Once you have a Proxmox host running a few LXC containers, the first service worth adding is your own DNS server. Pi-hole gives you network-wide ad blocking on every device — phones, TVs, laptops — with zero client software, and as a bonus it resolves friendly local names like wiki.homelab.lan instead of raw IP addresses.
This guide installs Pi-hole in a lightweight LXC container, points your network at it, adds local DNS records, and covers the single mistake that takes an entire home network offline.
Task 1: Create the container
Pi-hole needs almost nothing. Create a small Debian 12 container — the creating your first LXC guide walks through every field. The one setting that matters here is a static IP: your whole network will point at this address, so it must never change.
pct create 110 local:vztmpl/debian-12-standard_12.7-1_amd64.tar.zst \
--hostname pihole \
--cores 1 --memory 512 --swap 256 \
--rootfs local-lvm:4 \
--unprivileged 1 --features nesting=1 \
--net0 name=eth0,bridge=vmbr0,ip=10.0.0.53/24,gw=10.0.0.1 \
--onboot 1 --password --start 1
--onboot 1 makes the container start automatically after a host reboot — important for a service the whole network depends on. Swap 10.0.0.53 for a free static address on your LAN.
Pi-hole must live at a fixed address. If it gets a DHCP lease that later changes, every device still pointing at the old IP loses DNS. Set the static IP in the container config (above) — not just a DHCP reservation.
Task 2: Install Pi-hole
Enter the container and run the official install script. It walks you through an interactive setup.
pct enter 110
apt update && apt upgrade -y
apt install -y curl
curl -sSL https://install.pi-hole.net | bash
In the installer, accept the defaults, pick an upstream resolver (Cloudflare or Quad9 are good choices), keep the default blocklist, and write down the admin password shown on the final screen.
Reasonable instinct. You can download the installer first, read it, then run it: curl -sSL https://install.pi-hole.net -o pihole-install.sh and inspect it before bash pihole-install.sh. The Pi-hole docs also document a manual install.
Open http://10.0.0.53/admin (your container’s IP) and log in. If you lost the password, reset it from inside the container:
pihole setpassword
Task 3: Point your network at Pi-hole
There are two ways to route DNS through Pi-hole. Pick one.
In your router’s DHCP settings, set the primary DNS server to the Pi-hole IP (10.0.0.53). Every device that gets a DHCP lease will now use Pi-hole automatically. Add a secondary DNS as a safety net (see the warning below).
If your router won’t let you change DNS, disable its DHCP server and enable Pi-hole’s built-in DHCP (Settings → DHCP). Only one DHCP server can run per network, so this is an either/or.
If Pi-hole is the only DNS server and its container stops, your whole network looks dead. Set a second DNS entry on the router — a second Pi-hole is best, but even a public resolver like 1.1.1.1 as secondary means browsing keeps working (unfiltered) while you fix things. Never leave a single point of failure on DNS.
Task 4: Add local DNS names
The real homelab payoff: stop memorising IP addresses. In the admin UI go to Settings → Local DNS Records and map hostnames to your internal IPs.
| Hostname | IP |
|---|---|
proxmox.homelab.lan |
10.0.0.10 |
wiki.homelab.lan |
10.0.0.20 |
nas.homelab.lan |
10.0.0.30 |
Now http://wiki.homelab.lan resolves anywhere on your LAN. This pairs perfectly with a reverse proxy, which uses these names to route to the right service over HTTPS.
Because Pi-hole is just a container on your LAN, Tailscale can advertise it as your DNS server for remote devices — ad blocking and local names follow you off the network.
What’s next
You now have network-wide ad blocking and local name resolution — the foundation every other self-hosted service builds on. Next, learn how to run the huge ecosystem of containerised apps with Docker on Proxmox, then put them behind clean HTTPS URLs with a reverse proxy.
Related posts:
- Creating Your First Proxmox LXC Container — the container Pi-hole runs in.
- Docker on Proxmox: LXC vs VM, Done Right — run the rest of your self-hosted apps.
- What Is Traefik? Reverse Proxies Explained — turn your local DNS names into HTTPS URLs.
- Proxmox LXC Networking: Static IPs, VLANs, and Bridges — the networking Pi-hole depends on.
- Tailscale Subnet Router — use Pi-hole as your DNS from anywhere.
- Proxmox Backup Server — back up the container so a rebuild is a restore.