Pi-hole & Unbound in Container Manager on a Synology NAS

Last updated on 27 February 2025

What is Pi-hole?

If you are looking to get advertising and tracking blocked across all the devices on your network a Pi-hole will have you covered. It’s a locally hosted Domain Name Server and uses block lists to stop adverts.

This guide will get you set up with Pi-hole and cover some basic initial settings, I recommend checking out the documentation for all the various features available.

Pi-hole GitHub

What is Unbound (Optional)

Unbound is a validating, recursive, caching DNS resolver. Rather than using an upstream DNS provider such as Google or Cloudflare who will look up the IP addresses for domain names you visit Unbound does this for you. It queries root servers for the address for a website. For example when you visited this site its actually on the server 213.186.33.50. This adds a layer of privacy in your web browsing as you are not relying on a third party with this information.

Unbound GitHub

Host vs Bridge vs Macvlan Network Modes

You need to decide which mode of Networking you want to use, I have outlined the key points below in general order of preference. (Unbound will be on a bridge which has no impact on your choice)

Host:

Host mode uses your NAS underlying network to run the containers network services, so it will be reliant on the NAS not using any of the required ports for the container. However, this makes it easy to set up, but you need to make sure no other service is using the required ports. All your clients will appear correctly as independent devices and stats.

Bridge Mode:

The main benefit of Bridge Mode will be the ease of setup however you will find that all clients on your network will appear under the same IP as the Bridge 172.20.0.1. This won’t impact ad blocking, but it will mean you can apply device specific rules etc.

Macvlan:

This gives you the benefit of Pi-hole having its own IP address on your network, all clients appear with their real IP addresses allowing you to assign specific rules and give you some nicer stats. However, one downside is that your NAS will not be able to use Pi-hole for DNS, due to the additional security features of Macvlan and its communication with its host. This is generally not an issue unless you wanted to use your Ad blocking with Tailscale.

Please note you will not be able to use Macvlan with a Bonded network connection e.g. ‘Bond0’. You will need to remove the bond in order to use this method.

Let’s Begin

In order for you to successfully use this guide you will need to check that your Router allows you to change your network DNS servers, this is usually found in the DHCP settings.

Please follow the initial guide below to get a restricted Docker user set up, then come back here.

• Setting up a restricted Docker user

Folder Setup

Let’s start by getting some folders set up for the container to use. Open up File Station create the following.

/docker/projects/pihole-compose
/docker/pihole
/docker/unbound #Optional

Unbound Configuration (Optional)

We need to make a config file for Unbound to define its network settings.

Download the file below and put it into the “unbound” folder we created earlier

Container Manager

Next we are going to set up a ‘Project’ in Container Manager. Open up Container Manager and click on Project then on the right-hand side click ‘Create’.

In the next screen we will set up our General Settings, enter the following:

The code section of the below will be blank until we move to the next step.

Next we are going to drop in our docker compose configuration. You now need to decide if you are going to go with Host, Bridge Mode or Macvlan. Jump to the appropriate page to follow the setup.

Host – Page 2
Bridge – Page 3
Macvlan – Page 4

Pages: 1 2 3 4 5