Building a Private VPN Server with WireGuard and Pi-hole

Part 3: Building a Private VPN Server with WireGuard and Pi-hole

Creating your own private VPN server gives you total control over your security, privacy, and DNS traffic. By combining WireGuard (for fast encryption) with Pi-hole (for DNS filtering and ad blocking), you can protect every device connected to your network — without relying on commercial VPN services.

1. Why Use WireGuard

WireGuard is a modern, lightweight VPN protocol that uses state-of-the-art cryptography and outperforms older protocols like OpenVPN and IPSec. It is ideal for private servers and embedded systems.

Low latency and high throughput.

Minimal attack surface (only a few thousand lines of code).

Integrated with Linux kernel ≥5.6 for maximum performance.

2. Setting Up a Secure VPS

1.	Choose a Debian or Ubuntu VPS from a trusted provider (avoid free hosts for sensitive data).
2.	Update packages: apt update && apt upgrade -y
3.	Install security tools: apt install fail2ban ufw unattended-upgrades
4.	Enable the firewall: ufw default deny incoming && ufw default allow outgoing
5.	Allow SSH and WireGuard: ufw allow 22/tcp && ufw allow 51820/udp

3. Installing WireGuard

1.	apt install wireguard
2.	Generate keys: wg genkey \| tee /etc/wireguard/privatekey \| wg pubkey > /etc/wireguard/publickey
3.	Create configuration file: /etc/wireguard/wg0.conf
4.	Insert the following:

[Interface]
Address = 10.66.66.1/24
ListenPort = 51820
PrivateKey = (your private key)
PostUp = ufw route allow in on wg0 out on eth0
PostDown = ufw route delete allow in on wg0 out on eth0

4. Configuring the Client Device

Create a WireGuard client configuration and add it to your phone or desktop app.

[Interface]
PrivateKey = (client private key)
Address = 10.66.66.2/24
DNS = 10.66.66.1

[Peer]
PublicKey = (server public key)
Endpoint = yourserverip:51820
AllowedIPs = 0.0.0.0/0, ::/0

5. Installing Pi-hole for DNS Filtering

1.	Install Pi-hole: curl -sSL https://install.pi-hole.net \| bash
2.	Choose your network interface as wg0.
3.	Set upstream DNS to Cloudflare (1.1.1.1) or Quad9 (9.9.9.9).
4.	Set the admin password: pihole -a -p
5.	Access the web UI at http://10.66.66.1/admin

6. Integrating WireGuard and Pi-hole

Edit /etc/wireguard/wg0.conf and add DNS = 10.66.66.1 under each peer.

Restart both services:
systemctl restart wg-quick@wg0 && systemctl restart pihole-FTL

Confirm DNS queries are routed securely through your VPN by running dig @10.66.66.1 example.com.

7. Hardening the VPN Server

Enable ufw logging and limit ICMP requests.

Use fail2ban to block repeated connection attempts.

Run chmod 600 on private key files.

Add Automatic Security Updates: dpkg-reconfigure --priority=low unattended-upgrades

8. Optional: Add DNS over HTTPS (DoH)

Install cloudflared or dnscrypt-proxy on the same VPS.

Set Pi-hole upstream DNS to 127.0.0.1#5053 or 127.0.0.1:53 depending on the proxy used.

This ensures all queries stay encrypted from your device to the DNS resolver.

9. Verify and Test

Run wg show to confirm peer connection status.

Visit ipleak.net to check your public IP and DNS servers.

Use pihole -t to monitor DNS requests in real time.

10. Maintenance and Monitoring

Backup configs in /etc/wireguard and /etc/pihole.

Regularly rotate WireGuard keys.

Use logrotate to manage log file size.

Monitor uptime with UptimeRobot or similar.

Conclusion

A self-hosted WireGuard + Pi-hole setup provides full control over VPN routing and DNS privacy. With lightweight encryption, network-level ad blocking, and DNS-over-HTTPS integration, your private VPN can outperform many commercial services in speed and security. This system makes your data flow invisible to third parties while maintaining complete administrative visibility over your own traffic.