Build a FREE Cloud Pi-hole Firewall: Block Ads, Malware, and Trackers Everywhere

What You Will Build

The traffic flow is straightforward:

Phone, tablet, or computer
        ↓ encrypted DNS over HTTPS or TLS
Cloudflare Gateway DNS location
        ↓ security and content policies
Allowed domain → normal DNS response
Blocked domain → refused or 0.0.0.0 response

Because filtering occurs during DNS resolution, it can stop a connection before the browser or app reaches the unwanted domain. Cloudflare Gateway DNS policies apply across protocols and applications, rather than being limited to a single browser extension.

What This Setup Can and Cannot Do

Calling this a “cloud Pi-hole firewall” makes the idea easy to understand, but the technical distinction matters: this is a DNS filtering layer, not a complete network firewall.

It can:

• Block domains categorized as malware, phishing, spyware, scams, botnets, or command-and-control infrastructure.
• Filter many advertising and tracking domains across browsers and apps.
• Apply family, study, or work rules to categories such as social networks, gambling, and adult content.
• Use encrypted DNS on Wi-Fi and mobile networks.
• Show DNS activity logs so you can identify blocked or suspicious domains.

It cannot:

• Hide or change your public IP address.
• Inspect the full URL or page path in DNS-only mode.
• Reliably remove YouTube ads or other first-party ads delivered from the same domain as the content.
• Stop an app that connects directly to an IP address or forces a different encrypted DNS resolver.
• Replace endpoint security, a VPN, or a properly configured network firewall.

What You Need

• A Cloudflare account.
• A free Cloudflare Zero Trust organization.
• Administrator access to the devices you want to configure.
• About 15 to 20 minutes for the first setup.

Cloudflare currently lists its Zero Trust Free plan at $0 for teams of up to 50 users. The free plan includes up to 24 hours of standard Gateway log retention, which is enough for basic troubleshooting and home use. Pricing and limits can change, so confirm them on Cloudflare’s plan page before deploying this for a larger group.

Step 1: Create a Cloudflare Gateway DNS Location

Sign in to Cloudflare, open Zero Trust, choose a team name, and select the Free plan. Cloudflare may request billing information during onboarding even when the selected plan costs $0.

In the Cloudflare Zero Trust dashboard, go to:

Networks → Resolvers & Proxies → DNS locations

Select Add a location and give it a recognizable name such as Personal Devices. Cloudflare will assign several DNS endpoints to the location, including a unique DNS-over-HTTPS URL and DNS-over-TLS hostname.

The location-specific endpoints normally follow this pattern:

DoH: https://YOUR-SUBDOMAIN.cloudflare-gateway.com/dns-query
DoT: YOUR-SUBDOMAIN.cloudflare-gateway.com

Copy both values. The unique subdomain associates incoming DNS requests with your Gateway location and its policies, even when a device moves between networks.

Step 2: Block Malware and Other Security Threats

Go to:

Traffic policies → Firewall policies → DNS

Create a DNS policy called Block security threats. Choose Security Categories as the selector, select the threat categories you want to stop, and set the action to Block.

A sensible starting group includes:

• Malware
• Phishing
• Spyware
• Scam
• Command-and-control or botnet domains
• Domain-generation algorithms
• DNS tunneling

Cloudflare also provides broader risk categories such as newly registered or newly seen domains. Those can improve protection, but they can also block legitimate new websites. Start with high-confidence threat categories, review your DNS logs, and add aggressive categories only when you are prepared to maintain exceptions.

Step 3: Block Advertising and Tracking Domains

Create a second DNS policy. Choose Content Categories, select the available advertising or tracking categories you want to filter, and set the action to Block.

Policy order matters because Gateway uses first-match evaluation. Put narrow allow rules above broad category blocks. If a trusted login, payment form, newsletter, or embedded service stops working, check the DNS logs to find the affected hostname. Confirm that it is legitimate, then add a specific allow rule instead of disabling the entire advertising policy.

This category-based approach is convenient, but it is less customizable than maintaining your own Pi-hole blocklists. The tradeoff is that Cloudflare manages the domain intelligence and hosts the filtering infrastructure for you.

Step 4: Schedule Distraction or Family Filters

Gateway can activate a DNS policy only during selected hours. For example, you could block social networks during weekday work sessions or restrict gambling and adult-content categories during family downtime.

1. Create or edit a DNS policy.
2. Open Apply durations and schedules.
3. Enable Policy schedule.
4. Choose a preset or create a recurring custom schedule.
5. Confirm the time zone and save the policy.

Remember that DNS filtering controls entire domains. It cannot allow a useful page on a website while blocking a distracting page hosted on that same domain.

Step 5: Connect Your Devices with Encrypted DNS

You can now point each device to the Gateway location without opening an inbound port or running a traditional VPN tunnel.

Android: Use Private DNS

On recent Android versions, open the network settings and locate Private DNS. Choose Private DNS provider hostname, enter your location-specific DoT hostname, and save it.

The menu name varies slightly by phone manufacturer, but it is commonly found under:

Settings → Network & Internet → Private DNS

Android will then send DNS through the encrypted DoT endpoint on Wi-Fi and mobile data. A network that blocks DoT port 853 may prevent this connection from working.

iPhone, iPad, and Mac: Install Your Own DNS Profile

Apple devices can use a configuration profile containing your location-specific DoH URL. Set the DNS protocol to HTTPS and use:

https://YOUR-SUBDOMAIN.cloudflare-gateway.com/dns-query

A correctly configured DNS profile can apply across Wi-Fi and cellular connections. Only install a profile that you generated yourself, inspected, and trust. Never download an unknown DNS profile simply because someone claims it blocks ads.

Windows 11: Register the DoH Template

Windows 11 needs the IP addresses associated with your Gateway hostname and the matching DoH template. First resolve the location hostname:

nslookup -type=A YOUR-SUBDOMAIN.cloudflare-gateway.com
nslookup -type=AAAA YOUR-SUBDOMAIN.cloudflare-gateway.com

Then register each returned address in an elevated PowerShell window:

Add-DnsClientDohServerAddress `
  -ServerAddress <IP_ADDRESS> `
  -DohTemplate "https://YOUR-SUBDOMAIN.cloudflare-gateway.com/dns-query" `
  -AllowFallbackToUdp $False `
  -AutoUpgrade $False

Set the registered addresses as the DNS servers for your active network adapter and enable encrypted DNS. Replace every placeholder with the values from your own Gateway location.

Browser-Only Fallback

Chrome, Edge, Brave, and Firefox can use a custom DoH provider URL. This only protects DNS requests made by that browser, but it is useful when you cannot change the operating system settings.

Use your location-specific Gateway endpoint, not Cloudflare’s generic 1.1.1.1 resolver. The generic resolver can encrypt DNS, but it does not automatically apply the policies in your Zero Trust account.

Safari does not currently expose a custom DoH URL field. Use an Apple DNS profile or Cloudflare’s device client if you need Gateway filtering there.

Step 6: Test the DNS Firewall

Never assume the configuration works. Test it before relying on it.

Cloudflare provides harmless test domains for its security categories. To test the Malware category, run:

nslookup malware.testcategory.com

If the Malware policy matches, Gateway will return a block response. With the Gateway block page disabled, the response is typically 0.0.0.0. A different response may be used when the block page is enabled.

Next, open:

Insights → Logs → DNS

Find the test query and confirm that it matched the intended policy. Allow roughly a minute for new policy changes to propagate, and clear the device or browser DNS cache if an old result remains.

What to Check If a Blocked Site Still Loads

If a test domain or blocked category still resolves, the device is usually bypassing your Gateway location. Check these common causes:

• Another browser resolver: Chrome, Edge, Brave, or Firefox may have Secure DNS configured to use a different provider.
• A secondary DNS server: remove fallback resolvers that are not part of your Gateway configuration.
• A VPN or privacy relay: third-party VPNs, iCloud Private Relay, and similar services can interfere with Gateway DNS filtering.
• Cached DNS: clear the operating system and browser DNS caches, then repeat the test.
• Hard-coded DNS: some devices and apps send requests directly to public resolvers. Preventing this on a home network requires router or firewall enforcement.
• Direct IP connections: DNS policies cannot block a connection that never performs a DNS lookup.

Cloud Gateway vs. a Local Pi-hole

Gateway is the better fit when you want simple protection that follows devices outside the home. Pi-hole remains the stronger option when local control, custom blocklists, and network ownership matter more than convenience.

Privacy and Logging Considerations

Encrypted DNS prevents the local network from casually reading or modifying plaintext DNS requests, but it does not make DNS activity anonymous. Cloudflare processes the queries, and administrators of your Zero Trust account can review Gateway DNS logs.

The free plan currently retains DNS logs for up to 24 hours. Consider who controls the Cloudflare account before installing its endpoint on another person’s device. Family filtering should be transparent, especially for adults.

Final Thoughts

A free Cloudflare Gateway DNS location is a practical way to add encrypted DNS filtering to phones, tablets, and computers without purchasing hardware or keeping a home server online. It can stop known malicious domains early, reduce a meaningful amount of advertising and tracking traffic, enforce scheduled content rules, and give you usable logs when something behaves unexpectedly.

Just keep the promise accurate. This is a strong cloud DNS shield, not an invisible VPN or a complete replacement for endpoint and network security.

After enabling it, visit ShowMyIP.com to confirm your current public IP address. It should remain unchanged because the setup filters DNS rather than tunneling your connection.

Official Cloudflare References

• Create and configure DNS locations (opens in a new tab)
• Configure DNS over HTTPS (opens in a new tab)
• Configure DNS over TLS (opens in a new tab)
• Cloudflare Gateway DNS policies (opens in a new tab)
• Timed DNS policies (opens in a new tab)
• Test Gateway DNS filtering (opens in a new tab)
• Cloudflare Zero Trust plans (opens in a new tab)

Related tools & reading

• DNS Lookup — see what a domain resolves to from outside your filtered device.
• DNS Propagation Checker — confirm a record has rolled out to resolvers worldwide.
• Best DNS Servers in 2026 — Cloudflare, Google, Quad9, OpenDNS and AdGuard compared on speed, privacy and filtering.
• How to Flush DNS Cache — the exact commands for Windows, macOS, Linux and each browser.
• How to Hide Your IP Address — what DNS filtering cannot do, and the options that can.
• How DNS Works — the resolver, root, TLD and authoritative lookup flow this guide filters.
• Back to the Learning Center