Pi-hole Smart Blocking & Custom Lists

If you have successfully followed my initial Pi-hole Proxmox deployment guide, you have already taken the most important step: you have eliminated the vast majority of network-wide advertisements and background telemetry across your entire home. Your internet is faster, and your bandwidth is no longer being choked by tracking scripts. However, standard, blanket blocking inherently possesses a massive structural flaw: it forcefully treats every single device on your network exactly the same.

I ran into this exact problem almost immediately after deploying my first Pi-hole setup years ago. I personally wanted incredibly strict, highly aggressive blocklists to protect my core lab environment, my servers, and my kids' tablets. But those exact same aggressive rules completely broke legitimate shopping links, affiliate redirects, and newsletter marketing emails on my wife's phone. When her daily workflow broke, it caused immediate friction in the house. The dreaded phrase "the internet is broken again" echoed through the living room.

When you hit this wall, the solution is absolutely not to disable Pi-hole or dial back your security for the entire network. The true, professional solution is to master Pi-hole Group Management. In this comprehensive, step-by-step guide, I am going to show you exactly how to utilize Pi-hole's advanced, granular features to assign wildly different, custom blocklists to specific, individual devices on your network. We are also going to cover the absolute best, highly curated community blocklists you should be using today to completely stop telemetry without breaking the functional internet for your family.

Step 1: Architecting and Creating Custom Device Groups

By default, right out of the box, every single device that connects to your home network—from your gaming PC to your smart toaster—is automatically dumped into a single group called the 'Default' group. To apply different rules, we first need to create logically segmented groups.

Open a web browser and firmly log into your primary Pi-hole administrative dashboard (typically found at http://your-pi-hole-ip/admin).
Navigate to the left-hand sidebar menu, click on Group Management to expand it, and then click specifically on Groups.
You will see the Default group listed. At the top, in the Name input field, enter a highly specific, descriptive name for your new group. I highly recommend starting with something like Kids Devices, Strict Lab Servers, or Wife's Unfiltered iPhone.
You can optionally add a brief description to remind your future self why this group exists, then click the blue Add button.

You have now successfully created a logical container. However, right now, that container is completely empty. We need to populate it.

Step 2: Assigning Specific Physical Clients to Your New Groups

Now we need to explicitly tell Pi-hole exactly which physical hardware devices belong inside the segmented group we just created.

Navigate back to the left sidebar, click Group Management, and this time click on Clients.
At the top of this page, click the Known clients dropdown menu. Pi-hole is smart; it will show you a massive list of the IP addresses, MAC addresses, and often the hostnames of every active device currently chatting on your network. Carefully locate and select the specific device you want to isolate (for example, the kids' iPad).
Click the blue Add button to formally register this client into the management system.
Now, scroll down slightly to look at the list of "List of configured clients". Find the device you just added.
In the far right column labeled Group assignment, you will see a series of checkboxes. Uncheck the box for Default, and strictly check the box for your newly created Kids Devices group. Finally, click Apply.

Congratulations, this specific device is now completely isolated from your standard network rules. Any new blocklists you apply to the 'Default' group will no longer affect this iPad, and any ultra-aggressive lists you apply to the iPad will not break your wife's shopping links. This is the foundation of network harmony.

Step 3: Supercharging Your Setup with Curated Community Blocklists

Pi-hole ships with the standard StevenBlack list enabled by default. While this list is an excellent baseline, it fundamentally misses a massive amount of modern tracking telemetry, specifically targeting smart TVs, IoT devices, and aggressively tracked mobile apps. You absolutely need to pull in externally curated lists from the wider privacy community.

The Golden Rule of Blocklists: Only ever use thoroughly tested, actively maintained lists. If you go to Reddit or random GitHub repositories and grab massive lists containing 5 million domains just to see your "domains blocked" number go up, you will completely break the legitimate internet. You will break banking logins, streaming service authentications, and essential CDNs. I have learned this the hard way. I now rely exclusively on two incredibly trustworthy sources:

Firebog (The "Ticked" Lists): The website Firebog.net is legendary in the Pi-hole community. It curates dozens of different adlists, categorized by type (Tracking, Advertising, Malicious, etc.). The secret is to only use the lists that are highlighted in a green box with a checkmark (the "ticked" lists). These specific lists are heavily vetted and are virtually guaranteed not to interfere with normal, day-to-day internet browsing.
HaGezi's DNS Blocklists: Available publicly on GitHub, HaGezi maintains some of the best blocklists in the world right now. His "Multi Normal" list is widely considered the current gold standard for perfectly balancing highly aggressive tracker blocking with incredibly low false-positive rates. If you only add one extra list to your Pi-hole, make it HaGezi's Multi Normal.

Step 4: Applying Your Custom Blocklists to Specific Groups

Now that we know which lists to use, let's apply an incredibly aggressive, lock-down blocklist exclusively to our newly created Kids Devices group, while leaving the rest of the house on the standard list.

Go to Firebog or GitHub and completely copy the raw .txt URL of the specific blocklist you want to implement.
In your Pi-hole dashboard, navigate to Group Management > Adlists.
Paste the raw URL directly into the Address input field.
This is the Critical Step: Look at the Group assignment checklist right next to the address field. Uncheck the Default group completely, and only check the box for Kids Devices (or whichever highly specific group you are targeting).
Click the blue Add button.

You have now mapped a specific list to a specific device. This aggressive list will strictly filter traffic for the kids' devices, but your main network remains completely untouched and unaffected.

Step 5: Execute the Gravity Update

Adding a URL to the Adlists page in the GUI actually doesn't do anything immediately. It just saves the link to a database. You have to force Pi-hole to go out to the internet, download the text files, parse the domains, remove duplicates, and build a master database.

Navigate to Tools > Update Gravity on the left menu, and click the massive Update button in the center of the screen. You will see a terminal output as Pi-hole reaches out to fetch the new lists, compiles the millions of domains into a highly efficient binary tree, and cleanly restarts the internal DNS resolver (FTL). Once you see "Success," your new segmented rules are officially active across the network.

Troubleshooting & Edge Cases: When Things Break

When you start actively messing with custom, community-maintained blocklists, things will occasionally, inevitably break. This is the reality of network administration. Here is exactly how to diagnose and fix the most common issues:

A Legitimate Website Refuses to Load (The False Positive): If a website suddenly breaks for a specific device, don't panic. Log into Pi-hole, go to the Query Log page, and use the search bar to filter specifically by the IP address of the broken device. Have the device try to load the page again. Watch the log. You will see a domain light up in bright red (meaning it was blocked). Simply click the Whitelist button directly next to that domain. This instantly creates an exception rule for that domain, allowing the site to load permanently.
Devices Are Completely Ignoring Their Group Rules: If a specific device (like an iPhone) seems to be completely ignoring the fact that you assigned it to a group, there are two primary culprits. First, check if the device is running a commercial VPN (like NordVPN); VPNs bypass local DNS entirely. Second, check if Apple's "Private Wi-Fi Address" (or Android's MAC randomization feature) is turned on. Pi-hole explicitly tracks devices by their MAC address and IP. If the phone randomizes its MAC address every 24 hours for privacy, Pi-hole sees it as a brand new, unrecognized device and drops it right back into the 'Default' group. You must disable MAC randomization specifically for your trusted home Wi-Fi network in the phone's settings.
The Gravity Update Crashes or Hangs Indefinitely: If you hit 'Update Gravity' and it completely stalls out or crashes with an error, you have likely run out of hardware resources. If you added massive blocklists containing 10 million domains, the Pi-hole requires significant RAM to compile them. Check your LXC container resources in Proxmox. You may need to bump the container RAM from 512MB up to 1GB or check if the virtual disk is 100% full.

Conclusion & Next Steps for Your Lab

Mastering group management is the defining difference between running a frustrating, rudimentary ad-blocker that constantly causes arguments with your family, and orchestrating a silent, highly intelligent, invisible network shield. By utilizing heavily vetted custom lists and targeting them precisely to the devices that actually need them, you can maintain maximum lockdown security for your lab servers and kids' tablets, all without breaking the daily internet experience for everyone else in the house. This is network administration done right.