What It Is
AdGuard Home is a DNS server I run at home. All internet requests from every device in the household go through it first, and it then forwards them upstream. It blocks ad and tracking domains at the resolution layer, and also performs domain-based split routing, so domestic and overseas resolutions each use their own route. Nothing needs to be installed on the devices; just change the router's DNS and all devices take effect.
Why I Did It
The devices at home are too diverse: phones, TVs, tablets, and a bunch of IoT devices. Installing ad-blocking plugins one by one is unrealistic, and many devices cannot install them at all. Putting filtering at the DNS layer means maintaining only one place, and the whole household's browsing experience improves together. I also set up split routing along the way, saving the trouble of configuring each device individually.
Current Status
Running, and it is the first hop of the household network. There is a companion adguard-healthcheck.sh that runs on a schedule to monitor whether DNS is still working properly. I previously investigated an issue where a phone on 5G couldn't open websites; the final conclusion was the carrier link, not DNS—for this type of failure, my habit is to confirm layer by layer before changing configuration, rather than changing upstream right away.
Features
- 全家设备统一走一个 DNS 入口，改路由器就对所有设备生效
- 按域名分流上游，国内、国外解析走不同线路
- 在解析层拦截广告与追踪域名，减少页面加载干扰
- 配 adguard-healthcheck.sh 定时巡检，DNS 异常能及时发现
- 保留备用 DNS，主服务出问题时还有退路
Stack: AdGuard Home · DNS · Docker · Shell · 上游转发 · 健康检查
1. Preparation
Find an always-on machine (mine is at .164), assign it a static LAN IP, and install Docker. Confirm that port 53 is not occupied by systemd-resolved or dnsmasq; if it is occupied, stop it first, otherwise the container will not start.
2. Start the Container
docker run -d --name adguardhome \
--restart unless-stopped \
-p 53:53/tcp -p 53:53/udp \
-p 3000:3000/tcp \
-v /opt/adguard/work:/opt/adguardhome/work \
-v /opt/adguard/conf:/opt/adguardhome/conf \
adguard/adguardhomeOn first start, use port 3000 to enter the setup wizard, set the admin port and username/password; after setup, remember to close off port 3000 or add authentication.
3. Configure Upstreams and Routing
In "Upstream DNS servers", fill in two groups: one domestic and one overseas; use encrypted DoH/DoT where possible. Then in "DNS settings", assign domains to the corresponding upstreams by rule; test on a small scale first, and only roll it out broadly after confirming the resolution results are correct.
4. Enable Filtering Rules
In "Filters", just enable the default ad-blocking rule lists. Don't add too many all at once; the more rules there are, the more troublesome troubleshooting becomes.
5. Roll Out to the Whole Household
Change the DNS handed out by the router's DHCP to this machine's IP. At the same time, keep a backup DNS; don't fill in only one. After rollout, verify each type of device: test a phone, computer, and TV once each, and check whether there are corresponding records in "Query Log".
6. Set Up a Health Check
Add adguard-healthcheck.sh to cron to run on a schedule to probe whether DNS can still resolve normally; when something goes wrong, you'll know immediately instead of waiting for family members to report "the internet won't open."
7. Verification
nslookup example.com <DNS服务器IP>If it returns normally and there are records in the log, consider it working. After changing upstreams or rules later, run this command again.
