🛡️ Network & identity defence
Pi-hole
Network-wide DNS sinkhole that blocks ads, trackers, and known malware domains.
Why use it
Pi-hole turns any small Linux box (Raspberry Pi, mini PC, container) into a recursive DNS resolver that drops queries to ad networks, trackers, and known malicious domains. Network-wide protection with one device, plus visibility into what every device on your home network is asking for.
What you get
- DNS-level blocking using community blocklists
- Per-device query logs and statistics
- Group-based filtering (kids vs adults)
- Conditional forwarding and DHCP optional
- Built-in unbound for full recursion (privacy)
System requirements
| Cpu | minimal |
|---|---|
| Ram | 512 MB |
| Disk | 5 GB |
| Os | Linux (any), Raspberry Pi |
| Docker | Yes |
Installation
Easiest is the official installer: curl -sSL https://install.pi-hole.net | bash. Docker: docker run -d --name pihole -p 53:53/tcp -p 53:53/udp -p 80:80 pihole/pihole. Point your router's DNS at the Pi-hole IP.
Suggested configuration
Add the Cybercrime, malware, and phishing blocklists from firebog.net. Enable conditional forwarding for your local domain. Pair with unbound as upstream resolver for true privacy. Whitelist any false positives via the GUI rather than disabling lists.
Integration ideas
- Forward query logs to your SIEM as DNS telemetry
- Combine with CrowdSec for IP-level blocking on the same gateway
- Pull MISP IoCs into Pi-hole as a blocklist
Alternatives
- AdGuard Home — Similar concept; smoother UI; fewer features.
- Technitium DNS — More powerful DNS server with built-in blocking.
Cyentrix verdict
The single highest-ROI install for any homelab. 30 minutes of work, network-wide protection forever.