Security

Host Pi-hole on VeloxaHost

Pi-hole is a DNS server that answers lookups for ad, tracker and malware domains with nothing, so they never load on any device that uses it. People run it to filter DNS for a home, an office or their own devices, and on a VPS it is usually paired with a VPN such as WireGuard so phones and laptops are covered away from home.

The one-click install runs Pi-hole's official installer in unattended mode on Ubuntu 24.04, with Cloudflare (1.1.1.1) and Google (8.8.8.8) as upstream DNS servers and query logging on.

Install it yourself

  1. Install curl and download the official installer so you can read it before running it.

    apt update && apt install -y curl
curl -sSL https://install.pi-hole.net -o basic-install.sh

  2. Run the installer and answer its prompts (network interface, upstream DNS, blocklist). It frees port 53 by turning off systemd-resolved's stub listener, which Ubuntu runs by default.

    bash basic-install.sh

  3. Set the web interface password.

    pihole setpassword

  4. Forward a port in the server's block on the shared IPv4 to port 80 from the server's page in the console, then open http://<shared-ip>:<public-port>/admin and sign in. Pi-hole 6 serves its own web interface on ports 80 and 443, without a separate web server.

  5. Limit who can query it. Allow DNS (port 53, TCP and UDP) and the web interface only from your own addresses, or only over your VPN.

    ufw allow from 203.0.113.0/24 to any port 53
ufw allow from 203.0.113.0/24 to any port 80,443 proto tcp

  6. Point your devices, router or VPN clients at the server's address as their DNS server, then check that queries appear under Query Log.

  7. Keep Pi-hole and its blocklists current.

    pihole -up   # update Pi-hole
pihole -g    # rebuild the blocklist database

FAQ

What licence is Pi-hole under?

Pi-hole is licensed under the European Union Public Licence (EUPL). It is free to use, and you can modify and redistribute it under the same licence.

Is it safe to run Pi-hole on a public server?

Only with access restricted. An unrestricted DNS server on the internet can be used in amplification attacks against others. Pi-hole 6 defaults to answering only devices on its local network, so remote clients need either a VPN, such as the WireGuard app in the VeloxaHost marketplace, or a deliberate change of listening mode plus firewall rules limited to your own addresses.

Where does Pi-hole keep its settings and data?

Everything lives in /etc/pihole: pihole.toml holds the settings, gravity.db the blocklists and allow and deny lists, and pihole-FTL.db the long-term query history. Back up that directory, or the whole server, before major changes.

How much server does Pi-hole need?

Very little. It runs on the 1 vCPU, 512 MB and 10 GB minimum; the recommended 1 GB of RAM leaves room for large blocklists and a long query history. That fits the Veloxa Nano VPS size: 1 vCPU, 1 GB RAM and 25 GB disk for $5 a month, billed hourly and capped at that price.

Where do I find the password after a one-click deploy?

VeloxaHost replaces the install script's placeholder password with a random one for every deploy and stores it encrypted. Owners and admins of the account can reveal it on the server's page in the console, and every reveal is recorded in the audit log. You can set a new password at any time with pihole setpassword.

Can I roll back a bad blocklist or settings change?

Yes. Take a snapshot from the server page before the change and restore it if something breaks, or schedule automatic snapshots from hourly to weekly, kept for 1 to 30 days.