Notes · Home network

Stop a smart TV from dodging Pi-hole and scanning your network

Last updated September 2026

Our TVs were skipping Pi-hole and talking straight to Google DNS, and the LG was scanning every device on the Wi-Fi. This page is how we fixed both on a UniFi network: the TVs on their own VLAN, every DNS lookup forced through Pi-hole, and the ways around it blocked.

Tested on a UDM Pro running Network 10.6 and Pi-hole 6 in September 2026, with an LG, a Vizio, and two Fire TVs. It is a record of what worked for us, not a supported product. Menus move between UniFi releases, so check the version you are on.

The problem, in two parts

Smart TVs do two things you did not sign up for.

1. They ignore the DNS server your router hands out and talk straight to Google DNS or Cloudflare. That skips your Pi-hole, so the ad and tracking domains you block get through anyway.
2. They scan your Wi-Fi. LG webOS TVs look up every address on the subnet the moment they join, and they see your phones, laptops, thermostats, and cameras.

These need two different fixes. DNS blocking does nothing about the scanning, and a VLAN does nothing about the DNS bypass on its own. You need both, and the VLAN comes first, because the DNS redirect only works properly across a router hop.

Before the redirect, a Fire TV sat on the new VLAN for ten minutes without sending a single query to Pi-hole, even though DHCP had told it where Pi-hole was. The minute the redirect went in, its lookups started landing. After that, every lookup from all four TVs showed up in the query log, and about a third of them were blocked.

What you need

• A UniFi gateway (UDM, UDM Pro, UCG, UXG) on Network 9.0 or newer. The steps use the Zone-Based Firewall, which came in 9.0.
• A Pi-hole on your main LAN. The commands are for version 6. AdGuard Home works the same way in principle.
• Admin access to the UniFi console and SSH to the Pi-hole.
• About an hour.

1. Let Pi-hole answer other subnets

Do this first. Pi-hole ships in a mode that only answers devices on its own subnet. Anything routed in from a VLAN is silently dropped, and the TV reports "no internet." The log line looks like this:

dnsmasq: ignoring query from non-local network 192.168.20.127

On each Pi-hole:

sudo pihole-FTL --config dns.listeningMode ALL

It takes effect at once. This is safe as long as the Pi-hole sits behind your router with no port forward to it.

2. Create the IoT network

Settings > Networks > Create New.

"Auto DNS Server" is on by default and hands out the gateway itself. Turn it off, or the TVs never learn about Pi-hole.

Nothing moves when you create the network. Clients change only when you bind a Wi-Fi to it.

3. Create a Wi-Fi for the TVs

Settings > WiFi > Create New.

Watch the Advanced section. A new Wi-Fi can come with "IoT Optimization" on, which sets Force WiFi 4 Mode, Lock 2.4 GHz to Channel 6 (All APs), and DTIM Interval Lock. Turn all three off. WiFi 4 is too slow for 4K, and the channel lock changes the channel plan on every access point you own, not just this Wi-Fi.

Why a separate Wi-Fi instead of moving each TV? UniFi has a per-client "Virtual Network Override" setting, but it did not appear for a TV that was online on a 5 GHz-only Wi-Fi, and it did appear for one that was offline. A dedicated Wi-Fi is predictable. Private Pre-Shared Keys are the other clean option if you would rather keep one network name.

4. Join the TVs, then forget the old network on each one

Join each TV to the new Wi-Fi, then forget every other saved network on the TV itself. The LG in this setup joined the new Wi-Fi, ran for five minutes, and quietly reconnected to its old saved network on the main LAN. Forgetting the old networks fixed it for good.

Check in UniFi under Client Devices that each TV shows the IoT network and a 192.168.20.x address.

5. Upgrade to the Zone-Based Firewall

Settings > Policy Engine > Traffic and Firewall Rules shows an "Upgrade to the New Zone-Based Firewall" banner if you are still on the old one. On our system, which had no custom firewall rules, the upgrade converted nothing and changed nothing. It is one way, so read what it says about your own rules first.

Then create a zone for the TVs: Policy Engine > Zones > Create Zone. Name it IoT and put the IoT network in it. Read the note in that dialog: a new zone is blocked from reaching every other zone except External and Gateway, and other zones are blocked from reaching it. Both directions need rules.

6. Firewall rules

Click the cell in the zone matrix for each direction, then Create Policy.

The built-in "Block All Traffic" from IoT to Internal stays and does the scanning fix. Its hit counter climbs every time a TV probes your LAN. "Internal to IoT allow all" is what lets a phone cast to a TV, and return traffic for connections your phone starts is allowed automatically.

For the resolver rule, pick Destination IP, then Add Multiple, and paste this list:

8.8.8.8;8.8.4.4;1.1.1.1;1.0.0.1;9.9.9.9;149.112.112.112;
208.67.222.222;208.67.220.220;94.140.14.14;94.140.15.15;
76.76.2.0;76.76.10.0;185.228.168.9;185.228.169.9

Blocking port 443 to those addresses stops DNS over HTTPS without touching normal HTTPS to Netflix or YouTube.

7. The NAT redirect

This is the rule that actually catches hardcoded DNS. Policy Engine > Policy Table > Create New Policy > NAT.

Any TV that sends plain DNS to 8.8.8.8 now lands on Pi-hole and gets an answer. The firewall rule above catches the same packets, but the redirect is friendlier, because the TV keeps working instead of timing out.

This only works because the TV is on another subnet. On a flat network the Pi-hole would answer the TV directly, the reply would come from the wrong address, and the TV would throw it away.

8. Check that it works

On the Pi-hole, the query log in the web UI shows the TVs by their 192.168.20.x address within a minute. From the shell, use the database. The plain text log may be empty even when everything works, because Pi-hole 6 can have file logging off:

sudo pihole-FTL sqlite3 /etc/pihole/pihole-FTL.db \
  "select client, count(*) from queries where client like '192.168.20.%' group by client"

In UniFi, the zone matrix page lists hit counters per rule. After a day you want a large number on the DNS allow rule, a growing number on the IoT to Internal block, and ideally zero on the two External block rules. Zero there means the TVs gave up on encrypted DNS and are using Pi-hole.

9. Pi-hole lists

Add the LG safe list as an adlist:

https://raw.githubusercontent.com/furkan-bayrak/lg-tv-blocklist/main/lists/safe-domains.txt

The safe tier keeps Netflix, Prime, YouTube, and the LG store working. Skip the strict tier unless you want firmware updates and the LG account gone.

Then add these by hand. Wildcard denies for third-party ad and content recognition networks, plus LG's Americas telemetry hosts, which the list misses:

sudo pihole --wild alphonso.tv ueiwsp.com yumenetworks.com smartclip.com \
  smartclip.net lgsmartad.com wiselg.com lgtviot.com elastic.lgwebostv.com

Exact denies for the public DNS over HTTPS endpoints, so the TV cannot even find them by name:

sudo pihole deny dns.google cloudflare-dns.com dns.quad9.net \
  doh.opendns.com dns.adguard.com

And allows for LG's update hosts. One of them is on common blocklists, which silently breaks firmware updates:

sudo pihole allow ngfts.lge.com aic-ngfts.lge.com aic-gfts.nextlgsdp.com \
  snu.lge.com su-ssl.lge.com

Do not block lgtvsdp.com, lgappstv.com, or nextlgsdp.com subdomains beyond what the safe list does. They run the app store and the voice remote. If you have two Pi-holes, do all of this on both, because they do not sync.

10. Settings on the LG itself

• Settings > General > Additional Settings > Home Settings: Home Promotion off, Content Recommendations off.
• Settings > General > Additional Settings: Live Plus off. This is the content recognition that watches what is on screen.
• Support > Privacy & Terms: turn off ad personalization and decline the AI and ThinQ agreements you can. Skip the LG account.
• Turn off Quick Start+, so the TV is really off in standby.

The network scan comes from the ThinQ device discovery. There is no toggle for it. The VLAN is the fix.

Things that bit us

• Pi-hole's listening mode, step 1. Without it the whole VLAN has no DNS.
• Auto DNS Server on the new network, step 2. It hands out the gateway, not Pi-hole.
• The IoT Optimization preset on the new Wi-Fi, step 3. It rewrites channels on every access point.
• The TV silently going back to its old Wi-Fi, step 4.
• The empty text log on Pi-hole 6, step 8. We spent ten minutes thinking the redirect was broken.
• A firmware update host blocked by a general ad list, step 9.

Where to go next

The same pattern moves the rest of your smart-home gear. Sonos, Nest, and Ring are all known to fall back to Google DNS. Move them one brand at a time, add the allow rules each one needs, and test before the next. Sonos needs the most care, because the controller app on your phone talks to the speakers on several ports.

To find out which devices on your main LAN are bypassing Pi-hole today, open Insights > Flows in UniFi and filter on destination port 53. Anything that shows up is sending DNS straight to the internet.

Sources

• furkan-bayrak/lg-tv-blocklist, the LG TV blocklist
• Redirecting DNS traffic using UniFi DNAT and Pi-hole
• UniFi community: AirPlay and Cast firewall rules on an IoT VLAN