DNS Blocking, VPNs, and Network-Level Privacy

Network-layer defenses protect every device on your network — phones, smart TVs, IoT gadgets — that can’t run a browser extension. This is the layer most people skip and the one with the broadest reach.

DNS sinkholing (block trackers for the whole house)

A blocking DNS resolver refuses to resolve known ad and tracker domains, so those requests never leave your network.

• Pi-hole — the classic self-hosted option. Runs on a Raspberry Pi, a small VM, or a container; point your router’s DNS at it and every device is filtered. Gives you query logs, per-client rules, and blocklist management. (If you run a Proxmox or home-lab setup, Pi-hole or AdGuard Home in a container/LXC is the natural home for this.)
• AdGuard Home — similar to Pi-hole, single-binary, with a cleaner UI, built-in encrypted-DNS upstream, and per-client filtering. Easier first setup for many people.
• NextDNS — a hosted resolver if you don’t want to self-host. Configurable blocklists, per-device profiles, encrypted DNS, and logs, with a generous free tier. Works on mobile data too via its profiles.

Point your router at the resolver to cover everything, or configure devices individually if you can’t change the router.

Encrypted DNS

Whatever resolver you use, use DNS over HTTPS (DoH) or DNS over TLS (DoT) so your ISP can’t read or log which domains you look up. Browsers (Firefox, Chrome) can do DoH directly; AdGuard Home and NextDNS support encrypted upstreams for the whole network.

VPNs: what they actually do

A VPN encrypts your traffic to the VPN server and replaces your IP address, so sites and your ISP see the VPN’s IP, not yours, and your ISP can’t see which sites you visit. That is real and useful — especially on untrusted Wi-Fi and against IP-based tracking and geolocation.

What a VPN does not do, despite the marketing:

• It does not stop cookies, login-based tracking, or browser fingerprinting. Logged into Google or Facebook over a VPN? Still you.
• It does not block ads or trackers (unless the VPN bundles a blocker).
• It moves your trust from your ISP to the VPN provider — so the provider matters. Choose an audited, no-logs provider with a clear ownership story; Mullvad, Proton VPN, and IVPN are the commonly cited privacy-respecting choices. Avoid “free” VPNs, which often monetize your traffic.

Sensible setup

DNS blocking (Pi-hole/AdGuard Home/NextDNS) + encrypted DNS gives the widest tracker reduction. Add a reputable VPN for IP privacy on the move and on shared networks. Together they cover the network layer; combine with browser and extension layers for depth.