Configure a Filter That Protects Your Whole Home Network
One piece of software that blocks ads and trackers on every device in your home, without installing anything on any of them.
Once your home lab is ready to run applications, the first one worth installing is a network level filter. It sits quietly in the background, costs nothing to run, and immediately improves the experience on every device in your home: phones, laptops, smart TVs, all of them.
The tool I use for this is AdGuard Home. It works by intercepting the requests your devices make when they look up internet addresses, and filtering out the ones you do not want. Pi-hole is a well known alternative with similar capabilities. I went with AdGuard Home and have not had reason to switch.
What DNS is and why it matters
Every time you visit a website, your device sends a request asking what IP address to connect to. By default, that request goes to your ISP's DNS server, or to a public one. Your ISP can log every domain name you query. That is a record of everywhere you browse, across every device in the house.
Running your own DNS resolver on your network means those requests stay local. Your Pi answers them instead of your ISP. Your ISP sees a network connection but not what you are doing with it.
The ad blocking part
When you visit most websites, your browser loads resources from dozens of additional domains in the background: advertising networks, analytics platforms, tracking scripts. You do not see any of this. Your browser handles it silently.
AdGuard Home sits between every device on your network and the internet. It checks each DNS request against community maintained block lists and drops the ones that match. Advertising and tracking domains are blocked before a connection is even made. No browser extension required. It works for every device automatically.
The difference in browsing experience is noticeable. Pages load faster because they are not loading hundreds of advertising resources. You see white gaps where ads used to be on some sites. That is the expected result. Advertisers find ways around DNS blocking and the community fights back, so it is not perfect, but for the majority of common advertising and tracking it does the job.
Setting it up
AdGuard Home runs as a Docker container, which makes deployment straightforward once your home lab is ready to run apps. Define the container with the right port mappings, deploy it, and you are up.
The step that makes it work network-wide is pointing your router's DNS setting to your Pi's IP address. Your router then hands that DNS address out to every device on your network via DHCP. From that moment, all DNS traffic flows through AdGuard Home. The exact steps vary by router, so I would point you to the AdGuard Home documentation at adguard.com/adguard-home.html rather than walk through a specific router interface here.
Handling traffic in the background
AdGuard Home cannot resolve everything itself. Requests it does not have a cached answer for get passed upstream. I run multiple upstream providers: Cloudflare's 1.1.1.1, AdGuard's own DNS, and Google's 8.8.8.8. If one goes down, AdGuard Home moves automatically to the next. It also measures response times over time and tends to route toward whichever upstream is currently fastest.
Custom local domain names
One feature I use constantly is custom local DNS records. You can define any domain name and point it to an IP address on your network. Every container running on my Pi has a proper local name. Instead of remembering IP addresses and port numbers, I type the name. It is a small thing that quickly becomes indispensable when you are running multiple services.
AdGuard Home is a good first step. It gives immediate, tangible value and teaches you something about how your network actually works.