Pi-hole Network DNS Filter Appliance

This lab guides students through building, configuring, and testing a dedicated network-attached DNS sinkhole appliance using Pi-hole hosted on a Linux platform. Students configure host network interface settings including static IPv4 and IPv6 addressing, resolve port binding conflicts with default local resolvers, and deploy authoritative local caching DNS services across a local area network. Through hands-on integration, learners link the appliance into LAN infrastructure via router DHCP options or manual client assignment, analyze DNS resolution query paths, inspect domain blocking via customized adlists and the gravity database, and examine query telemetry through web dashboards and command-line diagnostics. Students gain practical understanding of core network protocols, Domain Name System architecture, network-wide content filtering, and Linux-based network appliance administration.

Domain Name System DNS DNS sinkhole network security computer networking Linux system administration Raspberry Pi single-board computer SBC DHCP Dynamic Host Configuration Protocol IPv4 IPv6 ad blocking content filtering local area network LAN Pi-hole network appliance caching resolver

Uploaded by demo on 2026-09-03 · ready · Electronics · Original source ↗

Files: pihole_README.md · pihole_basic-install.sh · pihole_prerequisites.html

Readiness checks

  • complete 2026-09-03 02:14 🛡 Cybersecurity: Review before networking · 5 findings 7 searches · 7 pages
    view · PDF

Latest report — 2026-09-03 02:14

Readiness: Pi-hole Network DNS Filter Appliance

Verdict: Ready · 2026-09-03 · est. parts cost $78–$95 Cybersecurity — software & network: Review before networking

All four items on this lab's bill of materials are current, plentiful commodity products, available today from several independent sellers at ordinary prices — a Raspberry Pi 4 Model B 2GB at $55.00, a 32 GB Class 10 microSD card from $11.74, an official 5.1 V 3 A USB-C supply from $7.99, and a Cat6 patch cable from $3.14. The snapshot also grants wide latitude on every line (any 32/64-bit host with at least 512 MB of RAM and a supported Linux, any Class 10 or better card, any well-regulated 5 V supply, any Cat5e/Cat6 cable or Wi-Fi instead), so no single part can hold the lab up. This is the cold check for this lab — there is no previous report, so the prices and sellers below establish the baseline against which the next check measures drift. The lab's real exposure is not in its parts list: it is the network posture and the entirely unpinned software stack described in the Cybersecurity section.

Action required

None — all checked parts are sourceable.

Cybersecurity — software & network

Review before networking — The stack installs cleanly with no default credentials, but it is entirely unpinned, its dashboard ships a Bootstrap release with two unfixed XSS advisories, and its DNS/DHCP and plain-HTTP admin services need an isolated network segment before students attach one to a campus LAN.

Component Version How known Support status
Pi-hole core (pi-hole/pi-hole) v6.4.3 inferred (installer runs git reset --hard $(git describe --abbrev=0 --tags) (fetched/05-basic-install.sh); GitHub releases/latest for pi-hole/pi-hole returns tag v6.4.3 (fetched/01-latest)) —
pihole-FTL daemon (DNS, DHCP, embedded web server) v6.7 inferred (installer downloads github.com/pi-hole/ftl/releases/latest/download (fetched/05-basic-install.sh); GitHub releases/latest for pi-hole/FTL returns tag v6.7 (fetched/03-latest)) —
Pi-hole web dashboard (pi-hole/web) v6.6 inferred (installer resets the clone to the newest tag; GitHub releases/latest for pi-hole/web returns tag v6.6 (fetched/02-latest), whose package.json was fetched and checked) —
Bootstrap (dashboard front-end library) 3.4.1 read from project (pinned in fetched/04-package.json (pi-hole/web v6.6 package.json)) —
pihole-meta, Debian/Ubuntu meta-package 0.7 read from project (PIHOLE_META_VERSION_APT=0.7 in fetched/05-basic-install.sh) —
pihole-meta, Alpine apk virtual package 0.3 read from project (PIHOLE_META_VERSION_APK=0.3 in fetched/05-basic-install.sh) —
pihole-meta, RPM/Fedora spec package 0.4 inferred (snapshot records Version 0.4 Release 1 in the installer's RPM control block; the extraction from fetched/05-basic-install.sh surfaced only the APT and APK version variables) —
Debian (base OS named by the snapshot) 12 inferred (the lab pins no OS; the snapshot's check plan names Debian 12 as the representative base) extended/LTS support only until 2028-06-30
Raspberry Pi OS Bookworm (base OS named by the snapshot) bookworm inferred (snapshot names Raspberry Pi OS Bookworm; Bookworm is the Debian 12 base, so Debian's cycle was looked up) extended/LTS support only until 2028-06-30
Fedora (base OS option named by the snapshot) 40 inferred (the lab pins no OS; the snapshot's check plan names Fedora 40) unsupported since 2025-05-13
Alpine Linux (base OS option named by the snapshot) 3.20 inferred (the lab pins no OS; the snapshot's check plan names Alpine Linux 3.20) unsupported since 2026-04-01
StevenBlack Unified Hosts List (default adlist) not determined unpinned (installer fetches the master branch head of the hosts file (snapshot)) —
macvendor.db (IEEE MAC vendor database) not determined not determined (binary database downloaded from ftl.pi-hole.net with no published version identifier) —
Component Finding Severity Fix available?
Bootstrap 3.4.1 (dashboard front-end) The admin dashboard ships Bootstrap 3.4.1, which carries two cross-site-scripting flaws with no fixed release in the 3.x line, so text that reaches a dashboard page could run script in the browser of whoever is signed in to the appliance. — GHSA-VXMC-5X29-H64V, CVE-2024-6485, GHSA-Q58R-HWC8-RM9J, CVE-2025-1647 moderate No - the project pins bootstrap 3.4.1 and OSV lists no fixed version; mitigate by keeping the admin interface off untrusted networks and signing out when finished.
Base operating system The lab pins no operating-system version, and the releases the snapshot names as representative are already out of standard support: Fedora 40 ended 2025-05-13 and Alpine Linux 3.20 ended 2026-04-01, while Debian 12 Bookworm left standard support on 2026-07-11 and now depends on extended/LTS updates until 2028-06-30. posture Mitigation only - build the appliance on a release that is still in support at lab time (check endoflife.date for whichever distribution you choose) rather than the versions the snapshot names.
DNS and DHCP services on the local network The appliance answers DNS on port 53 for any client that can reach it and can be switched into serving DHCPv4 on port 67 and DHCPv6 on port 547, so a lab device plugged into a shared campus LAN can start handing out addresses and redirecting name resolution for machines that have nothing to do with the lab. posture Mitigation only - keep the appliance on an isolated lab segment or VLAN, and never enable its DHCP server on a shared network without clearing it with campus IT first.
HTTP admin interface and REST API The dashboard and API are reachable over plain HTTP on port 80 at http://pi.hole/admin/, so the admin password and the query log it displays - every domain each client on the network looked up - cross the LAN unencrypted unless the HTTPS interface on port 443 is used instead. posture Mitigation only - use the HTTPS interface, keep the device on an isolated segment, and set a strong password with 'pihole setpassword'.
Pi-hole core, FTL and web dashboard (version pinning) Nothing in the lab pins a Pi-hole version: the installer clones the repositories and resets each to whatever the newest git tag happens to be, and pulls the newest FTL binary, so two students installing a fortnight apart get different code and this check goes stale the moment upstream publishes a release. posture Mitigation only - record the installed version with 'pihole -v' at lab time and re-run this check before each term rather than trusting an earlier report.

What this means for your lab

This appliance is meant to sit on your network and answer DNS for every device on it, so treat it as a piece of network infrastructure rather than a desk gadget. Two things deserve attention before students plug one in. First, if the DHCP feature is switched on while the device is attached to a shared campus network, it will start handing out addresses to machines outside the lab and pointing them at itself for name resolution - that is the kind of incident campus IT notices, so agree an isolated segment or VLAN with them in advance and leave DHCP off on any shared network. Second, anyone who can reach the device on the network sees the admin dashboard on plain HTTP, and that dashboard lists every domain every client looked up; that is a privacy question about your students as much as a security one, so use the HTTPS interface and keep the device off open networks. The good news is that there are no default passwords to worry about: the installer generates a random admin password on a fresh install and tells you to change it with 'pihole setpassword'. The dashboard's Bootstrap library has two unpatched cross-site-scripting flaws that upstream cannot fix in that version line, which is another reason not to expose the admin page beyond the lab. Finally, nothing here is version-pinned - the installer always takes the newest Pi-hole release - so record what version each student actually installed, and re-check before you run the lab again.

Not checked

  • pihole-FTL C daemon and its vendored libraries: the binary is downloaded at whatever version is newest and the FTL repository carries no runtime dependency manifest (CMakeLists.txt and git submodules only; its package.json is openapi test tooling), so there is no registry to check its bundled C code against
  • Pi-hole core shell scripts (gravity.sh, piholeDebug.sh, the installer): no vulnerability database covers a source-only shell project; the snapshot's planned 'pi-hole / github / v6.0' lookup has no OSV ecosystem behind it
  • 22 apt, 20 rpm and 25 apk packages pulled in by the pihole-meta packages: unpinned by design - each distribution supplies whatever version its release carries, so there is no version to look up
  • pi-hole/web devDependencies (autoprefixer, eslint, eslint-plugin-compat, globals, postcss, postcss-cli, prettier, xo): version ranges rather than pins, and they are build tooling the installer never puts on the appliance
  • StevenBlack Unified Hosts List: a rolling list fetched from a master branch, with no version identifier to check
  • macvendor.db: a binary database with no published version identifier
  • Host SSH access (port 22) and the base OS image's own accounts: not installed or configured by the Pi-hole installer - they come from whichever OS image the instructor writes to the card, which this check cannot see
  • install.pi-hole.net, docs.pi-hole.net and ftl.pi-hole.net: the GitHub repositories and the raw installer script were reached this run, but these three hosts were not fetched directly

Parts

Bill of materials

Part Spec/Package Status Stock Price Source
Host single-board computer / appliance platform Raspberry Pi 4 Model B 2GB (representative); any x86-64/ARM host, RAM ≥ 512 MB, 5.0–5.1 V at 2.5–3.0 A Readily available Retail, not published $55.00 PiShop USA (also $55.00 Electromaker, $61.05 Vilros)
MicroSD flash storage card / boot drive 32 GB Class 10 UHS-I microSDHC, 11.0 × 15.0 × 1.0 mm; ≥ 4 GB usable Readily available Retail, not published $11.74 Walmart, PNY 32GB Elite (also $14.95 SanDisk Extreme, Adorama)
Host AC/DC power supply adapter 100–240 VAC in; 5.1 V DC 3 A out, USB-C captive plug Readily available Retail, not published $7.99 Micro Center (also $9.84 DigiKey, $12.95 Jameco, 5.1 V 3 A exact)
Ethernet network patch cable Cat5e/Cat6 UTP, RJ-45 (8P8C) both ends, 1–2 m Readily available Retail, not published $3.14 My Cable Mart (also $4.99 3 ft Micro Connectors)

Two notes on reading the table. Retail sellers do not publish stock counts the way an authorised distributor does, so "readily available" here means several independent sellers listed the item at a normal price on 2026-09-03, not a warehouse quantity. And the shopping results carry near-matches that are not this BOM: a Raspberry Pi Compute Module 4 2GB at $90.00 and a Raspberry Pi 4 Desktop Kit at $105.81 are different products from the Model B board, and the "Official Raspberry Pi 5 USB-C PD Power Supply 27W" at $12.00 is the Pi 5 unit, not the 5.1 V 3 A Pi 4 supply.

Substitutes

None needed. No part on this list is out of stock, obsolete, or overpriced, so no substitute was proposed or verified this run. If you do swap something, the snapshot's own latitude is your guide: any supported Linux host with at least 512 MB of RAM, any Class 10 or faster card of at least 4 GB, any regulated 5 V supply that holds above 4.8 V under load at the current your board draws, and any Cat5e or better patch cable.

Verify any substitute against its datasheet or product page before ordering.

Other dependencies

  • Fabrication: none. The snapshot states explicitly that no PCB is designed, fabricated, or assembled — the appliance is entirely commercial off-the-shelf hardware. Nothing to check, nothing to order.
  • Project repositories reached this run. The pi-hole/pi-hole, pi-hole/web, and pi-hole/FTL repositories on GitHub, and the raw installer script the lab's instructions run, all responded normally on 2026-09-03 — the download paths the lab depends on are live.
  • Installer entrypoint https://install.pi-hole.net, the documentation portal https://docs.pi-hole.net/main/prerequisites/, the post-install guide, and the ftl.pi-hole.net host: not checked. No fetch was dispatched against these three hosts this run, so treat their availability as unverified until the next check.
  • Upstream preset DNS resolvers referenced in the setup dialogue (Google 8.8.8.8/8.8.4.4, OpenDNS, Level3, Comodo, Quad9 9.9.9.9, Cloudflare 1.1.1.1): not checked — no lookup was dispatched against them.

Watch list

  • Raspberry Pi 4 Model B 2GB pricing and availability. The 2 GB Pi 4 is a maturing board in a family that has moved on to the Pi 5; the $55.00 price point held across sellers this run, but board-by-board price and stock swings are the most likely thing to move by the next check. The snapshot's high substitution latitude (Pi 3 Model B+, Pi Zero 2 W, or an x86-64 mini PC all qualify) means this is a budget risk, not a blocker.
  • Power supply variants. Official Raspberry Pi supplies come in a 5.1 V 3 A USB-C unit for the Pi 4 and a 27 W PD unit for the Pi 5, and they turn up side by side in the same search results. Order against the board you actually buy.
  • microSD card endurance, not sourcing. Cards are cheap and everywhere; the failure mode for a DNS appliance that logs continuously is write wear, so treat the high-endurance wording in the snapshot as a real requirement rather than a price-shopping opportunity.
  • The software stack, not the parts. Nothing in this lab pins a Pi-hole version, and the base OS releases the snapshot names have already passed their support dates. That is where this lab will drift first — see the Cybersecurity section above.
Snapshot What the lab depended on when it was uploaded — the baseline the readiness checks research against.

This lab deploys a dedicated network-attached DNS sinkhole and ad-blocking appliance running Pi-hole v6.0 on a Linux host platform. The appliance operates as an authoritative local caching DNS resolver and optional local DHCPv4/DHCPv6 and NTP server to block unwanted domains across an entire local area network without requiring client-side endpoint software. The system operates on standard digital logic and host computer power rails, typically running on a nominal 5.0 V DC power rail (USB-C or Micro-USB supply at 2.5 A to 5.0 A) when deployed on single-board computer (SBC) hardware such as a Raspberry Pi, or standard ATX/mains power when hosted on an x86/x64 server platform.

Bill of materials

Host Single-Board Computer / Appliance Platform

  • Identity: Single-Board Computer (SBC) or PC host platform supporting x86_64, i386, ARMv6, ARMv7, ARMv8/AArch64, or RISC-V 64-bit CPU architectures (representative hardware: Raspberry Pi 4 Model B, Raspberry Pi 3 Model B+, Raspberry Pi Zero 2 W, or equivalent x86-64 mini PC).
  • Quantity: 1
  • Footprint/package: Standalone SBC / chassis-mount computer board (representative Raspberry Pi form factor 85 mm x 56 mm).
  • Electrical constraints: Nominal 5.0 V DC supply rail (typically 5.0 V to 5.1 V DC at 2.5 A to 3.0 A minimum); processing overhead minimal; system RAM ≥ 512 MB.
  • Substitution latitude: High latitude. Any computer platform possessing a compatible 32-bit or 64-bit processor, at least 512 MB of RAM, support for a compatible Linux operating system (Debian, Ubuntu, Alpine, Fedora, CentOS Stream, Raspberry Pi OS, Armbian), and an active IP network interface is physically and electrically compatible.
  • Operated control: No.
  • Sourcing plan: retail shopping search: Raspberry Pi 4 Model B single board computer 2GB

MicroSD Flash Storage Card / Boot Drive

  • Identity: High-endurance MicroSDHC or MicroSDXC flash memory card, or host-compatible SSD storage drive. Minimum capacity 2 GB free disk space (4 GB recommended; realistically ≥ 8 GB to 32 GB to hold base Linux OS distribution and persistent query logs).
  • Quantity: 1
  • Footprint/package: MicroSD card (11.0 mm x 15.0 mm x 1.0 mm) or M.2 / 2.5-inch drive matching host SBC slot.
  • Electrical constraints: Powered from SBC internal regulated rail (typically 3.3 V DC rail on standard microSD interface).
  • Substitution latitude: Any Class 10 / UHS-I or higher flash storage card or solid-state drive matching the host hardware storage interface with ≥ 4 GB usable capacity.
  • Operated control: No.
  • Sourcing plan: retail shopping search: 32GB microSD card Class 10 UHS-I

Host AC/DC Power Supply Adapter

  • Identity: External AC-to-DC regulated wall power supply adapter with USB-C or Micro-USB captive plug (matched to the target host SBC power receptacle).
  • Quantity: 1
  • Footprint/package: Wall-mount or inline AC adapter with attached cable terminated in a male USB-C or Micro-USB connector.
  • Electrical constraints: Input 100-240 VAC, 50/60 Hz; Output 5.0 V to 5.1 V DC regulated, current rating ≥ 2.5 A (12.5 W) to 3.0 A (15.3 W) (up to 5.0 A for Raspberry Pi 5). Must maintain output voltage above 4.8 V DC under transient processor loads to prevent brownouts.
  • Substitution latitude: Any well-regulated 5 V DC power source meeting the voltage tolerance and peak current demands of the selected host SBC.
  • Operated control: No.
  • Sourcing plan: retail shopping search: official Raspberry Pi 5.1V 3A USB-C power supply adapter

Ethernet Network Patch Cable

  • Identity: Category 5e or Category 6 UTP RJ-45 Ethernet network patch cable.
  • Quantity: 1 (optional if SBC connects via integrated Wi-Fi, but recommended for network appliance reliability).
  • Footprint/package: Standard RJ-45 (8P8C) male connector on both ends, 1 meter to 2 meters length.
  • Electrical constraints: Passive twisted-pair cable rated for 100BASE-TX or 1000BASE-T Ethernet signaling.
  • Substitution latitude: Any standard Cat5e, Cat6, or Cat6a RJ-45 patch cable, or an active 802.11 b/g/n/ac wireless link.
  • Operated control: No.
  • Sourcing plan: retail shopping search: Cat6 RJ45 ethernet patch cable 1m

Software and network dependencies

Pi-hole Core Application and Management CLI

  • Name: pi-hole (Core administration and automation scripts, including gravity.sh, piholeDebug.sh, piholeLogFlush.sh)
  • Source: repository URL https://github.com/pi-hole/pi-hole.git
  • Version: v6.0
  • Where the version came from: stated in documentation (architecture and configuration definitions target v6.0; installer script clones master and dynamically resets to latest git tag via git describe --abbrev=0 --tags).
  • Pinning: Unpinned in install script (pihole_basic-install.sh, make_repo and update_repo functions).
  • Manifest location: pihole_basic-install.sh (installed to /opt/pihole, /usr/local/bin/pihole, and /etc/.pihole).
  • Check plan: vulnerability lookup: pi-hole / github / v6.0

pihole-FTL Core Engine Binary

  • Name: pihole-FTL (compiled C daemon providing DNS sinkhole resolver, DHCP server, and embedded webserver/API)
  • Source: https://github.com/pi-hole/ftl/releases/latest/download/ or https://ftl.pi-hole.net/${ftlBranch}/ (available for amd64, 386, armv6, armv7, arm64, riscv64 architectures).
  • Version: not stated (installer dynamically pulls the latest binary release matching the host CPU architecture).
  • Where the version came from: not stated
  • Pinning: Unpinned in install script (pihole_basic-install.sh downloads from latest release path).
  • Manifest location: pihole_basic-install.sh (installed binary location: /usr/bin/pihole-FTL).
  • Check plan: not checkable: version unpinned, fetches dynamic latest binary.

Pi-hole Web Dashboard Interface

  • Name: web (HTML/JS administrative dashboard and management GUI)
  • Source: repository URL https://github.com/pi-hole/web.git
  • Version: not stated (installer clones repository and resets to latest available tag via git describe --abbrev=0 --tags).
  • Where the version came from: not stated
  • Pinning: Unpinned in install script (pihole_basic-install.sh).
  • Manifest location: pihole_basic-install.sh (installed to /var/www/html/admin).
  • Check plan: not checkable: version unpinned, dynamically resets to latest release tag.

Debian / Ubuntu Meta-Package

  • Name: pihole-meta (Debian/Ubuntu control meta-package)
  • Source: Dynamically assembled and built via dpkg-deb during installer execution.
  • Version: 0.7
  • Where the version came from: pinned in pihole_basic-install.sh (PIHOLE_META_VERSION_APT=0.7).
  • Pinning: The meta-package wrapper version 0.7 is pinned, but its 22 package dependencies are unpinned: awk, bash-completion, binutils, ca-certificates, cron | cron-daemon, curl, dialog, bind9-dnsutils | dnsutils, dns-root-data, git, grep, iproute2, iputils-ping, jq, libcap2, libcap2-bin, logrotate, lshw, procps, psmisc, sudo, unzip.
  • Manifest location: pihole_basic-install.sh (PIHOLE_META_PACKAGE_CONTROL_APT block).
  • Check plan: support-status lookup: Debian 12

RPM / Fedora / CentOS Stream Meta-Package

  • Name: pihole-meta (RPM control spec package)
  • Source: Dynamically assembled and built via rpmbuild during installer execution.
  • Version: 0.4, Release: 1
  • Where the version came from: pinned in pihole_basic-install.sh (PIHOLE_META_PACKAGE_CONTROL_RPM).
  • Pinning: The meta-package version 0.4-1 is pinned, but its 20 package dependencies are unpinned: bash-completion, bind-utils, binutils, ca-certificates, chkconfig, cronie, curl, dialog, findutils, gawk, git, grep, iproute, jq, libcap, logrotate, lshw, procps-ng, psmisc, sudo, unzip.
  • Manifest location: pihole_basic-install.sh (PIHOLE_META_PACKAGE_CONTROL_RPM block).
  • Check plan: support-status lookup: Fedora 40

Alpine Linux Virtual Meta-Package

  • Name: pihole-meta (Alpine Linux apk virtual package)
  • Source: Alpine Linux official package repositories via apk add.
  • Version: 0.3
  • Where the version came from: pinned in pihole_basic-install.sh (PIHOLE_META_VERSION_APK=0.3).
  • Pinning: The tracking variable is pinned to 0.3, but all 25 individual package dependencies are unpinned in PIHOLE_META_DEPS_APK: bash, bash-completion, bind-tools, binutils, coreutils, cronie, curl, dialog, gawk, git, grep, iproute2-minimal, iproute2-ss, jq, libcap, logrotate, lscpu, lshw, ncurses, procps-ng, psmisc, shadow, sudo, tzdata, unzip.
  • Manifest location: pihole_basic-install.sh (PIHOLE_META_DEPS_APK array).
  • Check plan: support-status lookup: Alpine Linux 3.20

Host Operating System Distributions

  • Name: Linux OS Distribution (Alpine Linux, Armbian OS, Debian, CentOS Stream, Fedora, Raspberry Pi OS, Ubuntu)
  • Source: Respective official Linux distribution release images.
  • Version: not stated
  • Where the version came from: not stated
  • Pinning: Unpinned.
  • Manifest location: pihole_prerequisites.html (Supported Operating Systems section).
  • Check plan: support-status lookup: Raspberry Pi OS Bookworm

Default Adlist / Domain Sinkhole Database

  • Name: StevenBlack Unified Hosts List
  • Source: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
  • Version: not stated (fetches master branch head).
  • Where the version came from: not stated
  • Pinning: Unpinned in pihole_basic-install.sh.
  • Manifest location: pihole_basic-install.sh (adlistFile="/etc/pihole/adlists.list").
  • Check plan: not checkable: rolling unpinned domain list.

IEEE MAC Address Vendor Database

  • Name: macvendor.db (hardware vendor lookup database for client identification)
  • Source: https://ftl.pi-hole.net/macvendor.db
  • Version: not stated
  • Where the version came from: not stated
  • Pinning: Unpinned in pihole_basic-install.sh.
  • Manifest location: pihole_basic-install.sh (/etc/pihole/macvendor.db).
  • Check plan: not checkable: binary database file with no published version identifiers.

Network exposure:

  • Network attachment: Device joins the local area network over wired Ethernet or Wi-Fi; requires a static IPv4 address, static IPv6 address (preferring ULA over GUA), or a static DHCP MAC reservation on the local router.
  • Listening services and port exposure (managed by pihole-FTL):
    • Port 53 TCP and UDP: Inbound DNS server resolver. The installer explicitly checks for conflicts and disables systemd-resolved DNSStubListener if present to bind to port 53.
    • Port 80 TCP: Inbound HTTP Admin Web Interface and API (falls back to port 8080 if 80 is occupied).
    • Port 443 TCP: Inbound HTTPS Admin Web Interface (falls back to port 8443 if 443 is occupied).
    • Port 67 UDP: Inbound DHCPv4 server (optional, when DHCP server mode is enabled).
    • Port 547 UDP: Inbound DHCPv6 server (optional, when DHCPv6 server mode is enabled).
    • Port 123 UDP: Inbound NTP network time protocol service (optional feature).
  • Documented credentials: No default hardcoded passwords exist in the sources; pihole-FTL generates a randomized administrative web interface password during fresh installation, or the user is instructed to set one via the command-line interface (pihole -a -p).
  • Administrative interfaces: Documentation instructs the operator to configure local network router DHCP DNS settings to forward client traffic to the Pi-hole IP, or manually assign the Pi-hole IP on clients. The web dashboard is exposed at http://pi.hole/admin/ or http://[IP_ADDRESS]/admin/. REST API documentation is accessible at http://pi.hole/api/docs. SSH remote access is not configured by the installation script, though standard headless host administration relies on SSH (port 22).

External downloads and URLs

Fabrication

No custom printed circuit board (PCB) is designed, fabricated, or assembled in this lab. The appliance is deployed entirely on commercial off-the-shelf (COTS) single-board computers or standard computer server hardware. No PCB layer count, board dimensions, or manufacturing gerber files apply.