Pi-hole operates as a DNS sinkhole rather than a network gateway, meaning it filters traffic by intercepting domain name resolutions instead of routing packets. To serve the 192.168.0.0/16 subnet, you must configure your DHCP server or individual devices to use the Pi-hole instance’s IP address as their primary DNS resolver. This ensures all queries from that range are processed through the blocking engine.
Distinguishing DNS Filtering from Network Routing
A common misconception is that configuring a subnet in Pi-hole automatically routes all internet traffic through the device running Pi-hole. This is incorrect. Pi-hole listens on port 53 (DNS) and optionally port 80/443 (Web Interface). It does not act as a transparent proxy or a default gateway for HTTP, HTTPS, or other application-layer protocols unless explicitly configured as such via complex firewall rules, which is outside the scope of standard Pi-hole operation. For the 192.168.0.0/16 subnet to benefit from ad blocking, clients within that range must send their DNS requests directly to the Pi-hole server. If a client uses a different DNS provider (like Google's 8.8.8.8), Pi-hole cannot block those domains regardless of subnet settings. Therefore, the core task is ensuring DNS delegation, not network bridging. You can read more about combining filtering solutions in Combining AdGuard and Pi-hole on Raspberry Pi 2 for Hotspot with Ethernet Internet, which discusses similar architectural considerations for multi-service environments.Identifying the Pi-hole Server Address
Before modifying client configurations, you must know the exact IP address assigned to your Pi-hole installation. Since you are running this on Ubuntu 22.04 within a Proxmox environment, the IP could be static or dynamic depending on your virtual network setup. Run the following command in your Proxmox shell or SSH into the Ubuntu VM to identify the active interface and its IP:ip addr show
eth0, ens18, or similar). Note the IPv4 address listed there. For example, if your Pi-hole is at 192.168.0.10, this is the address you will distribute to clients. Do not guess this value; verify it matches the subnet you intend to serve.
Configuring DHCP to Distribute DNS Settings
The most efficient way to ensure all devices in the 192.168.0.0/16 range use Pi-hole is to configure your network's DHCP server. Most home and small business routers handle this. You need to access your router's administration panel and locate the DHCP settings. In the DHCP configuration section, look for fields labeled "Primary DNS," "DNS Server 1," or "Domain Name System." Replace the existing DNS entries with the IP address of your Pi-hole instance. Some routers allow you to set specific DNS ranges for different subnets. If your router supports VLANs or separate DHCP scopes for the 192.168.0.0/16 network, assign the Pi-hole IP specifically to that scope. If you do not have control over the router's DHCP server, you must configure each device manually. On Windows, go to Network Connections > Properties > IPv4. On macOS, go to System Preferences > Network > Advanced > TCP/IP. Enter the Pi-hole IP in the DNS field. On Linux, edit your/etc/resolv.conf or use netplan depending on your distribution.
Verifying Client Resolution
After updating the DNS settings, verify that clients are actually querying Pi-hole. Use a device within the 192.168.0.0/16 subnet and run a DNS lookup usingdig or nslookup.
dig google.com @
<Pi-Hole-IP> with your actual server address. The response should come from your Pi-hole server. Check the Pi-hole Web Interface under "Query Log" to see if these queries appear. If they do, the configuration is successful. If not, check for firewalls blocking UDP port 53. Ensure that your Proxmox firewall or Ubuntu ufw allows incoming DNS traffic from the 192.168.0.0/16 range.
Handling Static IP Clients
Some devices, such as printers, servers, or IoT gadgets, may use static IP addresses and ignore DHCP updates. These devices must be manually configured to point to the Pi-hole DNS. If you have many such devices, consider using a script to push configuration changes or manage them via a centralized management tool. However, for most users, DHCP configuration covers the majority of traffic. It is also worth noting that Pi-hole has built-in features to detect and block attempts to bypass DNS. If a client continues to use external DNS despite your efforts, Pi-hole may log these attempts. Review the query logs regularly to identify any misconfigured devices that are not contributing to the ad-blocking ecosystem. For more advanced networking scenarios involving tunnels and subnets, you might find relevant insights in PFsense: Fake Subnet and IPsec Tunnel Mapping, though note that Pi-hole itself does not require tunnel mapping for basic DNS filtering.FAQ
Does Pi-hole block ads for devices not using its DNS?
No, Pi-hole only blocks domains for clients that send DNS queries to it. If a device uses a public DNS like Cloudflare or Google, Pi-hole cannot filter that traffic. You must change the device's DNS settings to point to the Pi-hole IP.Can I use Pi-hole without changing router DHCP settings?
Yes, but you must manually configure the DNS settings on every individual device. This is impractical for large networks but works well for single devices or small setups where DHCP access is restricted.Why are some ads still showing up even after configuration?
This often happens because the ad-serving domain is not in the Pi-hole gravity list, or the content is served from the same domain as legitimate content (whitelisted by default). Additionally, if the client is caching old DNS records, flushing the DNS cache on the client device may resolve the issue.How do I check if my firewall is blocking DNS?
Use theufw status command on Ubuntu to check if port 53 is open. You can also test connectivity from another machine using nc -u <Pi-Hole-IP> 53 to see if the UDP port responds. If the connection times out, adjust your firewall rules to allow inbound DNS traffic.