Raspberry Pi 5 + Armbian (Resolute KDE Plasma) + Technitium DNS. Point the network at it once; every device inherits the same blocking.
The box that runs the resolver. 8GB gives headroom for large blocklists and a desktop OS.
Faster uplink than the Pi’s built-in gigabit, plus an NVMe slot so DNS and the OS are not stuck on microSD.
Local storage for Armbian and Technitium. 1TB is overkill for DNS alone — and that is the point.
Ubuntu 26.04 (Resolute), current kernel, KDE Plasma desktop, for the Raspberry Pi 5. Grab the torrent, download with FrostWire, write with Armbian Imager to a USB stick. The Pi 5 can boot that stick directly. After first boot, move the install onto the NVMe with armbian-install if you want the OS off USB.
https://dl.armbian.com/raspberrypi5/Resolute_current_kde-plasma.torrent
1. Download with FrostWire. Install FrostWire, open the .torrent (File → Open Torrent or drag it in). Wait for 100%. The finished file is usually .img.xz — leave it compressed.
2. Write it with Armbian Imager. Point Imager at the local .img.xz, select the USB stick (double-check the name and size), flash, and wait for verification.
Flash the USB stick on your usual computer. Boot the Pi from it, finish first-login setup, then run sudo armbian-install if you want the system copied onto the KingBank NVMe.
SSH into the Pi (or open a terminal on it) and install Technitium.
curl -sSL https://download.technitium.com/dns/install.sh | sudo bash
After install the web console is at http://<pi-ip>:5380. Default login is usually admin until you set a password.
technitium-console is a modern replacement for the stock UI (same API, better layout, phone-friendly, live dashboard, combined Blocking section). Install it on the same machine after Technitium is running:
curl -sSL https://raw.githubusercontent.com/byGarcia/technitium-console/main/install.sh | sudo sh
On Technitium 15.5+ with systemd it sets up its own folder and restarts the DNS service once. Updates do not restart it. To remove later:
curl -sSL https://raw.githubusercontent.com/byGarcia/technitium-console/main/install.sh | sudo sh -s -- --uninstall
In the web console go to the Settings tab.
Under Settings → General, scroll to IPv6 Support and click Enable IPv6.
Under Blocking, scroll to Allow / Block List URLs. Add these two wildcard domain lists (Pro for ads/trackers, TIF for live threats):
https://hagezi-mirror.dnsbunker.org/wildcard/pro-onlydomains.txt https://hagezi-mirror.dnsbunker.org/wildcard/tif-onlydomains.txt
Under Proxy & Forwarders, use these OpenDNS DoH endpoints (or the ones closest to you):
https://doh.opendns.com/dns-query · 208.67.222.222 https://doh.opendns.com/dns-query · 208.67.220.220 https://doh.opendns.com/dns-query · [2620:119:35::35] https://doh.opendns.com/dns-query · [2620:119:53::53]
Click the upper-right corner of the Technitium UI to change the admin password and add 2FA. Do this before you expose the console to the rest of the LAN.
Give the Pi a reserved / static LAN address, then set that address as the DNS server in your router’s DHCP settings. Every client that renews a lease will start using Technitium automatically. Keep a backup DNS in your pocket in case the Pi is down.
Do not forward 53 / 5380 to the public internet. This box is for your LAN. An open resolver or exposed admin UI on the WAN is how home DNS servers get abused.