How to pair Pi-hole with an OpenVPN to block ads and increase privacy on Ubuntu / Debian Linux

Author: Vivek Gite Last updated: April 24, 2020 14 comments

I followed your tutorial to install an OpenVPN on my Ubuntu server in the cloud. How can I install Pi-hole to block ads, reduced my 4G/3G/LTE traffic on the same Debian or Ubuntu Linux server?

Pi-hole is free and open source software to block ads and tracking domain. It is released under the GNU General Public License. The biggest advantage is ad blocking on all devices on the network from your smartphone to your tablets including all desktop computers. It even blocks in app ads on iOS and Android/Windows devices. The benefits are as follows:

Install OpenVPN

Type the following two commands:
$ wget https://git.io/vpn -O openvpn-install.sh $ sudo bash openvpn-install.sh
Just follow on screen instructions to install the OpenVPN server. See our step-by-step guide for more detailed information on setting up an OpenVPN server on Linux.

Installing Pi-hole on a Linux server

At this stage I am assuming that you have a working OpenVPN server. The client is also configured to OpenVPN on OSX/Windows/Linux/FreeBSD/iOS/Andriod devices.

Note down your OpenVPN server IP address

Type the following command:
$ ip a show dev tun0
Sample outputs:

Fig.01: Finding out your OpenVPN server IP address

Please note down 10.8.0.1/24 IP address. You also need to provide tun0 as an interface name including your default gateway IP address such as 192.168.2.254:

$ ip r | grep default

default via 192.168.2.254 dev br0 onlin

Our sample setup

Our sample setup/network

Pi-hole was designed for Raspberry PI hardware but works with Ubuntu and Debian based Linux distro. In this example, I am setting up on a Ubuntu 16.04 LTS server.

Install PI-HOLE

Run the install command as follows:
$ wget -O basic-install.sh https://install.pi-hole.net $ sudo bash basic-install.sh
You will see progress on screen as follows:

Fig.02: Pi-Hole installer in action

This installer will transform your device into a network-wide ad blocker. The Pi-hole is a SERVER so it needs a STATIC IP ADDRESS to function properly.

Choose an interface for Pi-hole

Fig.03: Select an interface of OpenVPN server such as tun0

Select protocols for dns server

Fig.04: You must at least select IPv4 for all dns queries

Setup a static IP address (select No)

Fig.05: You must set a static IP address and it must match to tun0/OpenVPNs static IP address

Next enter OpenVPN’s server IP address as follows:

Fig.06: Enter your tun0 interfaces IP address here

Finally enter your default router/gateway IP address:

Fig.07: Setup default router IP

Confirm the settings:

Fig.08: Are static IP settings correct? Yes.

Setup upstream DNS IP address

Fig.09: Select upstream DNS provider such as Google DNS

And you are done:

Fig.10: Installation complete

Test it

Type the following command on Pi-hole to see if DNS is working or not:
$ host cyberciti.biz 10.8.0.1
Sample outputs:

Using domain server:
Name: 10.8.0.1
Address: 10.8.0.1#53
Aliases: 

cyberciti.biz has address 75.126.153.202
cyberciti.biz mail is handled by 1 aspmx.l.google.com.
cyberciti.biz mail is handled by 10 aspmx2.googlemail.com.
cyberciti.biz mail is handled by 10 aspmx3.googlemail.com.
cyberciti.biz mail is handled by 5 alt1.aspmx.l.google.com.
cyberciti.biz mail is handled by 5 alt2.aspmx.l.google.com.

Now try to lookup ad server IP address:
$ host pagead2.googlesyndication.com 10.8.0.1
Sample outputs:

Using domain server:
Name: 10.8.0.1
Address: 10.8.0.1#53
Aliases: 

pagead2.googlesyndication.com has address 10.8.0.1

As you can see 10.8.0.1 is not a valid public IP address hence any ads coming from pagead2.googlesyndication.com will be served by our own Pi-hole.

Update OpenVPN config to push our PI-hole dns server

Type the following command:
$ sudo vi /etc/openvpn/server.conf
Delete or comment out existing DNS entries:
#Stop using Google DNS for our OpenVPN #push "dhcp-option DNS 8.8.8.8" #push "dhcp-option DNS 8.8.4.4"
Next add our PI-Hole DNS IP address:
push "dhcp-option DNS 10.8.0.1"
Save and close the file. Restart the OpenVPN server:
$ sudo systemctl restart openvpn@server

Open port 53 and 80 for our OpenVPN subnet

Type the following commands:
$ ufw allow proto tcp from 10.8.0.0/24 to 10.8.0.1 port 80 $ ufw allow proto tcp from 10.8.0.0/24 to 10.8.0.1 port 53 $ ufw allow proto udp from 10.8.0.0/24 to 10.8.0.1 port 53
Now reconnect all OpenVPN clients and you should able to browser everything without ads on your mobile devices. You can view PI-hole stats with the following url:
http://10.8.0.1/admin/
Sample outputs:

Fig.11: Pi-Hole admin/stats area

You can white-list or blacklist certain domains.

Conclusion

And there you have it, Pi-hole installed and configured on Debian or Ubuntu Linux along with an OpenVPN server. See Pi-hole.net for more information.

This entry is 2 of 11 in the OpenVPN Tutorial series. Keep reading the rest of the series:

🐧 If you liked this page, please support my work on Patreon or with a donation.
🐧 Get the latest tutorials on SysAdmin, Linux/Unix, Open Source/DevOps topics:

RSS feed or Weekly email newsletter
Share on Twitter • Facebook • 14 comments... add one ↓

UP NEXT

Category	List of Unix and Linux commands
File Management	cat
Firewall	Alpine Awall • CentOS 8 • OpenSUSE • RHEL 8 • Ubuntu 16.04 • Ubuntu 18.04 • Ubuntu 20.04
Network Utilities	dig • host • ip • nmap
OpenVPN	CentOS 7 • CentOS 8 • Debian 10 • Debian 8/9 • Ubuntu 18.04 • Ubuntu 20.04
Package Manager	apk • apt
Processes Management	bg • chroot • cron • disown • fg • jobs • killall • kill • pidof • pstree • pwdx • time
Searching	grep • whereis • which
User Information	groups • id • lastcomm • last • lid/libuser-lid • logname • members • users • whoami • who • w
WireGuard VPN	Alpine • CentOS 8 • Debian 10 • Firewall • Ubuntu 20.04