Pi-hole Moving Port 53
Free up port 53 (for Pi-hole Docker)
In Linux, you need to tell systemd-resolved not to listen on port 53 (via its stub listener), then restart it. This keeps local DNS working on the host while freeing the port for Pi-hole.
Step 1: Confirm what's using port 53
Run one of these commands (use sudo if needed):
sudo ss -tulpn | grep ':53'or
sudo lsof -i :53or the classic:
sudo netstat -tulpn | grep ':53'Look for output like:
- systemd-resolved or systemd-resolve listening on 127.0.0.53:53 (or sometimes 0.0.0.0:53)
- Possibly dnsmasq, unbound, named (BIND), or another DNS service if you've installed one before.
If it's systemd-resolved (most common), proceed.
Step 2: Free up port 53 (for Pi-hole Docker)
You need to tell systemd-resolved not to listen on port 53 (via its stub listener), then restart it. This keeps local DNS working on the host while freeing the port for Pi-hole.
-
Edit the config file:
sudo nano /etc/systemd/resolved.confFind the line #DNSStubListener=yes (it might be commented out).
Change it to (uncomment and set):
text:DNSStubListener=noSave and exit.
-
Restart the service:
sudo systemctl restart systemd-resolved(Or if it was fully disabled before, sudo systemctl enable --now systemd-resolved isn't needed — just restart.)
-
Verify port 53 is now free:
Run the check command from Step 1 again — no process should be listening on :53 anymore.
-If the command returns blank, that is good.
If still taken, double-check for other services (e.g., sudo systemctl stop unbound if you have Unbound installed, or sudo systemctl disable --now dnsmasq).
Step 3: Restart your Pi-hole container
Now try again:
sudo docker compose down
sudo docker compose up -dIt should start without the port error.
Important: Fix host DNS resolution after this change
Disabling the stub listener breaks the host's own DNS (it was using 127.0.0.53 as its resolver).
To restore it:
-
Remove the symlink to the stub resolver:
Bashsudo rm /etc/resolv.conf -
Create a new static /etc/resolv.conf with a working upstream DNS (temporarily use public ones; later change to your Pi-hole IP once it's up):
Bashsudo nano /etc/resolv.confPut in something like:
textnameserver 1.1.1.1 nameserver 1.0.0.1 # or nameserver 8.8.8.8Save
To
Once its running: On your server (preventthe NetworkManagerhost ormachine)
/etc/resolv.conf fromis overwriting):currently:
nameserver 9.9.9.9
Ifnameserver using NetworkManager: Edit connections or add to /etc/NetworkManager/NetworkManager.conf:
Change it to this: (add nameserver 127.0.0.1)
nameserver 127.0.0.1
nameserver 9.9.9.9
nameserver 149.112.112.112Commands:
[main]sudo dns=defaultnano /etc/resolv.confPaste the three lines above, save and exit (Ctrl+O → Enter → Ctrl+X).
Then sudolock systemctlthe restartfile NetworkManagerso it survives reboot:
Or
sudo chattr +i /etc/resolv.confOnceconfTest it works:
ping google.com(Should resolve and ping.)
YOU2. NEEDOn TO:your Changerouter
Current DHCPsetting: Primary DNS Settings= to192.168.0.1 Point to Pi-hole
(This is thewrong most— importantyour steprouter is telling devices to use itself for network-wideDNS, blocking.so Pi-hole is not being used by the network.)
Change it to:
Log into your router again.
How
On the router'sserver WAN/Internetrun:
ip addr show | grep "inet " | grep -v 127.0.0.1Look for the router's192.168.0.x ownaddress upstreamon queries).your Onlymain changenetwork theinterface LAN/DHCP(usually side.
After this:changing the router DNS settings:
NewSavedevices/ Apply
Quick check after both changes
On any site)phone/laptop —(not itthe server):