Pi-hole in Container Manager on a Synology NAS

Last updated on 20 February 2025

What is Pi-hole?

If you are looking to get advertising and tracking blocked across all the devices on your network a Pi-hole will have you covered. It’s a locally hosted Domain Name Server and uses block lists to stop adverts.

This guide will get you set up with Pi-hole and cover some basic initial settings, I recommend checking out the documentation for all the various features available.

Host vs Macvlan vs Bridge Network Modes

Host:

Host mode uses your NAS underlying network to run the containers network services, so it will be reliant on the NAS not using any of the required ports for the container. However, this makes it easy to set up, but you need to make sure no other service is using the required ports. All your clients will appear correctly as independent devices and stats.

Macvlan:

This gives you the benefit of Pi-hole having its own IP address on your network, all clients appear with their real IP addresses allowing you to assign specific rules and give you some nicer stats. However, one downside is that your NAS will not be able to use Pi-hole for DNS, due to the additional security features of Macvlan and its communication with its host. This is generally not an issue unless you wanted to use your Ad blocking with Tailscale.

Please note you will not be able to use Macvlan with a Bonded network connection e.g. ‘Bond0’. You will need to remove the bond in order to use this method.

Bridge Mode:

The main benefit of Bridge Mode will be the ease of setup however you will find that all clients on your network will appear under the same IP as the Bridge 172.20.0.1. This won’t impact ad blocking, but it will mean you can apply device specific rules etc.

Let’s Begin

In order for you to successfully use this guide you will need to check that your Router allows you to change your network DNS servers, this is usually found in the DHCP settings.

Please follow the initial guide below to get a restricted Docker user set up, then come back here.

• Setting up a restricted Docker user

Folder Setup

Let’s start by getting some folders set up for the container to use. Open up File Station create the following.

/docker/projects/pihole-compose
/docker/pihole

Container Manager

Next we are going to set up a ‘Project’ in Container Manager. Open up Container Manager and click on Project then on the right-hand side click ‘Create’.

In the next screen we will set up our General Settings.

In the next screen we will set up our General Settings, enter the following:

Next we are going to drop in our docker compose configuration. You now need to decide if you are going to go with Macvlan or Bridge Mode and copy the appropriate compose from below and paste it into line ‘1’ just like the screenshot.

What on earth is a Docker Compose?
Docker Compose allows us to define how Docker should set up one or more containers within a single configuration file. This file is yaml formatted and Container Manager uses the Projects feature to manage them.

Host

services:
  pihole:
    image: pihole/pihole:latest
    container_name: pihole-host
    cap_add:
      - CAP_NET_RAW
      - CAP_NET_BIND_SERVICE
      - CAP_CHOWN
      - CAP_NET_ADMIN
      - CAP_SYS_NICE
      - CAP_SYS_TIME
    environment:
      - PIHOLE_UID=1234 #CHANGE_TO_YOUR_UID
      - PIHOLE_GID=65432 #CHANGE_TO_YOUR_GID
      - TZ=Europe/London #CHANGE_TO_YOUR_TZ
      - FTLCONF_webserver_api_password=YOURPASSWORD
      - FTLCONF_webserver_port=8000
      - DNSMASQ_LISTENING=local
      - DNSMASQ_USER=pihole
    volumes:
      - /volume1/docker/pihole:/etc/pihole
    network_mode: host
    labels:
      - com.centurylinklabs.watchtower.enable=false
    restart: unless-stopped

Macvlan

services:
  pihole:
    image: pihole/pihole:latest
    container_name: pihole-macvlan
    cap_add:
      - CAP_NET_RAW
      - CAP_NET_BIND_SERVICE
      - CAP_CHOWN
      - CAP_NET_ADMIN
      - CAP_SYS_NICE
      - CAP_SYS_TIME
    environment:
      - PIHOLE_UID=1234 #CHANGE_TO_YOUR_UID
      - PIHOLE_GID=65432 #CHANGE_TO_YOUR_GID
      - TZ=Europe/London #CHANGE_TO_YOUR_TZ
      - FTLCONF_webserver_api_password=YOURPASSWORD
      - DNSMASQ_LISTENING=local
      - DNSMASQ_USER=pihole
    volumes:
      - /volume1/docker/pihole:/etc/pihole
    networks:
      macvlan:
        ipv4_address: 192.168.0.129
    labels:
      - com.centurylinklabs.watchtower.enable=false
    restart: always

networks:
  macvlan:
    name: macvlan
    driver: macvlan
    driver_opts:
      parent: eth0
    ipam:
      config:
        - subnet: "192.168.0.0/24"
          ip_range: "192.168.0.254/24"
          gateway: "192.168.0.1"

Bridge Mode

services:
  pihole:
    image: pihole/pihole:latest
    container_name: pihole-bridge
    cap_add:
      - CAP_NET_RAW
      - CAP_NET_BIND_SERVICE
      - CAP_CHOWN
      - CAP_NET_ADMIN
      - CAP_SYS_NICE
      - CAP_SYS_TIME
    environment:
      - PIHOLE_UID=1234 #CHANGE_TO_YOUR_UID
      - PIHOLE_GID=65432 #CHANGE_TO_YOUR_GID
      - TZ=Europe/London #CHANGE_TO_YOUR_TZ
      - FTLCONF_webserver_api_password=YOURPASSWORD
      - FTLCONF_dns_listeningMode=all
      - DNSMASQ_USER=pihole
    volumes:
      - /volume1/docker/pihole:/etc/pihole
    ports:
      - 53:53/udp
      - 8000:80/tcp
      - 8443:443/tcp
    labels:
      - com.centurylinklabs.watchtower.enable=false
    restart: unless-stopped

We are now changing some settings this applies to all versions of the YAML above.

OK you now need to jump to an appropriate section of the guide for the network mode you have used. Use the links below.

• Macvlan (Settings Amendments for the Macvlan)
• Host (Settings Amendments for the Host Mode)
• Bridge (Web Portal Settings)

Settings Amendments for the Macvlan

OK we now need to make some further edits to the compose and sort out DNS for DSM

External DNS for DSM

Containers on a Macvlan cannot be accessed by the host they reside on (without network changes under the hood), this mean DSM cannot use Pi-hole for its own DNS requests. It’s better to put DSM on an external DNS provider to avoid it having any issues connecting to the Internet if your Pi-hole is down.

Go into the DSM Control Panel > Network and then in the ‘Manually configure DNS server’ set two good quality DNS providers such as Quad9 9.9.9.9 and Cloudflare1.1.1.1

Now you can make some edits to the compose information before moving on

You can now jump ahead to the Web portal settings

Settings Amendments for the Host Mode

In earlier versions of the Pi-hole docker container you amended the port the Web UI was available on with WEB_PORT, this doesn’t exist in new versions, and it is expected for you to edit the config file. However, there is a new variable which is not in the new installation documentation.

Web portal settings

You do not need to enable anything on the ‘Web portal settings’ screen click ‘Next’ again.

On the final screen click ‘Done’ which will begin the download of the container images and once downloaded they will be launched!

The image will now be downloaded and extracted. You should see ‘Code 0’ when it has finished.

You will now see your Pi-hole running and should have a green status on the left-hand side.

Accessing the Web UI

The web interface will now be available via the following methods. If you use the https address you will need to accept the self-signed certificate warning in your browser.

You can access the UI with the password you specified in the compose.

Update your Router DNS

Now you need to add the appropriate IP address to your router depending on which method you used to set up Pi-hole

Bridge or Host = Use your NAS IP address.

Macvlan = The address you chose for the container on the line ‘ipv4_address:’

It can take some time for all of your devices to move over the new DNS settings so be patient, and you will gradually start to see your stats begin to start.

Also note as we are not using Pi-hole as the DHCP server you will not be able to see the names of the devices in the statistics just their IP addresses.

That’s it!

Looking for some help, join our Discord community

If you are struggling with any steps in the guides or looking to branch out into other containers join our Discord community!

Buy me a beverage!

If you have found my site useful please consider pinging me a tip as it helps cover the cost of running things or just lets me stay hydrated. Plus 10% goes to the devs of the apps I do guides for every year.