Pi-hole and Browser Extensions: 3 Practical Choices for Ad Blocking

Every time I clicked the "save" button in a client project's admin panel, I noticed a pop-up ad suddenly appearing in the bottom right corner of the page, distracting my focus. This wasn't just a momentary distraction; it significantly impacted my productivity in the long run. Moments like these highlight how negatively ads affect our internet experience, especially how annoying they can be during sensitive workflows.

In this article, based on my own experiences, I will discuss three practical solutions I use and find effective for ad blocking: Pi-hole for my home network, uBlock Origin for browser-based blocking, and how these mechanisms interact with DNS Over HTTPS (DoH). I will explain the advantages, disadvantages, and suitability of each solution for different scenarios, based on my observations.

Why is Ad Blocking Important, and What Was My Approach?

Ad blocking doesn't just eliminate distracting visuals; it also offers significant benefits such as protecting our privacy, creating a defense layer against malware, and improving network performance. For me, the importance of this topic stems from the need to work without interruption, especially during system administration and software development processes that require continuous focus.

Ads often collect our personal data through third-party trackers, and this data is then used for targeted advertising. This creates both privacy concerns and unnecessarily consumes network resources. Over the years, I've tried different approaches and eventually arrived at a set of solutions that work integrally, both network-wide and device-specific. These solutions not only block ads but also minimize potential security threats.

ℹ️ What is a Tracker?

Trackers are pieces of software used by websites and applications to collect user behavior, preferences, and demographic information. This data is typically used for ad targeting, market research, and analytics purposes. Solutions like Pi-hole block the domain names of these trackers, stopping data collection attempts.

What is Pi-hole and Why Did It Become My Primary Choice?

Pi-hole is a network-level ad and tracker blocker that essentially functions as a DNS server. It listens to DNS queries from any device on the network, blocks queries to known ad and tracker domains based on its blacklist, and only forwards clean queries to the upstream DNS server. During my search for a centralized ad blocking solution for my home network, Pi-hole's flexibility and broad scope attracted me.

When I set up Pi-hole, seeing every device in my home (smart TVs, mobile devices, computers) automatically become ad-free saved me the hassle of installing individual browser extensions. Its ability to block in-app ads, especially on smart TVs, was an area browser extensions couldn't reach, and this was a huge plus for me. Pi-hole allowed me to manage all DNS traffic for all devices on the network from a single point, increasing my overall network security and control.

How to Install and Basic Configure Pi-hole?

Installing Pi-hole is usually quite simple, typically on a Raspberry Pi or any Linux-based virtual machine. I run it in a Docker container on my home server. The installation script automatically handles all dependencies and completes the basic configuration with a few questions.

Essentially, after installing Pi-hole, you need to configure your network's DHCP server (usually your modem/router) to distribute Pi-hole's IP address as the DNS server. This way, all devices on the network will automatically send their DNS queries to Pi-hole.

# Pi-hole installation script (usually a one-liner)
curl -sSL https://install.pi-hole.net | bash

# Or an example installation with Docker Compose
version: "3"

# For more information, see https://github.com/pi-hole/docker-pi-hole/blob/master/README.md
services:
  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "80:80/tcp"
    environment:
      TZ: 'Europe/Istanbul'
      WEBPASSWORD: 'your_admin_password' # Admin panel password
    volumes:
      - './etc-pihole/:/etc/pihole/'
      - './etc-dnsmasq.d/:/etc/dnsmasq.d/'
    cap_add:
      - NET_ADMIN # Required
    restart: unless-stopped

The Docker Compose example above is similar to the configuration I use on my own server. It's critical to replace the WEBPASSWORD variable with your own secure password. After installation, you can manage Pi-hole from its web interface (usually http://<pihole_ip>/admin), view blocked queries, and update your black/whitelists.

What are Pi-hole's Advantages and Its Value to Me?

Pi-hole's biggest advantage is providing centralized ad blocking for every device on the network. This means ads are blocked even on devices where browser extensions cannot be installed (smart TVs, game consoles, IoT devices). Furthermore, since ads are blocked at the DNS query stage, ad content is prevented from being downloaded to your device, saving bandwidth and potentially speeding up page load times.

For me, Pi-hole's value lies especially in making internet use safer for young children at home. Automatically filtering unwanted content and potentially harmful ads provides an extra layer of parental control. Additionally, being able to monitor DNS traffic across the network through Pi-hole's admin panel is very useful for understanding which devices are querying which domains and for detecting potential security issues.

What Challenges Did I Encounter While Using Pi-hole?

While Pi-hole is a fantastic solution, it's not without its challenges. One of the most frequent problems I encountered was some websites not working correctly due to ad blocking. This can happen particularly with banking applications or certain media sites. The solution is to add the relevant domain names to Pi-hole's whitelist. This can require some manual intervention and trial and error.

Another challenge is that, because Pi-hole itself is a DNS server, some applications or devices might bypass Pi-hole by using hardcoded DNS servers. Especially some Android applications can bypass Pi-hole's blocking capability by using their own custom DNS servers. In such cases, more advanced network configurations, such as forcing DNS traffic to Pi-hole on the router (DNS hijacking), might be necessary. Once, I noticed an IoT device sending telemetry data to ad servers, but Pi-hole couldn't block it because the device was connecting directly to Google DNS servers. In that situation, I had to adjust the router's firewall rules to redirect all DNS queries to Pi-hole.

Browser-Based Ad Blockers: UBlock Origin and Similar Tools

While Pi-hole does a great job at the network level, browser-based ad blockers also have their niche and complement where Pi-hole falls short. I've been using uBlock Origin for many years and find its balance between performance and blocking capability to be very successful. Such extensions work within the browser, analyzing web page content and blocking ads, trackers, or other unwanted elements directly at the DOM (Document Object Model) level.

Browser extensions are vital in scenarios where Pi-hole's scope is exceeded, especially when using a VPN or connecting to the internet outside your home network (e.g., in a cafe or at work). These extensions can also block certain visual ads that Pi-hole cannot block at the DNS level, particularly elements served from the same domain but carrying ad content.

How Do Browser Extensions Work and How Do They Differ from Pi-hole?

Browser extensions operate on a different layer than Pi-hole. While Pi-hole blocks traffic destinations as a DNS server, extensions like uBlock Origin intervene after web content reaches the browser. Extensions use constantly updated filter lists to detect ad URLs, CSS selectors, and JavaScript code as the page loads. These detected elements are then prevented from rendering or are hidden from the page.

This difference leads to important consequences:

• Pi-hole: Blocks the DNS query going to the ad server, so the ad content is never downloaded to the device. This saves bandwidth and processing power.
• Browser Extensions: Ad content might be downloaded from the server to the device, but the extension prevents this content from being displayed in the browser. This might consume slightly more resources than Pi-hole but offers more detailed visual blocking capabilities.

These two mechanisms complement each other. Pi-hole provides "broad and deep" blocking, while browser extensions perform "narrow and specific" blocking.

Why Do I Consider UBlock Origin an Important Complement?

I find uBlock Origin extremely valuable because, when used with Pi-hole, it provides an almost flawless ad blocking experience. UBlock Origin easily handles certain types of ads that Pi-hole misses or cannot block at the DNS level (e.g., ads coming via a CDN or using the same domain as the main content). Its power is particularly evident with dynamic and constantly changing ad formats like YouTube ads.

Furthermore, uBlock Origin's element blocking feature allows me to hide a specific element on a web page, even if it's not an ad. Once, on a news site, there was a sticky, distracting "most popular news" widget in the middle of the article I was reading. Thanks to uBlock Origin's feature, I was able to hide that widget with a single click and optimize the page layout for my reading experience. This provides much more control over the user experience than Pi-hole.

What are the Limitations and Overhead of Browser Extensions?

The most obvious limitation of browser extensions is that they only work in the browser and on the device where they are installed. Other devices on your home network or different browsers cannot benefit from this protection. Also, an extension running in the browser means it consumes some of the browser's memory and CPU resources. While uBlock Origin is highly optimized in this regard, some heavier extensions can noticeably affect performance.

Another issue is that, because browser extensions directly interfere with website code, they can sometimes cause sites to malfunction. Especially on sites using complex JavaScript, an ad blocker extension blocking a script can break the site's core functionality. In these cases, it might be necessary to disable the extension for the relevant site or whitelist it, which again requires manual intervention.

Interaction of Ad Blocking Mechanisms with DNS Over HTTPS (DoH) and DNS Over TLS (DoT)

Traditional DNS queries are unencrypted, meaning malicious actors or network administrators can monitor and manipulate your queries. DNS Over HTTPS (DoH) and DNS Over TLS (DoT) technologies encrypt DNS traffic to solve these privacy and security issues. However, these technologies can create complexity in terms of interaction with network-level DNS-based ad blockers like Pi-hole.

Many modern browsers (like Chrome, Firefox) and operating systems (Windows, macOS, Android) now offer DoH/DoT support and may start using these protocols by default. This situation carries the risk of your devices bypassing Pi-hole and connecting directly to external DoH/DoT providers (like Cloudflare, Google) if you use Pi-hole as the sole DNS server on your network. This bypasses Pi-hole's ad blocking capabilities.

How DoH/DoT Affects Ad Blocking Strategies?

While DoH and DoT increase privacy by encrypting DNS queries, they pose a challenge for local DNS-based blocking solutions like Pi-hole. If your devices start using Cloudflare's 1.1.1.1 DoH service instead of Pi-hole, Pi-hole's ad lists become ineffective.

There are a few approaches to solve this:

1. Blocking DoH/DoT traffic: In your router's firewall, block HTTPS (port 443) and TLS (port 853) traffic going to the IP addresses of known DoH/DoT servers. This forces devices to use Pi-hole. However, this method can be difficult to sustain as it requires tracking the IP addresses of all DoH/DoT servers.
2. Using a local DoH/DoT proxy: You can configure Pi-hole itself as a DoH/DoT server (e.g., using dnscrypt-proxy or unbound). This way, devices send encrypted DNS queries to Pi-hole, Pi-hole processes them, and forwards them encrypted to its designated upstream DoH/DoT servers. This combines both privacy and blocking. I use a similar setup in my own network, which allows both ad blocking and encrypted DNS queries.

What are the Security Aspects of Using My Own DNS Server?

Managing your own DNS server (like Pi-hole) provides greater control and security over your network. Centralized filtering of DNS queries allows for automatic blocking of known malware domains, phishing sites, and ad servers. This is a proactive security measure that helps stop potential threats before they reach your network.

However, this approach also has some security considerations:

• Single point of failure: If your Pi-hole server crashes or is not configured correctly, your entire network's internet access can be disrupted. Therefore, ensuring Pi-hole's high availability is important; I solved this with redundant DNS servers in a virtual machine.
• Update responsibility: Pi-hole and its blocking lists need to be updated regularly. Outdated lists can miss new ad and malicious domains.
• Upstream DNS selection: The choice of which upstream DNS server Pi-hole uses is important. If you value privacy, you should choose a reliable provider that doesn't log and offers DoH/DoT support. I generally prefer privacy-focused providers like Cloudflare or AdGuard DNS.

Which Solution to Use in Which Scenario: Decision Tree and Trade-offs

Choosing an ad blocking solution depends on your needs and technical knowledge. Each solution has its unique advantages and disadvantages. Therefore, it's more realistic to evaluate solutions suitable for different scenarios rather than a single "best" solution. In my experience, a hybrid approach usually yields the best results.

Here's a simple decision tree and trade-offs:

While this diagram shows a simple flow, each choice has its own sub-decisions and trade-offs.

When is Using Pi-hole Alone Sufficient?

Using Pi-hole alone can be sufficient, especially if you're looking for a centralized solution that covers all your devices and your home network. If your main priority is to block ad and tracker traffic at the DNS level across the network, Pi-hole is a strong starting point. For those like me who want to block ads on devices where browser extensions cannot be installed, such as smart TVs, IoT devices, and game consoles, Pi-hole is indispensable.

However, Pi-hole alone might miss some in-browser ads (especially those coming from the same domain or very dynamic ones). Also, if you want ad blocking on your mobile devices or laptops when you're outside your home network, Pi-hole doesn't offer a direct solution (unless you provide remote access via VPN). In these scenarios, additional solutions are needed.

How Effective Are Browser Extensions Without Pi-hole?

Browser extensions are quite effective even without Pi-hole and can meet most users' basic ad blocking needs. Powerful extensions like uBlock Origin successfully block the vast majority of ads in desktop and mobile browsers. If you only want to improve your internet experience on your own computer or phone and don't have the time or technical knowledge to set up a network-level solution, browser extensions are a practical and quick solution.

However, unlike Pi-hole, browser extensions do not protect other devices on your network, and since ad content is usually blocked after it reaches your browser, their benefits on bandwidth and performance might be more limited compared to Pi-hole. Also, you need to install and manage them separately for each browser, which can be tedious if you use multiple devices or browsers.

How to Implement a Hybrid Approach and Why is It Necessary?

For me, the most logical and effective solution is to use Pi-hole as a centralized network-level blocker and support it with uBlock Origin at the browser level. This hybrid approach combines the strengths of both solutions and compensates for their weaknesses.

The implementation steps are usually as follows:

1. Pi-hole setup: Set up a Pi-hole server on your home network and configure your DHCP server to use Pi-hole as the DNS. Don't forget to manage DoH/DoT traffic.
2. Browser extension: Install uBlock Origin on browsers (Chrome, Firefox, Edge, etc.) on all your computers. Use similar solutions on your mobile devices (e.g., Firefox + uBlock Origin for Android, or an app like AdGuard).
3. Optimization: Add the domain names that sites need to function correctly to Pi-hole's whitelist. Also, disable uBlock Origin on specific sites when necessary.

This combination allows me to block the vast majority of ads at the DNS level, while also cleaning up any ads or visually disturbing elements that escape in the browser with uBlock Origin. This way, I achieve comprehensive protection and can personalize my internet experience by making fine-tuned adjustments. Once, when working on a web interface of a production ERP, I encountered an ad script that prevented a critical form from loading. Finding the relevant domain in Pi-hole's logs and whitelisting it, then temporarily disabling uBlock Origin for that site in the browser, provided a quick and effective solution. Having both tools at my disposal in such situations is a huge advantage.

Future Ad Blocking Trends and My Predictions

The advertising industry is constantly evolving, which requires ad blocking technologies to adapt continuously. In the future, I predict that ad blocking methods will become even more sophisticated. Especially AI and machine learning-based ad detection algorithms could be used to identify more complex and dynamic ad formats.

Websites and advertising companies are constantly trying new ways to bypass ad blocking. This necessitates continuous updates to the filter lists of DNS-based solutions like Pi-hole and the algorithms of extensions like uBlock Origin. My prediction is that with the widespread adoption of encrypted DNS protocols like DoH/DoT, managing this traffic will become even more critical for network-level blocking solutions. Furthermore, browser manufacturers developing their own internal ad blocking features could also be a trend, but the scope and flexibility of these features will generally remain more limited than third-party extensions.

Finally, privacy-focused browsers and operating systems may come with stronger ad and tracker blocking capabilities by default. These developments will make it easier for users to achieve a safer and ad-free internet experience, while also requiring existing ad blocking solutions to adapt to these new environments.

Conclusion

The barrage of ads and trackers we face in the digital world is more than just distracting; it poses serious privacy and security risks. The solutions I've discussed in this article—Pi-hole, browser-based extensions (uBlock Origin), and their interactions with DoH/DoT—represent the practical and effective tools I use to combat these issues. While each has its unique strengths and weaknesses, in my experience, a hybrid approach provides the most comprehensive protection.

With Pi-hole, I create a network-wide DNS-level shield, and with uBlock Origin, I clean up any stray ads and unwanted elements within the browser. Understanding how evolving technologies like DoH/DoT interact with these blocking mechanisms and configuring them accordingly is also critically important. Remember, ad blocking is a dynamic process, and it's your responsibility to ensure the solutions you use remain up-to-date.

By using a combination of these solutions, I've made my own internet experience cleaner, faster, and more secure. You too can choose the combination that best suits your needs and technical knowledge to navigate the digital world more peacefully. In future articles, I will delve into more in-depth topics on network security and system administration.