Block Ads and Trackers Before They Reach Any Device on Your Network
AdGuard Home is a self-hosted DNS server that filters out ads, trackers, and malicious domains at the network level – before any request even reaches a browser or app. Unlike browser extensions that protect only one device, a single AdGuard Home instance covers every device connected to your router, from smart TVs to gaming consoles to guests on your Wi-Fi.
What You Need Before You Start
AdGuard Home runs on almost anything: a Raspberry Pi, an old desktop, a VPS, or a NAS device. The key requirement is that the machine stays on around the clock, because if your DNS server goes down, your entire network loses internet access. A Raspberry Pi 4 with a reliable power supply is a popular choice for home setups – low power draw, silent operation, and enough processing power to handle thousands of DNS queries per minute without breaking a sweat.
You will also need to assign a static IP address to the machine running AdGuard Home. This is non-negotiable. If the IP changes, your router will be pointing DNS requests at nothing, and you will spend an unpleasant evening troubleshooting from your phone. Set the static IP either through your router’s DHCP reservation feature (the cleaner option) or directly on the host machine through its network configuration. Note the IP address down – you will use it multiple times throughout this setup.
Make sure ports 53 (DNS), 3000 (initial setup), and 80 or 443 (dashboard, if you choose to expose it) are not already in use on the host machine. On Linux, you can check this quickly with sudo ss -tulpn | grep -E ‘:53|:3000|:80’. On systems running systemd-resolved – which includes most modern Ubuntu installations – port 53 will already be occupied. You will need to disable that service before AdGuard Home can bind to the port.
To disable systemd-resolved, run sudo systemctl stop systemd-resolved followed by sudo systemctl disable systemd-resolved. Then edit /etc/resolv.conf to point at a temporary upstream DNS like 1.1.1.1, so the machine itself retains internet access during setup. Once AdGuard Home is running, you can update resolv.conf to point at 127.0.0.1 so the host machine also routes through its own filter.
Installing and Configuring AdGuard Home
Download and install AdGuard Home using the automated install script. Run the following as root or with sudo:
curl -s -S -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s — -v
The script detects your OS and architecture, downloads the correct binary, installs it as a system service, and starts it automatically. Once it finishes, open a browser and navigate to http://[your-machine-ip]:3000. The setup wizard walks you through four short steps: choosing the network interface AdGuard Home listens on, setting the admin dashboard port, creating a username and password, and confirming the DNS port. For most home setups, leaving the DNS port at 53 and the dashboard at port 80 or 3000 is fine.
After completing the wizard, log into the dashboard. The first thing to configure is your upstream DNS servers, found under Settings > DNS Settings. These are the servers AdGuard Home forwards non-blocked queries to. Popular choices include Cloudflare (1.1.1.1), Google (8.8.8.8), or privacy-focused options like Quad9 (9.9.9.9), which also blocks known malicious domains at the resolver level. You can add multiple upstreams and enable parallel querying, which sends the request to all upstreams simultaneously and uses whichever responds first – this reduces latency noticeably.
Next, add your blocklists under Filters > DNS Blocklists. AdGuard Home ships with several pre-loaded options, but the most widely used community list is Steven Black’s Hosts file, which consolidates ad, tracking, malware, and social media domains into a single regularly updated list. AdGuard’s own DNS filter is also solid. Add the lists you want, click Apply, and AdGuard Home will download and parse them automatically. A reasonable starting setup with two or three lists will block somewhere in the range of 150,000 to 300,000 domains without causing noticeable breakage on legitimate sites.
You will almost certainly need to whitelist a few domains after enabling filtering. Streaming services sometimes use domains that get swept up in tracker blocklists. Smart home devices – particularly cheaper ones – occasionally rely on analytics endpoints for basic functionality. The dashboard’s query log (under the Query Log tab) makes this easy: every DNS request is logged in real time with a pass or block status, and you can whitelist a domain with a single click directly from the log entry. Check the log for the first day or two after setup to catch anything that breaks.
DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) are worth enabling if privacy is a concern. Under Settings > Encryption, you can configure AdGuard Home to accept encrypted DNS queries from clients that support it. This requires a domain name and a valid TLS certificate, which you can obtain free from Let’s Encrypt. Devices like iPhones (iOS 14 and later) and Android phones (Android 9 and later) support encrypted DNS natively and can be pointed directly at your AdGuard Home instance over DoH without any app install.
Pointing Your Router at AdGuard Home
With AdGuard Home running and configured, the final step is directing your router to use it as the DNS server for the entire network. Log into your router’s admin interface and find the DHCP settings – typically under LAN or Network settings. Replace the primary DNS field with the static IP address of your AdGuard Home machine. Set the secondary DNS to a public resolver as a fallback, though be aware that if clients use the fallback, those queries bypass AdGuard Home entirely. Some users prefer to leave the secondary DNS blank and accept that a brief outage means no DNS resolution rather than unfiltered resolution.
After saving the router settings, connected devices will pick up the new DNS server when their DHCP lease renews – which happens automatically, but you can speed it up by disconnecting and reconnecting devices or running ipconfig /flushdns on Windows or sudo dscacheutil -flushcache on macOS. Open the AdGuard Home dashboard and watch the query log populate with traffic from every device on your network. At that point, the filter is live. The real test is whether the ads disappear on a device that normally shows them – and whether the dashboard’s stats start climbing, because on an average home network, somewhere between 15 and 30 percent of all DNS queries will hit the blocklist within the first hour.
