Network-wide filtering with AdGuard Home#

You will end up with every client on the LAN behind a DNS filter, without touching a single client's settings, and with a query log you can search. AdGuard Home runs as a container on the router; the router's own resolver forwards to it.

Before you start#

The operator role and a licence.
The router's resolver configured and the LAN pointed at it.
Container support on the router, and a route to Docker Hub.

The port-53 conflict, first#

Step 1 — Install it#

On Services → Apps, press Install on the AdGuard Home card, as in Install an app. Leave Use the router's own network off, so that AdGuard Home gets its own Address on the app network. The panel fills in the first free address from 10.99.0.10; this guide uses 10.99.0.5.

What this adds lists the change: "Add app “adguard”", with its image, its address and its two storage folders, and, when the router has no app network yet, "Add app network “apps”". Press Install, then Apply changes.

The two volumes are the query log and statistics (work) and the configuration (conf). Both are under /config, so they survive an image upgrade and are not removed when you uninstall.

Step 2 — Run its setup wizard#

The catalogue entry's second note: The first run serves a setup wizard on port 3000; after setup, the web interface is on port 80.

Open http://10.99.0.5:3000 from a machine that can reach the apps network, and work through the wizard. Open ↗ on the app's page opens the same address: the app's address, and the port its catalogue entry names for the web interface.

Step 3 — Point the router's resolver at it#

Once AdGuard is running, the DNS page grows a card:

Point the resolver at AdGuard Home — Forward the router’s DNS queries to AdGuard Home, so every device on the network is filtered without changing its settings.

with Add this change. That is an integration offer, and the address in its change is AdGuard Home's own, read from the router rather than written into the catalogue: Show what this changes lists 10.99.0.5 added as a DNS server the router forwards queries to. Press Add this change.

Remove the upstream resolvers the forwarder had, so everything goes through the filter:

delete service dns forwarding name-server 9.9.9.9
delete service dns forwarding name-server 1.1.1.1

AdGuard now does the upstream resolution, configured in its own interface.

Step 4 — Apply#

Review the pending changes and press Apply changes. Clients go through the filter from then on.

Check it worked#

A blocked name is blocked, and an ordinary one is not:

bash

dig @192.0.2.1 example.com

And AdGuard sees the queries. Its query log shows them arriving from the router's address — see below.

The container is healthy. Apps → Installed shows declared beside running, with the health probe's verdict — a TCP connection to port 3000 plus an HTTP request to /.

Every query looks like it came from the router#

Because it did. The router's forwarder is the client as far as AdGuard is concerned, so per-client rules and the per-client view in AdGuard's own interface see one client.

If you want per-client policy, point the clients at AdGuard directly instead of at the router's forwarder:

set service dhcp-server shared-network-name LAN subnet 192.0.2.0/24 option name-server 10.99.0.5

That needs the apps network reachable from the LAN, which is a firewall and routing decision rather than a DNS one, and it takes the router's own resolver out of the path — including its authoritative records. Decide which you want; you cannot have both cleanly.

Alternatives in the same category#

The catalogue has five entries under DNS and filtering: AdGuard Home, Pi-hole, Blocky, Unbound and dnsmasq. The first three do roughly this job with different interfaces; Unbound is a validating resolver rather than a filter; dnsmasq is there for a different reason.

Undoing it#

Put the upstream resolvers back in the same apply as the uninstall, or the LAN loses DNS.

set service dns forwarding name-server 9.9.9.9
delete service dns forwarding name-server 10.99.0.5

Press Uninstall on AdGuard Home's page, and apply it with the resolver changes in one Apply changes.

The data under /config/apps/adguard stays behind on purpose — Stop, uninstall, and what stays behind.

Network-wide filtering with AdGuard Home#

Before you start#

The port-53 conflict, first#

Step 1 — Install it#

Step 2 — Run its setup wizard#

Step 3 — Point the router's resolver at it#

Step 4 — Apply#

Check it worked#

Every query looks like it came from the router#

Alternatives in the same category#

Undoing it#

See also#