In Matt Haughey’s recent Pro-level travel tips he mentioned the value of having a network-level adblocker like Pi-hole with Tailscale. This reminded me that I’d planned to write in detail about my failed attempt to set this up with Nix a while back.

This adblocker-plus-Tailscale setup is super helpful for solid adblocking at home and away, but while setting everything up I realised that it could be a little flaky. If the device that’s running the adblocker falls over while you’re in the same place, it’s annoying. If it falls over while you’re travelling and you haven’t set up a reliable home automation power-cycling system, it’s very annoying.

Of course, this was after I’d spent a fair amount of time setting up Pi-hole on a decade-old Raspberry Pi to prove things out, done it again on a new Pi with AdGuard Home (a more modern take on the Pi-hole idea), then fallen down the Nix-all-the-things rat hole mentioned previously.

In the end, I took a path that didn’t require me to look after a tiny box, which I think is probably a saner bet in 2026. Instead, I subscribed to NextDNS, which is essentially a highly configurable custom DNS service.

It took 20 mins to configure (most of that was choosing which custom blocklist to use). I updated custom DNS on the family tailnet (which I already had running) to use NextDNS’s DNS servers and it was done.

For good measure, I also ditched my old VPN and subscribed to Tailscale’s Mullvad exit node add-on so we could switch VPN on and choose an exit country from the Tailscale client.

This approach has given me everything I need (besides a good use for the Raspberry Pi, of course). It’s worth noting that as well as there being an element of trust in using a third-party DNS provider, NextDNS allows 300,000 queries/month on the free tier and going beyond that means the service drops back to being a classic, non-blocking DNS server. I didn’t really want that, so I was happy to pay £17.90/year for Pro.