WireHole is a docker-compose project that combines WireGuard, Pi-hole, and Unbound to create a personally managed VPN with integrated ad blocking and private DNS resolution.
The tool solves the problem of deploying a private VPN with DNS-level filtering and privacy. It works by routing device traffic through your own server running WireGuard, where Pi-hole blocks advertisement and tracker domains before passing remaining DNS queries to Unbound. Unbound then queries authoritative name servers directly rather than relying on public DNS providers, and validates responses using DNSSEC. This approach gives you control over your own infrastructure while filtering ads and improving DNS privacy across all connected devices.
WireHole suits anyone who wants to run their own VPN infrastructure without relying on third-party VPN providers. It works well for users with a Linux server available, whether that is a Raspberry Pi, home server, or rented hosting. The project supports both full-tunnel and split-tunnel configurations, allowing flexibility in how traffic is routed. The setup requires a dedicated Linux machine as the server; Docker Desktop on Mac or Windows cannot host it due to kernel requirements, and WSL2 on Windows does not work as a production server because it cannot expose UDP ports to other devices. The README does not compare WireHole to alternative VPN or DNS solutions.
The project underwent a significant rewrite that changed its internal layout, requiring users upgrading from older versions to follow a migration script rather than simply restarting. The documentation provides structured guidance organized into setup, configuration, and operational sections, with a quick-start path for new users and reference material for later customization. The tool includes testing capabilities to verify that all components work correctly and provides troubleshooting guidance for common issues.
