If you have kids, managing their screen time can be a constant battle.It can be difficult to enforce the rules because it's easy for them to pick up a phone or tablet without you realizing.If you have Pi-hole set up, you can use it to shut down their internet access when it's time for bed.
I put my kids' Fire tablets in their own Pi-hole group You can set different rules for different groups Close I run Pi-hole on my mini PC, and my router is set up to use Pi-hole as the sole DNS server, giving me filtering across my whole network.It means that any rules I create in Pi-hole will apply to most devices in my home.I only want to use Pi-hole to block my kids' tablets, so I needed to put these devices into their own group.
In Pi-hole, select Groups from the left-hand menu.Enter a name for the group, using quotes if your group name contains a space, as otherwise you get a separate group for each word.Click Add to create your group.
Select Clients from the left-hand menu.In the Known clients field, enter the MAC address of a device you want to add to the group, which you can find in the device settings or on your router's admin page.If your device uses MAC randomization, use a DHCP reservation or static IP and identify the client by its IP instead.
Add a Comment to identify the device.Click the Group Assignment dropdown and select the group you just created.Repeat the process for any other devices you want to add to the group.
Related How to Create iPhone and iPad Limits for Your Kids With Family Sharing Set healthy boundaries to protect your kids online.Posts By Aman Kumar I used a Regex rule to block every domain The rule blocks every DNS lookup Close Once you've set up your group containing your kids' devices, the next step is to create a rule that will block these devices from making DNS requests.Using ordinary Pi-hole blocklists isn't the best plan, because streaming apps and other apps that my kids like to use can rely on multiple domains and subdomains.
The most effective option is to simply block all DNS requests.I used a single regular expression to deny access to every single domain lookup.Select Domains from the left-hand menu.
Choose the RegEx filter tab and enter .* in the Regular Expression field.Add a Comment to identify your filter and select the Group assignment dropdown.Ensure that only the group you created above is selected; the Default group needs to be deselected, or Pi-hole will block DNS requests for every device.
Click Add to denied domains to create your new rule.You can now test your rule.With the filter showing as Enabled, try accessing a web page or streaming a video.
You should find that access is blocked and the page won't open or the content won't play.Click the Enabled button to disable the filter and try again.You should now be able to use the device as normal.
Using Pi-hole to block the internet isn't perfect There are flaws, but it's good enough for my needs Using Pi-hole this way can make a useful bedtime internet control, but ultimately Pi-hole can only block DNS requests; it's not a firewall.Enabling the filter stops the devices from translating new domain names into IP addresses, but it doesn't terminate connections that the devices have already established.For example, if my kids are watching a show on Netflix, when I activate the filter, the current episode will sometimes keep playing, as the app has already resolved the required domains.
It’s only when the episode finishes and the app tries to play a new episode that the filter will block it from happening.For my use, this is absolutely fine.My kids usually beg to watch to the end of the episode anyway, and this method allows them to do that but stops them from watching any more.
They could also work around the block using a VPN or by changing the DNS settings on their tablets, but on their Fire Kids tablets, they don't have access to these settings.I could use Amazon's own parental controls for the same purpose, but using Pi-hole allows me to add additional devices to the filter just by adding them to the blocked group.Quiz8 Questions · Test Your KnowledgeDNS filtering and network privacy toolsTrivia challengeFrom Pi-hole to Control D — how well do you know the tools that block ads and protect your network?DNSPrivacyNetworkingAd BlockingSecurityBegin01 / 8Ad BlockingWhat is Pi-hole primarily designed to do?AEncrypt DNS queries using TLSBAct as a network-wide ad blocker using DNS sinkholingCCreate a VPN tunnel for all home network trafficDMonitor bandwidth usage across connected devicesCorrect! Pi-hole works as a DNS sinkhole, intercepting DNS queries for known ad-serving domains and returning a null response so ads never load.
Because it operates at the network level, it blocks ads on every device connected to your router — including smart TVs and phones — without needing a browser extension.Not quite.Pi-hole is a DNS sinkhole, meaning it blocks ad-serving domains at the DNS level before your devices even attempt to connect to them.This makes it uniquely powerful because it works across your entire network, not just in a single browser.Continue02 / 8DNSWhich hardware platform is Pi-hole most famously associated with?AArduino UnoBNVIDIA Jetson NanoCRaspberry PiDIntel NUCCorrect! Pi-hole was built with the Raspberry Pi in mind, and its name is literally a portmanteau of 'Raspberry Pi' and 'black hole.' The low cost and small footprint of a Raspberry Pi make it an ideal always-on DNS server for a home network, though Pi-hole also runs on many other Linux systems.Not quite.
The 'Pi' in Pi-hole refers to the Raspberry Pi, the inexpensive single-board computer that inspired the project.The name cleverly combines 'Raspberry Pi' with 'black hole,' reflecting how it swallows ad requests before they can reach your devices.Continue03 / 8PrivacyWhat feature differentiates Control D from a basic DNS resolver like 8.8.8.8?AIt only works on Windows devicesBIt offers customizable filtering profiles, per-device rules, and analyticsCIt exclusively uses the DNS-over-HTTPS protocolDIt requires a dedicated hardware appliance to functionCorrect! Control D goes far beyond simple DNS resolution by letting users create custom filtering profiles that block categories like ads, malware, social media, or adult content.It also supports per-device routing rules and provides detailed query analytics, making it a powerful managed DNS service for both individuals and businesses.Not quite.
Control D is a managed DNS service that layers advanced filtering and analytics on top of standard DNS resolution.Unlike a plain resolver such as Google's 8.8.8.8, it lets you define exactly what content is blocked or redirected, and even apply different rules to different devices on your network.Continue04 / 8SecurityWhat does DNS-over-HTTPS (DoH) protect against compared to traditional DNS?AIt prevents malware from executing on your deviceBIt hides DNS queries from eavesdroppers by tunneling them over encrypted HTTPSCIt speeds up DNS resolution by caching responses locallyDIt blocks advertisements before they reach your browserCorrect! Traditional DNS queries are sent in plain text, meaning your ISP, network admin, or anyone monitoring your traffic can see every domain you look up.DoH wraps those queries inside encrypted HTTPS traffic, making them indistinguishable from normal web browsing and shielding your browsing habits from snoops.Not quite.
DNS-over-HTTPS is a privacy protocol, not a security or performance tool per se.It encrypts your DNS lookups inside standard HTTPS connections so that third parties on the network — like your ISP or a coffee shop operator — cannot see which domains you are querying.Continue05 / 8NetworkingWhat is the purpose of a blocklist in tools like Pi-hole or AdGuard Home?AA list of IP addresses that are given priority bandwidthBA whitelist of trusted certificate authoritiesCA curated list of domains known to serve ads, trackers, or malware that should be blockedDA log of all devices that have ever connected to your routerCorrect! Blocklists are the heart of DNS-based filtering tools.They are community-maintained or commercially curated databases of domains associated with advertising networks, trackers, phishing sites, or malware distribution.
When a device queries one of these domains, the DNS filter returns a fake or null address, preventing the connection entirely.Not quite.In DNS filtering, a blocklist is a database of known bad or unwanted domains — ad servers, trackers, and malware hosts.The DNS filter consults this list on every query and silently drops requests for listed domains, which is why Pi-hole can report blocking millions of queries per day on an active home network.Continue06 / 8Ad BlockingAdGuard Home is often compared to Pi-hole.
What is one key built-in feature AdGuard Home offers that Pi-hole historically lacked out of the box?AThe ability to run on a Raspberry PiBSupport for encrypted DNS protocols like DoH and DNS-over-TLS nativelyCA command-line interface for managing blocklistsDThe ability to block ads in mobile appsCorrect! AdGuard Home was designed from the ground up with encrypted DNS support built in, allowing it to act as a local DoH or DoT server without additional software.Pi-hole originally required pairing with a separate tool like Unbound to gain similar encrypted upstream capabilities, though the gap between the two projects has narrowed over time.Not quite.One of AdGuard Home's headline advantages has been native support for encrypted DNS protocols — DNS-over-HTTPS and DNS-over-TLS — both for upstream resolvers and for clients connecting to it.
Pi-hole users who wanted the same functionality traditionally had to install Unbound or another resolver alongside it.Continue07 / 8DNSWhat does the term 'upstream DNS resolver' mean in the context of Pi-hole or AdGuard Home?AThe DNS server that your filtering tool forwards non-blocked queries to for final resolutionBA secondary Pi-hole instance used for failover redundancyCThe router firmware that routes DNS traffic to the filtering toolDA paid subscription tier that unlocks faster query processingCorrect! Pi-hole and AdGuard Home sit between your devices and the internet, filtering out blocked domains.For everything that is not blocked, they need to forward the query to a real DNS resolver — the upstream — such as Cloudflare (1.1.1.1), Google (8.8.8.8), or a local recursive resolver like Unbound.The upstream is what actually looks up the IP address and returns it.Not quite.
An upstream DNS resolver is the server your filtering tool consults whenever a query is not on the blocklist.Think of Pi-hole as a bouncer at the door — blocked domains never get in, but for everything else it passes the question along to the upstream resolver, which does the actual DNS lookup and returns the answer.Continue08 / 8SecurityWhat is a DNS rebinding attack, and which type of tool is specifically designed to help mitigate it?AAn attack that floods a DNS server with requests; mitigated by a CDNBAn attack where a malicious website tricks your browser into communicating with internal network devices; mitigated by DNS filtering tools with rebinding protectionCAn attack that intercepts DoH traffic; mitigated by a VPNDAn attack that poisons the ARP cache to redirect local traffic; mitigated by a firewallCorrect! In a DNS rebinding attack, a malicious website first resolves to a legitimate external IP, then quickly changes its DNS response to an internal IP like 192.168.1.1 — effectively turning your browser into a proxy that can talk to devices on your local network.Pi-hole and AdGuard Home both include DNS rebinding protection that rejects responses containing private IP ranges for public domain names.Not quite.
DNS rebinding is a clever attack where a hacker's domain first points to their own server, then switches its DNS record to point at an IP inside your home network.Your browser, already trusting the domain, then happily sends requests to your router or other local devices.DNS filtering tools counter this by blocking any public domain that resolves to a private IP address range.See My ScoreChallenge CompleteYour Score/ 8Thanks for playing!Try Again Using Home Assistant to enable and disable the group A custom integration lets me turn the filter on and off Once I'd set up my group and my filter, I could block my kids' devices from accessing the internet or watching shows by toggling the filter in Pi-hole.
This was fine, but I didn't want to have to remember to do it manually every evening.The final step was to automate the process in Home Assistant.There's a native Pi-hole integration, but this doesn't expose everything that I need.
The Pi-hole V6 custom component available via HACS can expose individual Pi-hole groups as switches.Once this integration is set up, you get a switch for each Pi-hole group.Turning the group for the kids' devices on will block their access, and turning the group off will restore it again.
It's then trivial to create an automation that turns the group on at bedtime and turns the group back off again in the morning.My bedtime internet shutdown is now enforced automatically, and I'm no longer the bad guy telling them it's time to get off their tablets.There are plenty of other ways to block internet access If you don't already have Pi-hole set up, there are other ways to restrict internet access to specific devices, such as router parental controls, firewall rules, or putting your kids' devices on a separate VLAN or SSID.
If you already use Pi-hole, then the method above is a quick and easy alternative.
Read More
