Set Up AdGuard Home as a Pi-hole Alternative on Linux

A Cleaner Network Starts at the DNS Level

Pi-hole has long been the default recommendation for anyone wanting network-wide ad blocking at the DNS level. It works well, but the setup process is aging, the interface feels dated, and newer alternatives have caught up in meaningful ways. AdGuard Home covers the same ground – blocking ads and trackers before they reach any device on your network – while adding a more polished web dashboard, built-in DoH and DoT support, and a simpler configuration experience out of the box.

This guide walks through installing AdGuard Home on a Linux machine, pointing your network traffic through it, and locking down the configuration so it actually holds up over time. You do not need a Raspberry Pi specifically. Any Linux host running Debian, Ubuntu, or a Red Hat-based distro will work, including a home server, an old laptop, or a cheap VPS you control locally.

What You Need Before You Start

The requirements are minimal. You need a Linux machine with a static IP address on your local network, root or sudo access, and port 53 free to use. That last part is the most common stumbling block on modern Ubuntu systems, where systemd-resolved binds to port 53 by default. You will need to disable that before AdGuard Home can take over DNS duties. Port 80 also needs to be available during initial setup for the web installer, though you can change the dashboard port afterward.

Before touching anything, confirm your machine’s IP address is static either through your router’s DHCP reservation settings or by configuring a static address directly on the interface. If that IP changes, every device on your network loses DNS resolution until you update your router settings manually. Set it and forget it now to avoid that problem entirely.

Installing AdGuard Home

AdGuard Home distributes a single install script that handles architecture detection and service registration automatically. Run the following as root or with sudo:

curl -s -S -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -v

The script downloads the correct binary for your architecture, places it in /opt/AdGuardHome/, and registers it as a systemd service. Once it finishes, open a browser and navigate to http://YOUR_SERVER_IP:3000. The setup wizard walks you through choosing which network interface to listen on, setting the admin dashboard port, and creating your admin credentials. For most home setups, binding to all interfaces on port 53 for DNS and port 80 for the dashboard is fine. You can tighten that later.

If the installer fails on port 53, you are likely hitting the systemd-resolved conflict on Ubuntu. Fix it by editing /etc/systemd/resolved.conf, setting DNSStubListener=no, then running sudo systemctl restart systemd-resolved. After that, retry the setup wizard. On Debian systems without systemd-resolved active, this step is usually unnecessary.

After completing the wizard, the service starts automatically and survives reboots. You can verify it is running with sudo systemctl status AdGuardHome. The dashboard at your chosen port will show live DNS query logs almost immediately once devices start routing through it.

Pointing Your Network to AdGuard Home

The cleanest way to redirect all devices is through your router’s DHCP settings. Log into your router admin panel and find the DNS server field under DHCP or LAN settings. Replace whatever is there with your AdGuard Home machine’s static IP. Save and let devices renew their leases – most will pick up the change within a few minutes, or you can force it by disconnecting and reconnecting to Wi-Fi on individual devices.

Some routers, particularly ISP-provided ones, do not allow you to change the DNS field. In that case, you can configure DNS manually on each device you care about, or set up AdGuard Home as a DHCP server itself and disable DHCP on the router. The second option is more thorough but requires more care – running two DHCP servers on the same network causes conflicts, so make sure the router’s DHCP is fully off before enabling AdGuard’s.

Configuring Blocklists and Upstream DNS

AdGuard Home ships with one default blocklist enabled, but the real filtering power comes from adding more. In the dashboard, go to Filters – DNS Blocklists and add lists from sources like the AdGuard DNS filter, EasyList, OISD, or Steven Black’s hosts list. Each covers slightly different categories – some focus on ads, others on trackers, malware domains, or telemetry. Running three to five complementary lists is more effective than stacking twenty overlapping ones, which just slows query resolution without adding meaningful coverage.

Upstream DNS is where AdGuard Home separates itself from Pi-hole most clearly. Under Settings – DNS Settings, you can set upstream resolvers using plain DNS addresses, or switch to encrypted options like DNS-over-HTTPS or DNS-over-TLS without installing anything extra. Using https://dns.cloudflare.com/dns-query or tls://dns.quad9.net as your upstream means queries leaving your network are encrypted, which prevents your ISP from seeing your DNS traffic even if they cannot see AdGuard’s blocking behavior. Pi-hole requires a separate tool called Unbound or cloudflared to achieve the same result.

Enable DNSSEC validation in the same settings panel. It verifies that DNS responses have not been tampered with in transit. The performance hit is negligible on modern hardware, and it closes a category of attack that plain DNS resolvers are vulnerable to by design.

Keeping It Running Long-Term

AdGuard Home updates itself through the dashboard under Settings – Update, which makes staying current straightforward. Blocklists refresh automatically on a schedule you can configure, so you do not need to manually pull updates. The query log is stored locally and rotates based on settings you control – if you are privacy-conscious about logging DNS queries even on your own hardware, you can reduce retention or disable logging entirely without affecting blocking performance.

One thing to set up before you consider the installation complete: a local DNS rewrite entry for your AdGuard Home machine itself. Under Filters – DNS Rewrites, add an entry mapping a simple hostname like adguard.home to your server’s IP. This way you can reach the dashboard by name from any device on the network without remembering the IP address – and if you ever reassign that IP, you only update one record instead of hunting through bookmarks.

If you run other self-hosted services on the same machine – or plan to – keeping AdGuard Home on a dedicated static IP with a reserved hostname avoids the DNS resolution loops that sometimes affect self-hosted stacks when the DNS server and the app server share the same host. It is not always a problem, but it becomes one at the worst possible moment when you are troubleshooting something unrelated late at night.