Self-host Pi-hole on a VPS: network-wide ad blocking over WireGuard

Ad and tracker blocking at the DNS level is the single highest-leverage privacy win — it kills ads in apps, smart TVs and browsers alike. A home Pi-hole only covers your couch. Put it on a VPS behind WireGuard and every device gets filtered DNS everywhere — mobile data, hotel Wi-Fi, on the road. Set it up with Docker and pay for the server in crypto, no KYC.

What this needs

• A dedicated IPv4 for the WireGuard endpoint — clients connect to an inbound UDP port, which NAT plans don't provide. Nano-IP or Small-IP is plenty.
• WireGuard as the transport. Pi-hole answers DNS only on the tunnel interface; the public DNS port stays closed. This pairs directly with our WireGuard guide (linked below).
• Barely any RAM/CPU. Pi-hole is light even with many devices and large blocklists.

Set it up (Ubuntu 24.04, Docker)

First stand up WireGuard (see the guide below), then run Pi-hole bound to the tunnel IP:

# docker-compose.yml — Pi-hole. Bind DNS to the WireGuard interface, NEVER the public
# internet (an open DNS resolver gets abused for amplification attacks).
services:
  pihole:
    image: pihole/pihole:latest
    restart: unless-stopped
    environment:
      TZ: "UTC"
      FTLCONF_webserver_api_password: "change-me-strong"
    volumes:
      - "/srv/pihole/etc:/etc/pihole"
      - "/srv/pihole/dnsmasq.d:/etc/dnsmasq.d"
    ports:
      - "10.8.0.1:53:53/tcp"    # WireGuard IP only — not 0.0.0.0
      - "10.8.0.1:53:53/udp"
      - "127.0.0.1:8080:80"     # admin UI over localhost / SSH tunnel

Lock the firewall so DNS never faces the internet:

# Firewall: allow WireGuard (UDP 51820) in; keep DNS (53) OFF the public interface.
ufw allow 51820/udp
ufw deny 53
# Point each WireGuard client's DNS at 10.8.0.1 — Pi-hole now filters all their traffic.

Point each WireGuard peer's DNS at 10.8.0.1 and your whole device fleet is now ad-free, wherever it is.

Make it yours

• Blocklists you choose — curate what's filtered; add allowlists per domain.
• Per-client stats and query logs, visible in the admin UI (reach it over the tunnel or an SSH port-forward).
• DoH/DoT upstream for encrypted resolution beyond your server.
• Never expose port 53 publicly — the config above binds DNS to the WireGuard IP only.

Why EQVPS for Pi-hole + WireGuard

• Dedicated IPv4 from $8/mo, all ports (incl. UDP), self-service rDNS.
• EU locations (Germany, Finland) — clean routes, real data-protection law.
• No KYC, crypto payment. Email to register, USDC/USDT to pay — fitting for a privacy tool.
• Root in ~60 seconds, NVMe. Bring up WireGuard + Pi-hole and your devices are filtered anywhere.

Self-host WireGuard VPN first → · Anonymous VPS hosting explained →