Self-host Pi-hole on a no-KYC VPS
Block ads and trackers at the DNS level for every device on your network, including phones on mobile data. Anonymous signup, no email required, no KYC. Pay with crypto or card, full root, no logs.
Quick start: Pi-hole on Servury via Docker
Tested on Ubuntu 24. Pick a 1 GB+ plan, deploy, SSH in.
# 1. Install Docker
curl -fsSL https://get.docker.com | sh
# 2. Disable systemd-resolved on port 53 (it would conflict)
systemctl disable --now systemd-resolved
echo "nameserver 1.1.1.1" > /etc/resolv.conf
# 3. Run Pi-hole
docker run -d --name pihole --restart unless-stopped \
-p 53:53/tcp -p 53:53/udp \
-p 80:80/tcp \
-e TZ=America/New_York \
-e WEBPASSWORD=changeme \
-v pihole_etc:/etc/pihole \
-v pihole_dnsmasq:/etc/dnsmasq.d \
pihole/pihole:latest
# 4. Open http://YOUR_SERVER_IP/admin, log in
# 5. Set the VPS IP as DNS on your router (or per-device)
# For mobile data, pair with WireGuard so DNS still routes through Pi-hole
Why VPS Pi-hole beats a Raspberry Pi at home
A home Pi-hole only blocks ads when you are on home wifi. A VPS Pi-hole + WireGuard blocks ads everywhere, even on cellular.
If your home Pi-hole goes down, your whole network loses DNS. A VPS Pi-hole stays up regardless of your home connection.
Raspberry Pis kill SD cards. A VPS doesn't have that problem. Reliable storage, real RAM, snapshot backups.
Pi-hole's DNS-level blocking catches ads that uBlock Origin can't (iOS apps, smart TVs, IoT devices, console games).
Roku, Samsung TV, Echo, every smart device phones home constantly. Pi-hole shuts those telemetry endpoints down at the DNS level.
Stevenblack, OISD, hagezi all supported out of the box. Click toggle, save, done. Whitelist anything that breaks.
Frequently asked questions
How do I expose Pi-hole only to me, not the public internet?
You should not expose port 53 to the public, or your VPS will be used as an open DNS resolver and amplify DDoS attacks. The clean pattern is: install WireGuard on the same VPS, and only allow DNS queries from inside the WireGuard network. Then your devices connect over WireGuard and use Pi-hole. We have a WireGuard guide on the WireGuard VPS page.
Can it block YouTube ads?
On smart TVs and the YouTube app, often yes (DNS-level blocking catches the ad domains). In a desktop browser, no, because YouTube serves video and ads from the same domain. Pair with uBlock Origin for browser ads.
Will my browsing speed slow down?
No, faster usually. Blocking ads means fewer requests and fewer bytes downloaded. The DNS lookup itself is sub-millisecond.
How much VPS do I need?
1 GB RAM is overkill for Pi-hole alone. The reason most people pick 1-2 GB is they pair Pi-hole with WireGuard, Unbound, or other tools on the same VPS.
Can I use Unbound for DNS-over-TLS?
Yes. Pi-hole + Unbound is the gold-standard setup. Unbound recursively resolves DNS without sending queries to Cloudflare or Google. Tutorial in our blog.
What if Pi-hole goes down?
Set a secondary DNS on your devices that points to 1.1.1.1 or a backup. If Pi-hole is unreachable, devices fall back to the secondary and you keep working without ad blocking.
Can multiple users share one Pi-hole?
Absolutely. A 1 GB VPS comfortably serves a household, a small office, or a family. The blocklist is shared but admin can see per-client query stats.
Does Servury log my DNS queries?
No. Servury runs no application-level logging on customer servers. Anonymous signup and crypto/card payment.
