UniFi ad blocking: how it works, plus Pi-hole and AdGuard DNS (2026)

UniFi has ad blocking built in. It runs on your UniFi gateway and blocks known ad domains through DNS, for every device on the networks you pick. You don't need a Pi-hole or any software on the devices.

It needs a Next-Gen UniFi Gateway or a UniFi Cloud Gateway, such as a Dream Machine, Cloud Gateway or Dream Router. You turn it on in the content filter settings of the UniFi Network application.

This guide covers where the setting is, how to test it, why some ads still get through, and when Pi-hole or AdGuard DNS is the better choice.

How UniFi ad blocking works

Ubiquiti's Ad Blocking article describes it in two sentences. The gateway uses DNS to block common ad domains. Once a domain is blocked, every ad served from that domain is blocked too.

A few details matter in practice:

• The list comes from Ubiquiti. Its help articles call it "UniFi's internal database" of ad domains and don't publish the domains on it.
• It works per network or per device. You choose which networks and clients the policy covers.
• Devices that use their own DNS server get redirected to the gateway's DNS while Ad Blocking is on.
• You can allow a domain that is blocked by mistake, or block extra domains yourself.

Ubiquiti added the feature in UniFi Network 7.3.76 in November 2022, for gateways on UniFi OS 3.0 or newer. Per Ubiquiti's release notes, the Dream Machines got it with UniFi OS 3.0.20 in April 2023, and the Next-Gen Gateways (UXG) with firmware 3.0.7 that same month.

Ubiquiti's requirement list leaves out the older UniFi Security Gateway (USG). The USG is on Ubiquiti's legacy products list, which means it no longer receives updates.

How to turn on ad blocking in UniFi

Ubiquiti's content filtering article (updated June 2026) gives the current path:

1. Open the UniFi Network application and go to Settings > CyberSecure > Content Filter.
2. Create a policy and give it a name.
3. Under Source, pick the networks or client devices it applies to.
4. Enable Ad Blocking.
5. Optionally, add domains to the allowlist or blocklist, or set a schedule.

The same policy has a filtering level. Basic blocks malicious, explicit and adult domains. Enhanced adds more than 100 categories from Cloudflare and needs UniFi CyberSecure, Ubiquiti's paid security subscription. Ad Blocking is part of the standard policy. Ubiquiti's CyberSecure article doesn't list it as a CyberSecure feature.

Older Ubiquiti articles put Ad Blocking under the Application Firewall section. If your menus look different, update the Network application first.

How to test UniFi ad blocking

Ubiquiti's test is one command. Run it on a device connected to a network where Ad Blocking is on:

nslookup www.googleadservices.com

If ad blocking works, the answer is 0.0.0.0:

Name:    www.googleadservices.com
Address:  0.0.0.0

If you get a real IP address back, the device isn't using the gateway for DNS, or the policy doesn't cover that network.

Recent gateway firmware also shows a block page when a browser hits a blocked domain. Ubiquiti added it in UniFi OS 4.4, rolled out between October 2025 and January 2026 depending on the gateway model.

Why UniFi ad blocking isn't working

Ubiquiti lists the things that let ads through:

• Encrypted DNS on the device, such as DNS over HTTPS or DNS over TLS in a browser.
• Android Private DNS.
• Apple iCloud Private Relay and Limit IP Address Tracking.
• A VPN or proxy on the device.

In each case the device's DNS lookups bypass the gateway, so the gateway can't block them. Turn the feature off on the device, or accept that this device won't be filtered.

YouTube ads are a common complaint. DNS blocking works per domain, so an ad that comes from the same domain as the video can't be blocked without blocking the video too. Pi-hole and AdGuard DNS filter by domain as well, so they share that limit.

If ad blocking breaks a site you need, add that domain to the policy's allowlist.

UniFi ad blocking vs Pi-hole

Pi-hole is a free, open-source DNS sinkhole: it answers lookups for ad domains with an address that goes nowhere. It blocks ad domains for every device that uses it as its DNS server, with no software on the devices. You run it yourself, on a Linux machine such as a Raspberry Pi, or in Docker.

Pi-hole gives you more control over the lists and shows every lookup. You pay for that with one more machine to update and keep running.

To use Pi-hole with UniFi, hand its address out to your devices through DHCP. Ubiquiti's DNS records article gives the steps:

1. Go to Settings > Networks and select the network.
2. Scroll down to DNS Server and uncheck the toggle.
3. Enter the IP address of your Pi-hole.

Devices pick up the change when they renew their DHCP lease. Pi-hole can also act as the DHCP server itself, but then you turn off DHCP on that UniFi network.

Don't enable UniFi's Ad Blocking on the same network. It redirects devices with a custom DNS server to the gateway, so their lookups would skip your Pi-hole.

AdGuard DNS as a no-hardware option

AdGuard DNS is a free public DNS service that blocks ads and trackers. Setup is a change of DNS servers, with nothing to install.

These addresses come from AdGuard's own server list. You can set them in two places in UniFi:

• For one network: Settings > Networks > your network > DNS Server, as in the Pi-hole steps above.
• For the gateway itself: in the DNS settings of your internet (WAN) connection. Ubiquiti's DNS troubleshooting guide covers this.

The same guide says UniFi needs to resolve ui.com domains for updates and remote management. It cautions against custom internal DNS servers that may not resolve them. Check that your console still shows up online after the change.

On Android, you can also use AdGuard DNS on one phone. Under Private DNS, choose Private DNS provider hostname and enter one of the hostnames above, per AdGuard's setup page. Remember that Private DNS bypasses UniFi's own Ad Blocking.

The trade-off with any public DNS filter is control. You can't see or edit the list it uses, and every lookup from your network goes to that provider.

For custom DNS entries and resolver settings, see our guides on UniFi DNS settings and UniFi content filtering.

Frequently asked questions

Does UniFi have built-in ad blocking?

Yes. UniFi gateways have Ad Blocking in the content filter, under Settings > CyberSecure > Content Filter. It needs a Next-Gen UniFi Gateway or a UniFi Cloud Gateway.

Do I need a CyberSecure subscription for ad blocking?

Not according to Ubiquiti's documentation. Ad Blocking is an option in the standard content filter. Ubiquiti's CyberSecure article lists only the Enhanced filtering categories and extra intrusion-prevention signatures.

Does UniFi ad blocking work on a USG?

No. Ubiquiti's requirement is a Next-Gen UniFi Gateway or a UniFi Cloud Gateway, and the USG is a legacy product that no longer gets updates. On a USG, use Pi-hole or AdGuard DNS instead.

Can I use Pi-hole with UniFi?

Yes. Enter the Pi-hole's IP address as the DNS server for your UniFi network, and leave UniFi's own Ad Blocking off on that network.

Does UniFi ad blocking block YouTube ads?

Don't count on it. DNS-based blocking works per domain. If an ad comes from the same domain as the video, it can't be blocked without blocking the video too.

Final thoughts

For most networks with a UniFi gateway, the built-in Ad Blocking is enough: one toggle, per network, and a one-line test to confirm it works. Pi-hole makes sense when you want your own lists and a query log. AdGuard DNS is the quickest fix when you don't have a supported gateway.

Whichever you pick, test it with nslookup and expect a few ads to slip through on devices that use their own DNS.