Pi-Hole does a lot but it acts against DNS queries, that is, requests done in the open through normal name resolution. If a malicious software or piece of hardw

Pi-Hole does a lot but it acts against DNS queries, that is, requests done in the open through normal name resolution. If a malicious software or piece of hardware wants to pester the user with ads, or spy on them, through connections to hardcoded IPs without using DNS queries then only a properly configured firewall can be effective. At least until said malware decides to use a well known service nobody would block to phone home, for example by having a mail client buried in the code that exchanges encrypted blobs with user data and/or ads through a gmail address; who would ever block gmail? In that scenario, if that is a device that doesn't need mail functionality, for example a Smart TV rather than a PC, a dedicated firewall that blocks any non essential connection to the outside would be mandatory just for that device.