Enhancing Network Security and Content Control in Academic Environments Using Pi-hole

Abstract

Academic institutions require reliable internet access to support teaching, research, communication, and digital learning activities. However, unrestricted connectivity may expose institutional networks to non-academic content, malicious domains, excessive bandwidth consumption, and unauthorized access attempts. This study develops and evaluates a lightweight DNS-based internet filtering architecture using Pi-hole for centralized content control in academic environments. The system was deployed on a Raspberry Pi 3B+ as the primary DNS resolver, enabling domain requests to be processed through configurable blocklists, whitelists, scheduled policies, and centralized query logging. Its performance was compared with firewall-based filtering, proxy-server filtering, and browser-extension filtering using five evaluation dimensions: blocking effectiveness, CPU efficiency, cost-effectiveness, scalability, and bypass resistance. The results show that Pi-hole achieved the highest overall score of 9.0, with scores of 9 for blocking effectiveness, CPU efficiency, and bypass resistance, 10 for cost-effectiveness, and 8 for scalability. The enterprise firewall provided greater client capacity but required substantially higher infrastructure and operational costs. Proxy servers offered application-level control but imposed higher computational overhead, while browser extensions were inexpensive but limited in scalability and resistance to circumvention. The findings demonstrate that Pi-hole provides a balanced, centralized, and resource-efficient filtering solution for small- and medium-sized academic networks. Its effectiveness can be further strengthened through forced DNS redirection, firewall integration, role-based policies, and automated domain classification.