Skip to content
The Gateway

The Gateway vs Pi-hole and AdGuard Home

Short answer

Section titled “Short answer”

Choose Pi-hole or AdGuard Home when network-wide DNS blocking is the goal. Choose The Gateway when DNS decisions must use the same device groups and enforcement model as routing, tunnels, firewall rules, and fail-closed protection.

Choose a dedicated DNS filter when

Section titled “Choose a dedicated DNS filter when”
  • You mainly want ad, tracker, or malware-domain blocking.
  • You value its blocklist community and focused web interface.
  • Routing and VPN policy are managed elsewhere.
  • An open-source resolver is required.

Choose The Gateway when

Section titled “Choose The Gateway when”
  • Per-device DNS policy must align with per-device routes.
  • Devices that ignore DHCP-provided DNS must be contained.
  • DNS queries must follow a protected tunnel and fail closed with it.
  • You also need tunnels, firewall, splitting, mesh, or federation.

Use them together

Section titled “Use them together”

The Gateway can send resolver traffic to an existing Pi-hole or AdGuard Home instance. In that design, the dedicated resolver keeps its blocklists and reporting while The Gateway owns routing and leak-prevention policy.

Decide which system is authoritative for client groups and avoid duplicating incompatible rewrite rules in both places.

Important trade-off

Section titled “Important trade-off”

Dedicated DNS filters have larger blocklist ecosystems and a narrower operational surface. The Gateway’s DNS plane is valuable when DNS is part of a broader network policy, but it is not a reason to replace a DNS filter that already meets your needs.

Sources and next steps

Section titled “Sources and next steps”