Use Pi-hole as a VPN to Block Ads on the Go with Tailscale

Tested August 2026

Tailscale lets you securely reach your Pi-hole from anywhere without opening ports on your router.

This page covers two features:

Remote access
- SSH into the Pi and open the Pi-hole web interface from any device on your tailnet.
Exit node for a private, ad-blocking VPN (optional)
- Route all of a device’s traffic through your home Pi, so you get Pi-hole ad blocking even when away from home.

Why Tailscale Instead of Port Forwarding

Tailscale creates an encrypted peer-to-peer network called a “tailnet” between your devices using WireGuard. The Pi is only available to devices logged in to your Tailscale network.

The alternative to Tailscale is port forwarding: opening SSH (port 22) and the Pi-hole web interface (ports 80/443) on your router so they’re reachable from the internet. This works, but exposes those ports to the public internet and increases the risk of brute force attacks.

Prerequisites

A Tailscale account (free)
Pi-hole installed and working
UFW active

Install Tailscale and Connect

Install Tailscale on the Pi:

curl -fsSL https://tailscale.com/install.sh | sh

Connect the Pi to your tailnet:
From the Pi
```
sudo tailscale up
```
This displays an authentication URL. Open it in a browser and log in to your Tailscale account to authorize the Pi.
Disable key expiration for the Pi in the Tailscale admin console. Find the Pi in the machine list, select the … menu, and select Disable key expiry.

By default, Tailscale authentication keys expire after 180 days. When a key expires, the device loses tailnet access until you re-authenticate.

You can learn more about key expiry in the Tailscale docs.
Note the Pi’s Tailscale IP. You can copy it from the machine list or from the Tailscale app.
Allow all Tailscale traffic through UFW:
Terminal window
```
sudo ufw allow in on tailscale0 comment 'Tailscale'
```
This single rule covers SSH, the Pi-hole web interface, and anything else you access through the tailnet.
Install Tailscale on your laptop, phone, or tablet, and add it to your tailnet.
Verify remote access.

From another device on your tailnet (phone, laptop), SSH to the Pi’s Tailscale IP and open https://100.x.x.x/admin in a browser.

Use Pi-hole DNS to Block Ads for All Devices on Your Tailnet

By default, Tailscale uses its own DNS resolver. Configure Pi-hole as the DNS server for your tailnet to enable ad blocking on every connected device wherever it is.

Allow Pi-hole to accept DNS queries from devices connected to the tailnet:
From the Pi
```
sudo pihole-FTL --config dns.listeningMode ALL && \
sudo systemctl restart pihole-FTL
```
ALL accepts DNS queries on every interface, not just tailscale0. Pi-hole’s own documentation is explicit that this requires a properly configured firewall, which is why UFW is a prerequisite for this page.
In the Tailscale admin console, go to DNS.
Under Nameservers, select Add nameserver > Custom.
Enter the Pi’s Tailscale IP (the 100.x.x.x address from the previous section).
Add a second nameserver: select Add nameserver > Custom again and enter 1.1.1.1. This keeps DNS working on your tailnet if the Pi goes offline.

The same trade applies here as in your router’s DHCP settings: a second nameserver is a fallback and a leak at the same time, because clients aren’t required to prefer the first one. See Devices Might Bypass Pi-hole in Favor of Secondary DNS. Leave this step out if you’d rather every tailnet query either resolve through Pi-hole or fail outright, with no fallback.
Enable Override local DNS so that all tailnet devices use these nameservers instead of their own.
Select Save.

DNS queries from any device on your tailnet now go to your Pi-hole, regardless of where you are.

Each device on your tailnet is reachable at its 100.x.x.x address, or by its MagicDNS name if you’ve enabled MagicDNS. That tailnet address is also what appears in the Pi-hole query log under Client while the device is connected, rather than the device’s LAN IP.

Optional: Use the Pi as an Exit Node for a Private VPN

An exit node routes all of a device’s traffic through the Pi, not just DNS. Your phone or laptop appears to be on your home network when away.

This is useful for accessing local resources or creating another layer of privacy while traveling.

Enable the Exit Node on the Pi

Enable IP forwarding. This is required for the Pi to route packets on behalf of other devices:

echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf && \
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf && \
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

Advertise the Pi as an exit node:
From the Pi
```
sudo tailscale set --advertise-exit-node
```
set applies immediately and only changes the flag you name, unlike up, which requires every preference to be repeated each time and can silently reset ones you don’t.
In the Tailscale admin console, find the Pi in your machine list. Select Edit route settings and enable Use as exit node.

Tailscale requires explicit admin console approval.

Enable the Exit Node on Your Devices

Advertising an exit node doesn’t automatically route traffic through it.

Each client enables its own exit node options.

macOS / Windows:
- Open the Tailscale menu bar app, go to Exit Node, then select your Pi by name.
iOS / Android:
- Open the Tailscale app, select your tailnet name, go to Use exit node, then select the Pi.
Linux:
- Run on the client device (not the Pi), using the 100.x.x.x Tailscale IP from above:
  From the client device
```
sudo tailscale set --exit-node=100.x.x.x
```

To stop using the exit node, select None in the app, or run the following from the client (not the Pi):

sudo tailscale set --exit-node=

Checkpoint

At this point you can reach your Pi-hole from anywhere, and optionally route all your traffic through it.

Before you continue, confirm the following:

SSH and the Pi-hole web interface both work from a device on your tailnet, away from your home network.
If you configured Pi-hole as your tailnet’s DNS server, a tailnet device’s queries show up in the Pi-hole query log under its 100.x.x.x address.
If you set up an exit node, a client using it shows your home IP address when it checks.
If you run into issues, see Tailscale troubleshooting.

The next page covers updating Pi-hole, backing up your configuration, and other maintenance tasks.