Using Pi-hole on the Go with WireGuard

Your own Pi-hole reliably filters ads and trackers, but only at home. This article shows how you can use Pi-hole on the go too: with FritzBox WireGuard and automatic VPN activation on iOS as soon as you leave the home network.

Examples refer to the FritzBox (Fritz!OS 7.50+) and iOS. Other WireGuard-capable routers and mobile clients work analogously.

Prerequisite: a working Pi-hole setup as described in the previous articles of the series.

Overview

#

flowchart TD
    A["On the go
(mobile / foreign WiFi)"] --> B[iOS WireGuard App]
    B --> C[FritzBox WireGuard VPN]
    C --> D["🏠 Pi-hole"]

Setting up FritzBox WireGuard

#

Requirements

#

• FritzBox running Fritz!OS 7.50 or newer
• MyFRITZ! account for DynDNS (or your own domain)
• Access to the FritzBox interface

Creating the VPN connection

#

1. Open the FritzBox interface: http://fritz.box
2. Navigate to Internet → Permit Access → VPN (WireGuard)
3. Click Add VPN Connection
4. Choose Connect a Single Device
5. Pick a name (e.g. iPhone)
6. Click Finish

The FritzBox automatically generates:

• WireGuard key pair
• Configuration file
• QR code for the mobile app

Exporting the configuration

#

The generated configuration already contains everything needed. For the iOS app, you can either scan the QR code or export the configuration file.

Important: the configuration contains private keys; store it safely and don’t share it.

Setting up iOS WireGuard

#

Install the app

#

Install the official WireGuard app from the App Store.

Add a tunnel

#

1. Open the WireGuard app
2. Add a tunnel → Create from QR code
3. Scan the QR code from the FritzBox interface
4. Pick a name (e.g. FritzBox Home)
5. Save

DNS settings are pulled from the FritzBox automatically; Pi-hole is already configured there as the local DNS server.

Auto-VPN When Leaving the Home Network

#

The WireGuard app supports on-demand activation natively, no shortcuts needed.

Enable on-demand

#

1. Open the WireGuard app
2. Activate onDemand for your tunnel and tap Edit
3. Scroll down to On-Demand Activation
4. Enable Cellular
5. Enable Wi-Fi

Configure Wi-Fi exceptions

#

Under Wi-Fi → Except for these SSIDs:

1. Tap Add SSID
2. Enter your home network’s name (exactly as in the Wi-Fi settings)
3. Save

The logic:

• At home (SSID match): VPN disabled, direct access to Pi-hole
• On foreign Wi-Fi: VPN enabled, Pi-hole via VPN
• On cellular: VPN enabled, Pi-hole via VPN

Verifying the VPN Connection

#

1. Disable Wi-Fi (use cellular)
2. Open the WireGuard app, the tunnel should activate automatically
3. Open https://pi-hole-primary.fritz.box in Safari
4. The Pi-hole dashboard should be reachable

Bonus: Setting up a Secondary Pi-hole

#

For high availability, you can add a second Pi-hole. Thanks to Ansible, this is just an inventory change.

Extending the inventory: hosts.yml

#

The complete project is also available here:

This tutorial is based on Version 1.0.0 .

---
all:
  vars:
    ansible_python_interpreter: /usr/bin/python3
  children:
    podmen:
      children:
        piholes:
          hosts:
            pi-hole-primary:
              ansible_host: pi-hole-primary.fritz.box
            pi-hole-secondary:                          # NEW
              ansible_host: pi-hole-secondary.fritz.box # NEW

Host-specific variables

#

Use separate host_vars for different update times:

host_vars/pi-hole-primary.yml:

---
pihole_fqdn: pi-hole-primary.fritz.box
pihole_autoupdate_time: "03:00"

host_vars/pi-hole-secondary.yml:

---
pihole_fqdn: pi-hole-secondary.fritz.box
pihole_autoupdate_time: "04:30"

The staggered updates ensure that at least one Pi-hole is always available.

Running the playbook

#

ansible-playbook play.yml

Ansible picks up the new host and configures it identically to the primary.

FritzBox DNS settings

#

You can now also enter the secondary Pi-hole’s IP address as an additional local DNS server in the FritzBox. If the primary fails, the FritzBox falls back to the secondary automatically.

Conclusion

#

With FritzBox WireGuard and the on-demand feature of the iOS WireGuard app, Pi-hole is available on the go too:

• Automatic activation when leaving the home network
• Ads and trackers filtered on foreign Wi-Fi and cellular as well
• Simple setup without extra servers or complicated configuration

The optional secondary Pi-hole adds resilience, and thanks to Ansible the setup is just an inventory change.

Acknowledgments

#

• WireGuard - fast, modern VPN protocol
• Pi-hole - DNS-based ad and tracker filter
• Ansible - automation and configuration management

Own Roles and Playbooks

#

• Complete tutorial playbook: Codeberg