Setting up a Pi-hole ad-blocker on a Khadas VIM1S SBC
-- 2025-10-24 --
This guide describes how I set up ad-blocker for my home network on a dedicated machine. I used Pi-hole to do the filtering with Unbound as its DNS resolver. I decided to set it up on a small SBC from Khadas, the VIM1S. This is quite cheap, has an simple OS setup system and operates silently.
Setting up the server
The VIM1S has Khadas's OOWOW service embedded within it. This makes it simpler to perform maintenance tasks such as installing an operating system. The VIM1s will boot straight into OOWOW on first use. There is a straightforward installation guide which allows you to choose the OS to install. I chose the "trixie_legacy" option from the Armbian sub-menu.
Once the OS is installed the machine will reboot into it. Once again Armbian has a straightforward setup procedure. The only thing to take extra care over is setting up a static IP address. Pi-hole won't work properly if the host machine has a IP address assigned by DHCP that may change. (You may also need to make changes on your router to accomodate the static IP.)
I usually do the initial setup with the machine plugged into a keyboard and monitor (although the Khadas website describes other ways to do it). After I'm sure everything is running properly I make sure that SSH access works and then close down the machine, unplug the peripherals and do all the other set up work over SSH.
Opening ports
Pi-hole needs several ports open to function. I don't use Pi-hole's DHCP function or its NTP function. Also I only allow acess over HTTPS, not HTTP. So I need to open the following ports:
Installing Pi-hole
The simplest way to install Pi-hole is by using the command below. This means running downloaded code blind. If you have security concerns about this it's probably better to run install by one of the alternative options given on the Pi-hole website.
When going through the installation you will be asked to choose an upstream DNS provider. It doesn't matter much which one is chosen as you will be changing it to a locally run instance of 'Unbound' later in this guide.
Accept the suggested blocklist as this can be changed after installation and it's easier to do it from the web interface once it's set up.
When asked, enable query logging. This has some privacy implications but you don't want to switch it off until you're sure everything is running smoothly as query logging can give you some clues as to the source of problems. You'll also be asked what privacy mode to enable for FTL (the Pi-hole blocker); I choose 'Show everything'. Once I'm sure that Pi-hole is working properly I can change this to a more private setting later.
After installing Pi-hole
First add your unprivileged user to the Pi-hole group to avoid having to enter the Pi-hole password for every Pi-hole CLI command. Either:
Or edit the /etc/group and /etc/gshadow files directly.
Next update Pi-hole:
Start Pi-hole:
Pi-hole is now running and will always start up at boot.
Set a password for the web interface:
Run Pi-hole's 'Gravity' to get the blocklist in the proper format:
If you want your Pi-hole server to do its own DNS resolving (you do!) you need to remove the /etc/resolv.conf symlink, which is managed by systemd and replace it with a static resolv.conf file. (Remember, this is Armbian, other distributions will handle this differently.)
This /etc/resolve.conf file should suffice:
Finally, log out of the Pi-hole server and point one of your network's computer's browser at the Pi-hole instance:
From here you can login using the password set above and tweak the system to your liking.
A useful feature when finishing the set up is that if you have another instance of Pi-hole running elsewhere you can use the 'Teleporter' option in 'Settings' menu to export the settings (including blocklists) from there and then import them from the saved file into your new instance. This is particularly handy if you use a lot of blocklists.
Unbound
Unbound is a recursive DNS resolver which supports DNSSEC and DNS over TLS (DoT) which improves the security and privacy of DNS requests. By installing your own resolver you stop sharing your DNS traffic with third parties and increase your DNS privacy. When you run your own resolver your DNS cache will be kept on your own machine rather than stored on someone else's computer. The downside is that the first time you resolve a domain name it will probably be slower than using your ISP’s resolver. However all subsequent queries for that domainn should be much faster.
Install unbound and apparmor (to improve security):
Configure Unbound
Now create a config file at /etc/unbound/unbound.conf.d/pi-hole.conf (this one is based on the example provided on the Pi-hole website):
Check that the config file is OK:
Now create the logfile:
Next create and AppArmor exception for the logfile. Edit /etc/apparmor/local/usr.sbin.unbound, adding the line:
Then reload AppArmor, making sure it reads the new exception:
Get Unbound running and working with Pi-hole
Enable and start unbound:
Run some tests:
Now configure Pi-hole to use Unbound. Use the web interface and go to the 'Settings >> DNS >> Custom DNS servers' section. Enter '127.0.0.1#5335' and untick all the other DNS servers. Click on 'Save & Apply'.
Use a browser on one of your network's computers to visit 'https://one.one.one.one/help/' which will show you if Pi-hole is now using DoT.