Homelab 4: block ads and trackers for the whole house with AdGuard Home

Level BeginnerEstimated time 30 minRead first Homelab 1: Proxmox, the base under every serviceA word you don't know? Glossary

Every device on your network asks a DNS server where to find a name before it connects. Answer those questions yourself and you decide what gets through: ad and tracker domains get nothing, on every phone, TV and console, with nothing to install on them. AdGuard Home is an open-source DNS server built for exactly that.

Every device asks the same DNS. An ad or tracker gets nothing; your own domain gets the proxy's address on the local network, so internal traffic stays home and stays filtered; everything else goes out encrypted.

A bit of history

Blocking ads by DNS became popular with Pi-hole in 2015: instead of filtering each page, answer "nothing here" when any device asks for the address of a tracker. AdGuard Home, released in 2018, follows the same idea with a single program and encrypted DNS built in. One server protects every device on the network, phones and TVs included.

1. Run it

On a small VM or container (Homelab 1), from the official image, version pinned:

services:
  adguardhome:
    image: adguard/adguardhome:v0.107.79
    restart: unless-stopped
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "3000:3000/tcp"
    volumes:
      - ./work:/opt/adguardhome/work
      - ./conf:/opt/adguardhome/conf

Open http://<address>:3000 for the setup wizard: choose the admin port and an administrator account. If the same machine already runs your HTTPS proxy on port 80, give AdGuard another web port in the wizard.

2. Point the house at it

In your box's DHCP settings, set the DNS server to AdGuard's address. Every device that renews its lease starts using it. Check in AdGuard's dashboard that queries arrive.

3. Upstream: encrypted

For the names it does not block, AdGuard asks an upstream resolver. Choose one over DNS-over-HTTPS, so your provider no longer sees your lookups in clear, for example https://dns.quad9.net/dns-query.

4. The local rewrite

In Filters → DNS rewrites, map your own domain to the proxy's local address (*.yourdomain.tld → the proxy's LAN IP). Without it, your devices reach your own services through your public address and back, a detour some boxes refuse and that bypasses filtering. With it, internal traffic stays home, and your services still work when the internet is down.

Traps

On Ubuntu and other systems running systemd-resolved, port 53 is already taken by its local stub and the container will not start. The official documentation explains how to disable the stub listener first.

Your DNS is now a single point of failure: if it stops, the whole house "loses the internet". Keep it on an always-on machine, back up its configuration, and know how to put the box's DNS back in two clicks.

Never open port 53 to the internet: an open resolver is used by others for amplification attacks.

On a laptop, set the DNS per network connection rather than globally: at home it uses AdGuard, elsewhere the visited network's DNS takes over and nothing breaks.

Add block lists sparingly. One broken list can block a bank or a login page; when something stops loading, look at the query log first.

Sources

Found this useful? Tell us what to measure next.