Why Your Router’s Default DNS Is Not Doing You Any Favors
Every device on your network quietly sends DNS queries before loading any webpage, app, or service. Those queries go somewhere – usually your ISP’s resolver or a public one like Google’s 8.8.8.8 – and that resolver logs them, sometimes sells them, and almost never blocks anything harmful along the way. AdGuard Home changes that equation by putting a DNS resolver under your direct control, running on your own hardware, filtering ads and trackers at the network level before a single packet reaches any device on your LAN.
Unlike browser extensions that only protect one device, AdGuard Home covers everything that connects to your network: smart TVs, phones, game consoles, IoT gadgets, and any guest device that joins your Wi-Fi. The filtering happens at the DNS layer, which means apps cannot route around it the way they can sidestep browser-level blockers.
Setup takes under 30 minutes on almost any Linux machine or Raspberry Pi.
What You Need Before You Start
AdGuard Home runs on Linux, macOS, Windows, and ARM devices. A Raspberry Pi 3 or newer handles the load without breaking a sweat, but any always-on Linux box will work. You need root or sudo access, a static local IP assigned to the machine, and port 53 available – that last one is the common sticking point on modern Ubuntu and Debian systems, where systemd-resolved occupies port 53 by default.
To free port 53 on Ubuntu or Debian, edit /etc/systemd/resolved.conf and set DNSStubListener=no, then run sudo systemctl restart systemd-resolved. After that, update the symlink at /etc/resolv.conf to point to a working resolver temporarily – sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf – so the machine itself can still resolve names while you finish the installation. On a plain Debian minimal install or a Raspberry Pi OS image, port 53 is usually free already and you can skip this step entirely.
If you plan to expose the AdGuard Home admin interface beyond your LAN, pairing it with a reverse proxy like Caddy for HTTPS termination is a straightforward way to add TLS without touching AdGuard’s own certificate handling. For a purely internal setup, plain HTTP on your local network is fine.
Installing AdGuard Home
The fastest path is the official install script. Run this as root or with sudo:
curl -s -S -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s — -v
The script detects your architecture, downloads the correct binary, and registers a systemd service. Once it finishes, open a browser and navigate to http://[your-machine-ip]:3000 to complete the initial configuration wizard. The wizard walks you through choosing which network interface AdGuard Home listens on for DNS (port 53) and which interface serves the web admin panel (default port 3000, which you can change to 80 or 443 later). You will also create an admin username and password here – pick something strong, since this panel controls your entire network’s DNS behavior.
After the wizard closes, the service moves to port 53 for DNS and your chosen port for the web UI. Confirm the service is running with sudo systemctl status AdGuardHome. If port 53 was already freed as described above, the service starts cleanly on the first attempt. If it fails, sudo ss -tlnp | grep :53 shows what is still holding the port.
Configuring Filters and Pointing Your Network at AdGuard Home
Log into the admin panel and go to Filters – DNS Blocklists. AdGuard Home ships with its own default list, but adding more takes seconds. The most widely used choices are AdGuard DNS filter, EasyList, and the OISD blocklist – all available directly from the panel’s built-in list browser. Enable two or three well-maintained lists rather than stacking a dozen mediocre ones; overlapping lists slow query processing without meaningfully improving coverage. The Filters – DNS Allowlists section handles false positives – if a domain you need gets blocked, add it there rather than disabling an entire blocklist.
Under Settings – DNS Settings, configure your upstream resolvers. The default points to AdGuard’s own public servers, but you can swap in Cloudflare (1.1.1.1), Quad9 (9.9.9.9), or any resolver you prefer. Enabling DNS-over-HTTPS or DNS-over-TLS for the upstream connection encrypts the traffic between AdGuard Home and the resolver, which prevents your ISP from seeing which domains your resolver queries even if they cannot see individual device queries. The option is in the same DNS Settings panel under “Upstream DNS servers” – prefix the address with https:// for DoH or tls:// for DoT.
To make every device on your network use AdGuard Home automatically, log into your router and set its primary DNS server to the static IP of your AdGuard Home machine. Secondary DNS is a judgment call: leaving it blank forces all queries through AdGuard Home; setting a fallback like 1.1.1.1 means filtering stops working if your machine goes offline. For home networks where the filtering is the whole point, leaving secondary DNS blank is the more consistent choice. Devices already connected may need a DHCP lease renewal before the new DNS takes effect – on most operating systems, disconnecting and reconnecting to Wi-Fi is enough.
Checking That It Works
The AdGuard Home dashboard shows real-time query logs under Query Log and a summary of blocked versus allowed requests on the main statistics page. Within a few minutes of pointing your network at the new resolver, you should see traffic from multiple devices populating the log. Blocked entries appear in red with the name of the list that matched them. If everything shows as allowed and nothing is being blocked, check that the router change saved correctly and that a test device is not still using a manually configured DNS address that overrides the router’s setting.
A quick functional test: try resolving a known ad domain like doubleclick.net using nslookup doubleclick.net [your-adguard-ip] from any device on the network. AdGuard Home returns 0.0.0.0 for blocked domains, which is exactly what you want to see. The Query Log will record the block in real time, confirming the filter is active.
AdGuard Home also supports per-client settings, which means you can apply stricter filtering to certain devices – a child’s tablet, for example – while leaving others on a lighter ruleset. Each client is identified by IP address or MAC address in the Settings – Client Settings panel, and from there you assign it a custom filtering profile. That single feature makes AdGuard Home more flexible than most commercial parental control products, and it costs nothing beyond the hardware you already own.
