save & Apply.
Set the listening mode. Pi-hole v6 disables the default listening mode for security reasons.
1. Go to Settings, then All Settings.
2. In the DNS tab, scroll to dns.listeningMode on the right. It is most likely set to Local (default).
3. Select Single.
4. Click Save & Apply.
The All option works with multiple network interfaces. Use it only when you need it, or to test a problem.
Set the IPv4 DNS of the host to its own LAN address, HOST_IP_ADDRESS, where Pi-hole publishes port 53. Do not use 10.80.0.2, which is Unbound on port 5335. Do not add a secondary DNS server, so the host uses itself as DNS server.
- Tick IPv4 is required for this connection.
- Disable IPv6 for security reasons.
- Click Apply.
- Disable the network connection, wait about 5 seconds, then enable it again.
Test that Pi-hole serves pages. If a site is blocked, the dashboard shows a block page. To check whether Pi-hole causes the problem, click Disable blocking in the dashboard, load the page again, then re-enable blocking.

Optional: add clients

On the bottom left of the dashboard, select Clients.
In the Known Clients field, enter the IP address of the host running Pi-hole, or 127.0.0.1. Select the drop-down below it that shows your IP address.
Optionally add a description on the right.
Click Add to add the client to the Default group.

If you return to the dashboard after a while, the client shows in the bottom left. Click it to see its logs. If requests were blocked, the client view lists the blocked domains at the bottom right.

Point your devices at Pi-hole

On each device, set the DNS address to the Pi-hole host address. You can add 1.1.1.1 as a secondary DNS address in case the host is unavailable, for example during an update.

You can set the DNS server in your router’s LAN settings instead. Then devices that use the router as DNS server use Pi-hole automatically.

Test Unbound with Pi-hole

Check the upstream configured in Pi-hole. The output should show [10.80.0.2#5335].
Terminal window
```
sudo podman exec -it pihole-container pihole-FTL --config dns.upstreams
```
Query a domain through Unbound. The output must contain status: NOERROR.
Terminal window
```
sudo podman exec -it pihole-container dig @10.80.0.2 -p 5335 cloudflare.com
```
Query a domain that fails DNSSEC validation. The output must show status: SERVFAIL and no answer.
Terminal window
```
sudo podman exec -it pihole-container dig @10.80.0.2 -p 5335 dnssec-failed.org
```
From another device that uses the host as DNS server, query a domain through Pi-hole. Replace HOST_IP_ADDRESS with the host address.
Terminal window
```
dig @HOST_IP_ADDRESS google.com
```
The output should show status: NOERROR and an answer section.

The flags in the answer mean:

Flag	Meaning
`qr`	Response received
`rd`	Recursion desired
`ra`	Recursion available
`ad`	DNSSEC authenticated data, so the answer uses secure DNS

Create a logrotate file

The Unbound log grows over time. This script creates a logrotate rule. When the log reaches 1 MB, logrotate compresses it, renames it and clears the original, and keeps 5 rotated copies.

Create a file called logrotate.sh and paste the script below into it. Make it executable, then run it.

#! /bin/bash

cat <<EOF | sudo tee "/etc/logrotate.d/unbound-schedule" > /dev/null
/var/log/unbound/unbound.log {
    size 1M
    rotate 5
    compress
    missingok
    notifempty
    # copytruncate (Tell Unbound to reopen logs after rotation with a signal/reload.)
    copytruncate
    su root root
    postrotate
        # systemctl reload unbound
    endscript
}
EOF

Test the rule with a dry run, then force a rotation:

sudo logrotate -d /etc/logrotate.d/unbound-schedule
sudo logrotate -f /etc/logrotate.d/unbound-schedule

Check the result. You should see a compressed file called unbound.log.1.gz.
Terminal window
```
ls -lah /var/log/unbound/
```

Update Pi-hole

A container image is not updated from inside the container. Pull the latest image and recreate the container instead. Save the create command in a safe place, but without your password in it.

Stop the container:
Terminal window
```
sudo podman stop pihole-container
```
Remove the container:
Terminal window
```
sudo podman rm pihole-container
```
Pull the latest image and create the container again with the same command. You do not need to recreate the network.
Terminal window
```
sudo podman pull docker.io/pihole/pihole:latest
```

Your Pi-hole settings are kept. Back them up before an update with the Teleporter option in the Settings section of the dashboard.

Update gravity

Gravity downloads and updates the block lists. Recent Pi-hole versions update it automatically. Run it manually after you add or remove block list links.

In the dashboard, select Update Gravity in the left panel.

Or run it from the command line. This suits automation.

sudo podman exec -it pihole-container pihole -g
sudo podman exec -it pihole-container pihole updateGravity

Example output of a gravity run:

[✓] DNS resolution is available
[✓] Preparing new gravity database
[✓] Creating new gravity databases
[✓] Pulling blocklist source list into range
[i] Target: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
[✓] Status: Retrieval successful
[✓] Parsed 96767 exact domains and 0 ABP-style domains
[✓] Building gravity tree
[✓] Building antigravity tree
[✓] Optimizing database
[✓] Swapping databases
[✓] Done.

Block lists, allow lists and gravity database

This section comes from the guide on building a comprehensive gravity database. It assumes Pi-hole runs as described above.

How gravity works

Gravity downloads the subscribed block lists and merges them into the gravity.db SQLite database. Duplicate domains are removed automatically. Entries that are not domains, such as comments and formatting, are filtered out. The new database is built on the side and then swapped in, so the running database is never half-written.

Automatic updates: the original guide says gravity updates every Sunday between 03:00 and 05:00 local time. Not confirmed for Pi-hole v6.
Manual update: use the dashboard or the command in the previous section.
Multiple Pi-hole instances: Gravity Sync or Nebula Sync keep the gravity.db files and configuration identical across nodes.
Logging: a blocked domain logs gravity blocked in the dnsmasq log.

Add a block list

Log into Pi-hole. In the dashboard, open Lists in the left panel. This opens the Subscribed lists group management page.
Paste the list URL and assign it to a group. Click Apply to save.
To turn a list off, click the green Enabled button. It changes to Disabled.
To remove a list, click the orange trash icon. A green notification confirms the removal.

Recommended block lists

The original guide lists many block lists. Add the ones you need. The list below is the selection from the original guide. The guide notes that the list is long and personal, and that each URL can change or go offline.

General and miscellaneous

https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://raw.githubusercontent.com/hectorm/hmirror/master/data/easylist/list.txt
https://raw.githubusercontent.com/hectorm/hmirror/master/data/easyprivacy/list.txt
https://raw.githubusercontent.com/hectorm/hmirror/master/data/fademind-add.2o7net/list.txt
https://raw.githubusercontent.com/hectorm/hmirror/master/data/fademind-add.dead/list.txt
https://raw.githubusercontent.com/hectorm/hmirror/master/data/fademind-add.risk/list.txt
https://raw.githubusercontent.com/hectorm/hmirror/master/data/fademind-add.spam/list.txt
https://www.stopforumspam.com/downloads/toxic_domains_whole.txt
https://raw.githubusercontent.com/deathbybandaid/piholeparser/master/Subscribable-Lists/ParsedBlacklists/AakList.txt
https://raw.githubusercontent.com/deathbybandaid/piholeparser/master/Subscribable-Lists/ParsedBlacklists/Prebake-Obtrusive.txt
https://raw.githubusercontent.com/mitchellkrogza/The-Big-List-of-Hacked-Malware-Web-Sites/master/hacked-domains.list
https://v.firebog.net/hosts/static/w3kbl.txt
https://raw.githubusercontent.com/vokins/yhosts/master/hosts
https://paulgb.github.io/BarbBlock/blacklists/hosts-file.txt
https://v.firebog.net/hosts/Easyprivacy.txt
https://raw.githubusercontent.com/Perflyst/PiHoleBlocklist/master/SmartTV.txt
https://raw.githubusercontent.com/Perflyst/PiHoleBlocklist/master/AmazonFireTV.txt
https://osint.digitalside.it/Threat-Intel/lists/latestdomains.txt
https://bitbucket.org/ethanr/dns-blacklists/raw/8575c9f96e5b4a1308f2f12394abd86d0927a4a0/bad_lists/Mandiant_APT1_Report_Appendix_D.txt
https://raw.githubusercontent.com/Spam404/lists/master/main-blacklist.txt
https://raw.githubusercontent.com/anudeepND/blacklist/master/facebook.txt
https://blocklistproject.github.io/Lists/scam.txt
https://lists.zachlagden.uk/lists/suspicious.txt

Malware, spyware and ransomware

https://gitlab.com/quidsup/notrack-blocklists/raw/master/notrack-malware.txt
https://raw.githubusercontent.com/r-a-y/mobile-hosts/master/AdguardMobileSpyware.txt
https://s3.amazonaws.com/lists.disconnect.me/simple_malvertising.txt
https://v.firebog.net/hosts/Prigent-Malware.txt
https://raw.githubusercontent.com/AssoEchap/stalkerware-indicators/master/generated/hosts
https://malware-filter.gitlab.io/malware-filter/phishing-filter-hosts.txt
https://blocklistproject.github.io/Lists/malware.txt
https://blocklistproject.github.io/Lists/ransomware.txt
https://lists.zachlagden.uk/lists/malicious.txt

Phishing

https://raw.githubusercontent.com/hectorm/hmirror/master/data/eth-phishing-detect/list.txt
https://phishing.army/download/phishing_army_blocklist_extended.txt
https://raw.githubusercontent.com/HorusTeknoloji/TR-PhishingList/master/url-lists.txt
https://v.firebog.net/hosts/RPiList-Phishing.txt
https://blocklistproject.github.io/Lists/phishing.txt

Crypto mining

https://raw.githubusercontent.com/hectorm/hmirror/master/data/adblock-nocoin-list/list.txt
https://raw.githubusercontent.com/hectorm/hmirror/master/data/zerodot1-coinblockerlists-browser/list.txt
https://v.firebog.net/hosts/Prigent-Crypto.txt
https://blocklistproject.github.io/Lists/crypto.txt

Ads, banners, spam and tracking

https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt
https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt
https://raw.githubusercontent.com/hectorm/hmirror/master/data/adaway.org/list.txt
https://raw.githubusercontent.com/hectorm/hmirror/master/data/adguard-simplified/list.txt
https://raw.githubusercontent.com/hectorm/hmirror/master/data/anudeepnd-adservers/list.txt
https://raw.githubusercontent.com/hectorm/hmirror/master/data/kadhosts/list.txt
https://raw.githubusercontent.com/hectorm/hmirror/master/data/matomo.org-spammers/list.txt
https://raw.githubusercontent.com/hectorm/hmirror/master/data/pgl.yoyo.org/list.txt
https://raw.githubusercontent.com/hectorm/hmirror/master/data/someonewhocares.org/list.txt
https://raw.githubusercontent.com/hectorm/hmirror/master/data/spam404.com/list.txt
https://raw.githubusercontent.com/hectorm/hmirror/master/data/winhelp2002.mvps.org/list.txt
https://gitlab.com/quidsup/notrack-blocklists/raw/master/notrack-blocklist.txt
https://raw.githubusercontent.com/r-a-y/mobile-hosts/master/AdguardMobileAds.txt
https://raw.githubusercontent.com/jerryn70/GoodbyeAds/master/Hosts/GoodbyeAds.txt
https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/spy.txt
https://raw.githubusercontent.com/PolishFiltersTeam/KADhosts/master/KADhosts.txt
https://raw.githubusercontent.com/FadeMind/hosts.extras/master/add.Spam/hosts
https://raw.githubusercontent.com/matomo-org/referrer-spam-blacklist/master/spammers.txt
https://someonewhocares.org/hosts/zero/hosts
https://winhelp2002.mvps.org/hosts.txt
https://v.firebog.net/hosts/neohostsbasic.txt
https://raw.githubusercontent.com/RooneyMcNibNug/pihole-stuff/master/SNAFU.txt
https://v.firebog.net/hosts/AdguardDNS.txt
https://v.firebog.net/hosts/Admiral.txt
https://raw.githubusercontent.com/anudeepND/blacklist/master/adservers.txt
https://v.firebog.net/hosts/Easylist.txt
https://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&showintro=0&mimetype=plaintext
https://raw.githubusercontent.com/FadeMind/hosts.extras/master/UncheckyAds/hosts
https://v.firebog.net/hosts/Prigent-Ads.txt
https://hostfiles.frogeye.fr/firstparty-trackers-hosts.txt
https://raw.githubusercontent.com/Perflyst/PiHoleBlocklist/master/android-tracking.txt

Manual allow and block rules

Use the Domains page on the dashboard to add domains by hand.

Enter the domain in Domain to be added. For patterns, use the Regex filter tab. The regex tutorial is linked under Web links.
Optionally add a description in Comment.
Use Group Assignment to choose the groups the rule applies to.4. Tick Add domain as a wildcard to apply the rule to the domain and all its subdomains. For example, blocking example.com also blocks sub.example.com.
Click Add to denied domains or Add to allowed domains.

On the Subscribed lists group management page the same group settings apply. Its entries can be toggled with the green Enabled button.

Allow list for common sites

Some block lists are strict. The original guide sets some domains to Exact allow. An exact allow overrides any block list. The list is personal, so adjust it to your needs.

Garuda Linux, YouTube, social media and other services

Garuda Linux mirrors:

mirror.vtti.vt.edu
ftp.tsukuba.wide.ad.jp
chaotic.kittydragon.love
mirror.bouwhuis.network

YouTube:

s.youtube.com
i.ytimg.com
manifest.googlevideo.com

Facebook:

www.facebook.com
facebook.com
upload.facebook.com
external.fakl6-1.fna.fbcdn.net
video.xx.fbcdn.net
scontent.xx.fbcdn.net
static.xx.fbcdn.net
web-chat-e2ee.facebook.com
www.fbsbx.com
edge-chat.facebook.com
star.c10r.facebook.com
star-mini.c10r.facebook.com
external.fakl1-3.fna.fbcdn.net
gateway.facebook.com
rupload.facebook.com

Instagram:

www.instagram.com
instagram.com
scontent.cdninstagram.com
static.cdninstagram.com
instagram.fwlg2-1.fna.fbcdn.net
web-chat-e2ee.instagram.com
edge-chat.instagram.com

VPN services:

protonvpn.com
account.protonvpn.com
account-api.protonvpn.com
vpncdn.protonweb.com
vpn-api.proton.me
_https._tcp.repository.mullvad.net
repository.mullvad.net
cdn.mullvad.net
mullvad.net
ipv4.am.i.mullvad.net
bytzvpn.com
bridges.torproject.org

Weather widget, Spotify, SoundCloud and Brave:

gn-flagpoles.api.bbci.co.uk
mybbc-analytics.files.bbci.co.uk
open.spotify.com
dwt.soundcloud.com
invite.soundcloud.com
tor.bravesoftware.com
usage-ping.brave.com
variations.brave.com
star-randsrv.bsg.brave.com
collector.bsg.brave.com

Cloudflare and router security:

chrome.cloudflare-dns.com
one.one.one.one
cloudflare-dns.com
ipv6b.cloudflare-dns.com
rgom10-asus-en.url.trendmicro.com
ntd-asus-2014b-en.fbs20.trendmicro.com
ntd-asus-2014b-en-cfg.fbs20.trendmicro.com

AI, miscellaneous and other services:

cdn.shortpixel.ai
count.perplexity.ai
js.sentry-cdn.com
heartbeat.dm.origin.com
consumer.entitlement.skype.com
improving.duckduckgo.com
platform-api.sharethis.com
use.typekit.net
telemetry.kde.org
cdn.optimizely.com
trackers.uglyemail.com
www.ipvanish.com
archive.org
athena.archive.org
whitepages.co.com
firebaseinstallations.googleapis.com
s3.amazonaws.com
filebin.net
ipinfo.io
mirrors.sytes.net
litter.catbox.moe
aae-sgweb001-1.asuscomm.com
fscdn.eppo.cloud
content-autofill.googleapis.com

After you change the allow list, reload the lists:

sudo podman exec -it pihole-container pihole reloadlists

Reset the Pi-hole admin password

This guide sets the password with FTLCONF_webserver_api_password in the container command. A setting from an environment variable is locked, so pihole setpassword cannot change it. To change the password, stop and remove the container, then create it again with a new value for FTLCONF_webserver_api_password. Your settings are kept in the pihole_data volume.

Without the variable, set the password inside the container:

sudo podman exec -it pihole-container pihole setpassword YOUR_PASSWORD

The v5 command pihole -a -p is replaced by pihole setpassword in v6.

Troubleshooting

Show the container log:

sudo podman logs pihole-container

Warning about non-local network queries

If the host loses internet access and the log shows this warning, the host address is outside the listening scope of Pi-hole:

WARNING: dnsmasq: ignoring query from non-local network 192.168.1.7 (logged only once)

Pi-hole’s documentation covers this warning in the dnsmasq warnings page. The fix is to set the listening mode:

Go to Settings, then All Settings.
In the DNS tab, find dns.listeningMode on the right.
Select Single.
Click Save & Apply.

Diagnostics error for an offline block list

If the Pi-hole diagnostics report a block list that could not be downloaded, the list was probably offline during the last gravity run. Gravity keeps the last good copy and updates the list when it is back online.

Web links

Sources: