AdGuard Home: Ad Blocking + Encrypted DNS

What You'll Build

AdGuard Home blocks ads and trackers for every device, like Pi-hole, and adds a few extras out of the box: encrypted DNS to your upstream provider (so your ISP can't read your lookups), simple wildcard rewrites, per-device rules, and parental controls / safe search.

Ports: 53 (DNS), 3004 (first-time setup), 8083 (web admin) · Time: 30 minutes · Difficulty: Easy

What You Need

• Your home server from Foundations 1 (Docker installed, ~/stacks folder).
• Nginx Proxy Manager with your *.home.example.com certificate (recommended).
• Port 53 freed on Ubuntu — follow Step 1 of the Pi-hole guide (identical for AdGuard Home).

Step 1: Start AdGuard Home

mkdir -p ~/stacks/adguard && cd ~/stacks/adguard
nano compose.yaml

services:
  adguardhome:
    image: adguard/adguardhome:latest
    container_name: adguardhome
    restart: unless-stopped
    ports:
      - "53:53/tcp"          # DNS
      - "53:53/udp"          # DNS
      - "3004:3000/tcp"      # first-time setup wizard only
      - "8083:80/tcp"        # web admin after setup
    volumes:
      - ./work:/opt/adguardhome/work   # query logs, statistics
      - ./conf:/opt/adguardhome/conf   # AdGuardHome.yaml settings

docker compose up -d
sudo ufw allow 53

Step 2: The Setup Wizard

1. Open http://192.168.1.50:3004 → Get Started.
2. Admin Web Interface: All interfaces, port 80 (inside the container — you'll reach it on 8083).
3. DNS server: All interfaces, port 53.
4. Create the admin username and password → finish.
5. From now on, open http://192.168.1.50:8083.

Step 3: Encrypted Upstream DNS

Settings → DNS settings → Upstream DNS servers. Replace the default with encrypted resolvers, one per line:

https://dns.quad9.net/dns-query
https://cloudflare-dns.com/dns-query

Choose Parallel requests for speed, click Test upstreams, then Apply.

Step 4: Point Your Network at It

In your router's DHCP settings, set the DNS server to 192.168.1.50 and remove any secondary. Reconnect a device, browse, then check Dashboard and Query Log.

Step 5: Blocklists, Rewrites, and Per-Device Rules

• Filters → DNS blocklists → Add blocklist → Choose from the list: tick a couple (e.g. an AdGuard DNS filter plus a well-known tracker list).
• Filters → DNS rewrites → Add: domain *.home.example.com, answer 192.168.1.50. All your app names now work at home.
• Settings → Client settings → Add client: name a kid's tablet by IP and turn on safe search, parental control, or block specific services (e.g. TikTok) just for that device.
• Unblocking: in the Query Log, hover a blocked entry → Unblock.

Add It to Your Proxy, Dashboard, and Backups

• Nginx Proxy Manager: new proxy host adguard.home.example.com → scheme http, 192.168.1.50, port 8083, Websockets on, your wildcard certificate, Force SSL.
• Homepage: add a tile in services.yaml (how).
• Uptime Kuma: add an HTTP monitor for the new address (how).
• Backups: ~/stacks/adguard is already covered by the restic script.

Troubleshooting

• Port 53 in use — see freeing port 53, and make sure Pi-hole isn't also running.
• Wizard page won't load after setup — expected: port 3004 is only used for first-time setup. Use 8083.
• All queries show the router as the client — the router is forwarding. Hand out AdGuard's IP via DHCP instead.

What's Next?