I recently set out to take more control of my home network. The main aim was for network-wide ad blocking, but adding private DNS resolution, and secure remote access to my home LAN was a minor addition. This post is a brief overview of what I built, the hardware I chose, and the design decisions along the way.
The hardware: why a Dell Wyse 5070?
I wanted something always-on, which immediately ruled out anything power-hungry or noisy. The Dell Wyse 5070 thin client turned out to be a great fit:
- Cheap — plentiful on the refurbished market
- Low power — 5–12W under typical load, so running it 24/7 costs pennies
- Silent — passively cooled, no fans at all
- Capable enough — a quad-core Pentium Silver J5005 with 8GB RAM is vastly more than DNS and VPN duties require, leaving headroom for future projects
It runs Ubuntu Server 24.04 with LUKS full-disk encryption. Since the machine is headless, I set up Dropbear in the initramfs — a tiny SSH server that runs during early boot — so I can unlock the encrypted disk remotely rather than plugging in a keyboard and monitor after every reboot.
The stack
All three services run as Docker containers, defined in version-controlled Compose files under /opt/homelab/, with secrets kept in permission-restricted .env files. Containers make each service easy to update, rebuild, or move to another machine.
Pi-hole: network-wide ad blocking
Pi-hole acts as the DNS server for every device on the network, sinkholing requests to known ad and tracker domains. Phones, TVs, laptops — everything benefits with zero per-device configuration.
My ISP-supplied router doesn't allow custom DNS servers in its DHCP settings (a common frustration with locked-down ISP hardware), so the cleanest solution was to disable DHCP on the router and let Pi-hole hand out leases — with itself as the advertised DNS server. This guarantees every device on the network uses Pi-hole without touching each one individually.
Unbound: private recursive DNS
By default, Pi-hole forwards queries to an upstream provider like Google or Cloudflare — which means that provider sees every domain your household visits. Unbound removes that third party entirely.
Unbound is a recursive resolver: it walks the DNS hierarchy itself, starting from the root servers, so no single upstream company aggregates my browsing history. The chain looks like this:
Device → Pi-hole (blocking + caching) → Unbound (recursion) → Root/authoritative servers
Unbound listens only on localhost (port 5335), so it's reachable by Pi-hole but not exposed to the wider network. The config includes standard hardening — DNSSEC validation, protection against DNS rebinding via private-address filtering, and glue record verification. First lookups are marginally slower than a big public resolver, but caching means it's imperceptible in practice.
An update script is also run weekly to update the root hints via a cron job.
WireGuard: secure remote access
WireGuard provides VPN access so I get all the benefits of Pi-Hole and Unbound away from home. It's a modern VPN protocol — dramatically simpler and faster than OpenVPN, with configs small enough to fit in a QR code for painless phone setup.
Two design choices here:
- Full-tunnel clients with Pi-hole DNS. Peers route all traffic through home (
AllowedIPs = 0.0.0.0/0) and use Pi-hole for DNS, so ad blocking follows my devices onto mobile networks and public Wi-Fi. - WireGuard is the only service exposed to the internet. Everything else — SSH included — is reachable only from inside the LAN or through the tunnel. WireGuard doesn't respond to unauthenticated packets at all, so to a port scanner the network looks closed. This dramatically reduces attack surface compared to forwarding SSH or admin interfaces directly.
Since my home IP is dynamic, a small script updates a DNS record in Azure (where I already manage my domain) whenever the IP changes — a service principal with narrowly-scoped DNS permissions, run on a schedule via cron. Clients connect to a hostname rather than an IP that might change under them.
Defence in depth
A few layers work together rather than relying on any single control:
- SSH: key-only authentication, password login disabled, fail2ban banning repeat offenders
- UFW: services restricted to the local subnet; only WireGuard's port accepts traffic from anywhere
- Encryption at rest: LUKS protects everything if the hardware is ever stolen
- Minimal exposure: one open port to the internet, total
Closing thoughts
None of this requires exotic hardware - a £50 thin client (and an optional UPS). The result is a quieter, more private network: ads blocked everywhere, DNS queries that never leave the house unencrypted to a third-party aggregator, and secure access to home from anywhere.
Next up: the same box's twin is already running game servers and file sharing — but that's a post for another day.