A Pi-hole alternative that needs no hardware

A Pi-hole blocks ads for every device on your network, as long as the Raspberry Pi is running, updated and at home. Blokada Cloud does the same job from our servers:

• No box to maintain. No SD cards, no updates, no outage when the Pi goes down.
• It works away from home. Phones and laptops keep their blocking on mobile data and other Wi-Fi networks.
• Encrypted. Devices talk to Blokada over DNS over TLS or DNS over HTTPS, so your provider cannot read or change your lookups.
• One dashboard. Blocklists, allowed and blocked domains, and activity per device, at app.blokada.org.

There are two ways to switch. Replace the Pi-hole completely, or keep it and use Blokada Cloud as its upstream.

Option 1: replace the Pi-hole

1. Get Blokada Cloud and open the dashboard. Under Setup you find your personal addresses:
   • DNS over TLS: <your-id>.cloud.blokada.org
   • DNS over HTTPS: https://cloud.blokada.org/<your-id>
2. Point your router at Blokada instead of the Pi-hole. Follow the router guide. If your router only accepts a plain IP address as DNS server, set up your devices one by one instead: Android, iPhone, iPad, Mac and Apple TV, and browsers.
3. If your Pi-hole was the DHCP server, turn DHCP back on in your router before you switch the Pi off. Otherwise your devices stop getting network addresses.
4. Move your lists. In the dashboard, choose blocklists under Blocklists, and add your own allowed or blocked domains under My blocklists.
5. Switch the Pi-hole off, or keep it for something else.

Option 2: keep the Pi-hole, use Blokada Cloud upstream

If you want to keep your local setup, such as local host names, DHCP or your own lists, let the Pi-hole forward its lookups to Blokada over an encrypted connection. Pi-hole cannot do encrypted forwarding itself, so a small forwarder runs next to it. This guide uses dnsproxy, an open source forwarder that is a single file.

1. On the Pi-hole machine, download the dnsproxy release for your CPU (linux-arm64 for a recent Raspberry Pi) from its releases page, and copy the dnsproxy binary to /usr/local/bin/.
2. Create /etc/systemd/system/dnsproxy.service:

[Unit]
Description=Encrypted DNS forwarder to Blokada Cloud
Wants=network-online.target
After=network-online.target

[Service]
ExecStart=/usr/local/bin/dnsproxy -l 127.0.0.1 -p 5054 -u tls://<your-id>.cloud.blokada.org -b 9.9.9.9
Restart=always
DynamicUser=yes

[Install]
WantedBy=multi-user.target

3. Start it: sudo systemctl enable --now dnsproxy
4. In the Pi-hole admin, open Settings → DNS. Untick every upstream server and add 127.0.0.1#5054 as a custom upstream server. Save.
5. Check the dashboard Activity page. Lookups from your network now show up there.

You can turn off the Pi-hole's own blocklists and manage blocking in the dashboard, or keep both.

Frequently asked

Do I need Blokada Plus? No. Blokada Cloud covers DNS blocking for your whole home. Blokada Plus adds a VPN on top.

What if Blokada is unreachable? Your devices cannot resolve names until it is back, just as when a Pi-hole goes down. Don't add a second, unfiltered DNS server as fallback. Most devices use all their servers at random, so ads would get through.