Build your own

Set up your Holdfast Brick

A small device that plugs into your home router and blocks ads and trackers for every device on your network — phones, TVs, laptops, guests. No app installs per device, no subscriptions, no cloud account. Your data never leaves your home. Six steps, one SSH session.

What you need (~$70–90)

Raspberry Pi 5 (2 GB is plenty) — older models with an Ethernet port (Pi 4, 3B+) work too
microSD card, 16 GB or larger
The official Pi 5 power supply (27 W USB-C)
One Ethernet cable
A phone or computer on the same WiFi

Step 1

Flash the SD card

Install Raspberry Pi Imager (rpi.org) on your computer.
Choose Raspberry Pi OS Lite (64-bit) (DietPi also works).
In the Imager's settings (gear icon): enable SSH, set a username and password, and set the hostname if you like.
Write the card, then put it in the Pi.

Step 2

Plug the brick into your router

Connect the Ethernet cable from the Pi to any LAN port on your router, then plug in power. Give it a minute to boot. Wired is required — the brick will serve your whole network and must not depend on WiFi.

Step 3

Install the Holdfast software

Find the Pi's address in your router's device list (or try ssh <username>@raspberrypi.local), then:

On your computer

ssh <username>@<pi-address>
git clone https://github.com/MarwanNakhaleh/PrivacyBrickAPI.git
cd PrivacyBrickAPI
sudo bash deploy/provision.sh

The script installs and wires everything: AdGuard Home, Unbound with encrypted DNS (DNS-over-TLS to Cloudflare/Quad9), Tailscale (optional remote access), ntopng, and the Holdfast API. It's safe to re-run any time.

Step 4

Finish AdGuard's one-time wizard

Open http://<pi-address>:3000 in a browser. Choose web port 3000 and DNS port 53, create an admin login, finish the wizard — then run it once more:

On the Pi

sudo bash deploy/provision.sh

The re-run wires AdGuard to the encrypted DNS chain and creates the app's credentials automatically.

Step 5

Connect the app

Build PrivacyBrickUI-iOS from Xcode onto your iPhone/iPad (App Store release coming). On first launch the app finds the brick on your WiFi by itself.

Enter the 6-digit pairing code — it's printed at the end of the install, or get a fresh one:

On the Pi

sudo privacybrick-pair

Allow the "local network" permission when iOS asks.

Step 6

Protect every device

In the app: Ad Blocking → Whole-home protection. The guided flow checks your network, walks you through turning off your router's DHCP (with a direct link to your router's admin page), and flips the brick to handing out addresses — after that, every device on the network is protected automatically, including guests.

Xfinity note xFi gateways can't turn DHCP off. Workaround the app will walk you through: shrink the gateway's DHCP range to a single address (e.g. 10.0.0.253–10.0.0.253); devices then migrate to the brick as their leases renew.

Troubleshooting quick hits

App can't find the brick: Same WiFi? Local Network permission on? (Settings → Privacy & Security → Local Network). VPN off?
Ads still showing on a device: It may still hold an old DHCP lease; toggle its WiFi off/on.
Streaming ads still showing: Hit or miss — see the honest limitation above. Sometimes a blocklist catches them, sometimes it doesn't.