AdGuardHome is an ad-blocking application, but it’s not just for blocking ads. It can also serve as a DNS server for your local network.

Installation

Since this application is related to network management, I installed it on OpenWrt. During compilation, simply check the luci-app-adguardhome option.

Then download the core in the OpenWrt management page (you may need a VPN or proxy).

Ad Blocking

  • The web management interface is on port 3000 by default.

  • Default username and password are admin and admin.

  • In Settings → DNS Settings → Upstream DNS servers, you can add public DNS servers, for example:

    # International
8.8.8.8
1.1.1.1

    # China
223.5.5.5
114.114.114.114

  • Then change your device’s DNS server to OpenWrt.

Default DNS Server

  • OpenWrt’s default DNS server is dnsmasq, which listens on port 53. Since we’ve already installed AdGuardHome, we can make it the DNS server. In OpenWrt terminal, run:

    uci set dhcp.@dnsmasq[0].port='0'
uci commit dhcp
/etc/init.d/dnsmasq restart

    This makes dnsmasq stop listening on port 53.

  • Then modify AdGuardHome’s configuration file. Its default port is 1753, but we can change it to 53:

    # vim /etc/AdGuardHome.yaml
dns:
  bind_hosts:
    - 0.0.0.0
  port: 53

  • Restart AdGuardHome:

    /etc/init.d/AdGuardHome restart

  • Now AdGuardHome becomes the default DNS server. The benefit is that you can monitor which device requested which service. Otherwise, all device requests would first be received by dnsmasq, then forwarded to AdGuardHome, making all requests appear to come from localhost.

Naming Devices

  • Another benefit of setting AdGuardHome as the default DNS server is the ability to name individual devices. Previously, I had to remember the Debian server’s IP address; now I only need to remember the device’s domain name.

  • In Filters → DNS Rewrite, add rewrite rules:

    DNS Rewrite

  • Now I can access the OpenWrt Web Manager directly by entering http://openwrt.home in my browser.

Changing Username and Password

  • While the username and password aren’t critical since AdGuardHome only runs on the internal network (I haven’t deployed OpenWrt to the public internet), it’s still a good practice to change them from admin/admin, which is too risky.

  • See: Configuration · AdguardTeam/AdGuardHome Wiki · GitHub

  • If you have Alpine, you can run it inside Alpine:

    docker run --rm alpine sh -c 'apk add --no-cache apache2-utils >/dev/null && htpasswd -B -C 10 -n -b username password'