Your ad blocker can take down your whole house's internet. Not hackers. Not your ISP. A $35 box you set up last weekend.

Pi-hole is a free tool that blocks ads and trackers for every device on your Wi-Fi, including phones, TVs, and game consoles. It works by answering your network's "where is this website?" questions, known as DNS lookups. It is a great first self-hosting project. These five mistakes are why many beginners give up on it.

1. Making Pi-hole the Only Door Out

If Pi-hole is your only DNS server and the Raspberry Pi reboots, nothing loads. Your partner blames the Wi-Fi. You get the call.

Fix: Run a second Pi-hole on another device, such as an old laptop or a small virtual machine. List both in your router. Tools like Gravity Sync or Nebula Sync keep their blocklists matched.

2. Letting the Pi's Address Wander

Your router hands out addresses that can change. If the Pi's address changes, every device keeps asking the old one and gets no answer.

Fix: Open your router's DHCP settings and reserve a fixed address for the Pi. It takes about two minutes.

3. Forgetting IPv6 Exists

You set up Pi-hole on IPv4, the familiar address format. Many routers also hand out IPv6 DNS servers, often your ISP's. Devices use those instead, and ads slip through.

Fix: Either turn on IPv6 in Pi-hole and give your router its IPv6 address, or switch off IPv6 DNS advertising on the router. Then check the Query Log. If a phone never shows up there, it is going around Pi-hole.

4. Ignoring Devices That Hardcode Google DNS

Some smart TVs and streaming sticks skip your settings and call 8.8.8.8 directly. Your blocklist never sees that traffic.

Fix: If your router supports it, add a firewall rule that redirects all port 53 traffic to the Pi-hole. On basic routers, block outbound port 53 for everything except the Pi. The stubborn device usually falls back to your network's DNS.

5. Stacking Every Blocklist You Find

More lists do not give you more privacy. They break things: banking logins, package tracking links, and the shopping app your family uses. People then switch Pi-hole off completely and forget to turn it back on.

Fix: Start with the default list and add one or two well-maintained ones. When something breaks, find the blocked domain in the Query Log and allow it. Don't disable the whole thing.

Bonus: Never Open It to the Internet

Forwarding port 53 so Pi-hole works away from home turns it into an open resolver. Attackers can use it to flood other people with traffic. Use a VPN to reach it instead.

Do This Today

Log in to your router and reserve a fixed IP address for your Pi-hole. That one change prevents the most common way Pi-hole breaks a home network.