Pi-hole DNS Filtering
A self-hosted DNS filtering environment using Pi-hole and a local Unbound recursive resolver inside a dedicated Linux container on Proxmox.
Project Goal
The goal of this environment is to provide centralized DNS filtering and local recursive name resolution for the home lab and internal network while maintaining visibility into DNS behavior and troubleshooting name-resolution problems from a single service.
Pi-hole handles client DNS requests and filtering, while Unbound provides the local recursive resolver used by Pi-hole instead of forwarding queries directly to a third-party public DNS provider.
Public documentation intentionally excludes internal IP addresses, exact listener ports, client identifiers, query history, blocklist details, and administrative access information.
Environment Summary
Pi-hole Platform
Pi-hole FTL 6.6.2 runs inside a dedicated Ubuntu 25.10 LXC container hosted on Proxmox VE.
Recursive DNS
Unbound 1.22.0 runs locally as the recursive resolver used by Pi-hole for upstream name resolution.
Service State
Both Pi-hole FTL and Unbound are currently active and enabled as system services.
Resolver Design
Pi-hole is configured to send upstream queries only to the local Unbound resolver rather than directly to public DNS resolvers.
Configuration Validation
Unbound configuration validation completes without errors, and live DNS queries through Pi-hole resolve successfully.
Architecture
Technologies Used
What I Built
- Deployed a dedicated Ubuntu LXC container for DNS filtering and recursive name resolution.
- Installed and maintain Pi-hole FTL as the primary DNS filtering service for internal clients.
- Installed and configured Unbound as a local recursive resolver.
- Configured Pi-hole to use only the local Unbound resolver for upstream DNS resolution.
- Configured both Pi-hole FTL and Unbound to run as enabled system services.
- Validated Unbound configuration with its native configuration-checking tools.
- Tested end-to-end DNS resolution through Pi-hole to confirm the resolver path is operational.
- Use Pi-hole visibility to support DNS troubleshooting and review name-resolution behavior across the network.
Security and Privacy Considerations
- Internal addresses, client identifiers, DNS query history, blocklists, and administrative access details are not published.
- Unbound is configured as a local resolver used by Pi-hole rather than being documented as a publicly exposed recursive DNS service.
- Pi-hole and Unbound run together inside a dedicated workload separated from unrelated application services.
- Public documentation describes the DNS architecture and operational role without exposing internal network topology or client activity.
- The project page itself retains both HTML and HTTP-header noindex protection.
Operational Value
Centralizing DNS filtering and recursive resolution provides one place to troubleshoot name-resolution issues, review DNS behavior, and manage filtering policy for the internal environment.
Using a local Unbound resolver also separates filtering from recursive resolution: Pi-hole handles client-facing DNS policy while Unbound handles the recursive lookup process.
The environment provides practical experience troubleshooting DNS across multiple layers, including client requests, filtering behavior, resolver configuration, service state, and upstream resolution.
What This Demonstrates
This project demonstrates DNS administration, Pi-hole management, local recursive DNS with Unbound, Linux service management, DNS configuration validation, network troubleshooting, resolver architecture, filtering policy, and operational visibility.
Project Status
Active and operational. Pi-hole FTL 6.6.2 and Unbound 1.22.0 are currently running and enabled. Pi-hole is configured to use the local Unbound resolver for upstream DNS resolution, and live DNS queries through the service resolve successfully.