Home network

Finished September 2026

Home Network Hardening

4 / 4tracker domains I targeted, blocked from my phone on any network

I set up Pi-hole and Tailscale so my phone uses the same DNS filter at home and away. I also used ADB to clean up a carrier-issued Android TV box.

Pi-holeTailscaleDocker ComposeUbuntuADBAndroid 14Java
THE SHORT VERSION

What I tested, built, and learned.

4 / 4targeted tracker domains blocked
0inbound ports opened
uid 0process restarting the old launcher

The problem

Four Meta and X tracking domains kept showing up in my phone's DNS requests. My smart TV needed a few exceptions to keep its app store working. The Android TV box had a slow launcher and preinstalled apps I couldn't remove through Settings.

What I built

I run Pi-hole in Docker on an Ubuntu mini PC. I gave the TV its own group, so its app store exceptions don't apply to my phone. Tailscale points my phone to Pi-hole on cellular and other Wi-Fi networks. I use Tailscale Serve for HTTPS access to an internal service without opening router ports. On the TV box, I used network ADB to disable unwanted apps, shorten animations, and change the launcher.

How I checked it

The Pi-hole query log showed all four target domains blocked for my phone. The launcher took more digging: Android accepted the new home setting, but the old screen kept returning. In logcat, I found a uid 0 process starting the old launcher by component name. Disabling that package stopped the override.

What didn't work

Some of the box stayed out of reach without root, like its protected system overlays. I also wanted a remote shortcut that jumps straight to a channel, but the vendor's player has no public way to tune by intent. I decompiled it to confirm, and that one's still open.

01 / REMOTEiPhoneany network
02 / LOCALSmart TVLAN
03 / LOCALAndroid TV boxLAN
04 / MANAGEMENTMac · ADB
MINI PC · DOCKERPi-holeper-device DNS rulesTailscale Servetailnet HTTPS
RESOLVERUpstream DNS
TAILNETLAN

PI-HOLE / PHONE QUERY LOG

connect.facebook.net → BLOCKEDan.facebook.com → BLOCKEDstatic.ads-twitter.com → BLOCKEDanalytics.twitter.com → BLOCKEDPhone DNS: Pi-hole over Tailscale
blocked query tailnet path ADB management

Details

  • TV-only allow rules kept its app store working
  • Phone uses Pi-hole DNS on cellular and outside Wi-Fi
  • Found double NAT across two routers
  • Traced remote-key handling in a decompiled system APK
  • Built and sideloaded a Java accessibility app without Gradle
  • Uptime Kuma sends monitoring alerts to my phone

Configs available on request.