# Tutorial for setting up Pi-hole on an AWS instance

**URL:** <https://discourse.pi-hole.net/t/tutorial-for-setting-up-pi-hole-on-an-aws-instance/31390>\
**Category:** Customizing Pi-hole\
**Created:** [May 1, 2020, 1:48pm UTC](https://discourse.pi-hole.net/t/tutorial-for-setting-up-pi-hole-on-an-aws-instance/31390 "2020-05-01T13:48:27Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cyron52](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/cyron52/32/14697_2.png) [@Cyron52](https://discourse.pi-hole.net/u/Cyron52)\
**Post date:** [May 1, 2020, 1:48pm UTC](https://discourse.pi-hole.net/t/tutorial-for-setting-up-pi-hole-on-an-aws-instance/31390/1 "2020-05-01T13:48:27Z")

</div>

I setup a Pi-hole server on an AWS instance about a year ago. It was pretty straight forward and runs just great of the free tier. One of the advantages is that you can then use the Pi-hole server from multiple LANs if you want, or devices not on your LAN. After talking with some folks, I decided to put together a tutorial on how to do it, focused on people without AWS experience.

[https://blog.sethmay.net/2020/05/how-to-setup-pi-hole-on-an-aws-instance/](https://blog.sethmay.net/2020/05/how-to-setup-pi-hole-on-an-aws-instance/)

May it meet your pi-hole needs.

---

<div class="post-metadata">

**Author:** ![yubiuser](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/yubiuser/32/12100_2.png) [@yubiuser](https://discourse.pi-hole.net/u/yubiuser)\
**Post date:** [May 1, 2020, 3:16pm UTC](https://discourse.pi-hole.net/t/tutorial-for-setting-up-pi-hole-on-an-aws-instance/31390/2 "2020-05-01T15:16:23Z")

</div>

Nice write up.

The only thing I stumbled across is the Security Group Configuration. If you set it up with TCP/UDP p53 IP/32 it allows DNS resolution only from one device (or WAN of the router). And you need a static public IP, or?

---

<div class="post-metadata">

**Author:** ![Cyron52](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/cyron52/32/14697_2.png) [@Cyron52](https://discourse.pi-hole.net/u/Cyron52)\
**Post date:** [May 1, 2020, 3:46pm UTC](https://discourse.pi-hole.net/t/tutorial-for-setting-up-pi-hole-on-an-aws-instance/31390/3 "2020-05-01T15:46:32Z")

</div>

Very true. You would need to update your security group if you VPN changed. Interestingly, my non-static IP has stayed the same for as long as I've been running my Pi-hole (at least a year). You could widen the IP restriction, but it might need to be pretty wide to account for IP changes, and that opens you to potential abuse.

You could also setup vpn with the server (as t0m5k1 on reddit has suggested), but then it wouldn't work with your entire WAN.

---

<div class="post-metadata">

**Author:** ![yubiuser](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/yubiuser/32/12100_2.png) [@yubiuser](https://discourse.pi-hole.net/u/yubiuser)\
**Post date:** [May 1, 2020, 4:01pm UTC](https://discourse.pi-hole.net/t/tutorial-for-setting-up-pi-hole-on-an-aws-instance/31390/4 "2020-05-01T16:01:43Z")

</div>

> [@Cyron52](#):
>
> and that opens you to potential abuse

Yes, that's a huge risk - it likely becomes an open resolver easily.

> [@Cyron52](#):
>
> You would need to update your security group if you VPN changed.

Did you write anything about VPN? I must have missed that....

---

<div class="post-metadata">

**Author:** ![Cyron52](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/cyron52/32/14697_2.png) [@Cyron52](https://discourse.pi-hole.net/u/Cyron52)\
**Post date:** [May 1, 2020, 6:12pm UTC](https://discourse.pi-hole.net/t/tutorial-for-setting-up-pi-hole-on-an-aws-instance/31390/5 "2020-05-01T18:12:06Z")

</div>

I did not. My tutorial only covers the setup that I put in place. The reddit discussion is suggesting VPN but I have not played with going that route.

[https://www.reddit.com/r/pihole/comments/gbigci/created\_a\_tutorial\_for\_setting\_up\_pihole\_on\_aws/](https://www.reddit.com/r/pihole/comments/gbigci/created_a_tutorial_for_setting_up_pihole_on_aws/)

---

<div class="post-metadata">

**Author:** ![Hootenberry](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/hootenberry/32/15121_2.png) [@Hootenberry](https://discourse.pi-hole.net/u/Hootenberry)\
**Post date:** [May 11, 2020, 8:04pm UTC](https://discourse.pi-hole.net/t/tutorial-for-setting-up-pi-hole-on-an-aws-instance/31390/6 "2020-05-11T20:04:05Z")

</div>

One other suggestion. Add instructions for opening it up so you can ping it to see the response time. For anyone not familiar, here they are.

Add a new EC2 security group **inbound rule** :

- Type: **Custom ICMP rule**
- Protocol: **Echo Request**
- Port: **N/A**
- Source: same as other instructions