AdGuard Home

AdGuard Home is a DNS server that you run yourself. When a device looks up an ad or tracker domain, AdGuard Home returns a fake answer, so the device never connects to that server. Try it on one computer first before you point the whole network at it.

This review is for people who manage a home or small-office network. After reading it, you can do the following:

• Install AdGuard Home on your own computer and point only that computer’s DNS at it
• Use the query log to see which domains were blocked
• Know how to roll it out to the whole network by changing your router’s DNS setting

##What AdGuard Home does

The official README and Knowledge Base list these features:

• Blocks ad and tracker domains with blocklists (filters) that you choose, plus your own rules
• Blocks phishing and malware domains (Browsing Security) and adult sites (Parental Control). Both are off by default
• Encrypts lookups to upstream DNS servers with DNS-over-HTTPS, DNS-over-TLS, DNS-over-QUIC, or DNSCrypt
• Runs as a DNS-over-HTTPS or DNS-over-TLS server itself
• Shows which device looked up which domain, in the query log and statistics
• Applies different settings, such as filtering or Parental Control, to each device (client)
• Includes a built-in DHCP server

It also works on devices where you can’t install an ad blocker, such as smart TVs and smart speakers.

##Network connections it makes

According to the privacy notice, AdGuard Home connects to outside servers only in these cases. It does not send usage data to AdGuard.

You can turn off the update check with the --no-check-update option.

##Try it safely on one computer

The official “Setting up AdGuard Home securely” page recommends the loopback address (127.0.0.1) if you run AdGuard Home for your computer only. With that setting, no other device’s traffic reaches it. These steps use Windows as the example.

1. Download the archive for your operating system from the releases page and extract it. The supported platforms page lists every OS and CPU.
2. Open cmd.exe or PowerShell as an administrator and run AdGuardHome.exe from the extracted folder. DNS uses port 53, which usually requires administrator rights.
3. Open http://127.0.0.1:3000 in your browser to start the setup wizard. At this point AdGuard Home listens on port 3000 on all interfaces (0.0.0.0), so finish the wizard promptly.
4. In the wizard, choose 127.0.0.1 as the DNS listen address, and set a username and password for the admin interface.
5. In Control Panel, open Network and Sharing Center>Change adapter settings. Open the properties of your active connection, select Internet Protocol Version 4 (TCP/IPv4), choose Use the following DNS server addresses, and enter 127.0.0.1.
6. Run nslookup example.org in Command Prompt and check that the Server line shows 127.0.0.1.
7. If the lookup for example.org appears in the query log in the admin interface, it is working.

To undo this, set the DNS setting from step 5 back to automatic.

##Other ways to install, and rolling it out to the network

On Linux, you can run it without root by granting it a capability with setcap or by changing the listen port.

To cover the whole network, install AdGuard Home on a device that is always on, and set the listen address to its LAN address (for example, one starting with 192.168.). Then enter that address in your router’s DHCP/DNS settings, and every device on the router uses it. If your router can’t change its DNS server, you can use AdGuard Home’s DHCP server instead.

##The query log and privacy

Once it covers the whole network, the query log records every domain that family members’ or coworkers’ devices look up. Whoever runs it can see what sites people visit. Tell the people who use the network before you roll it out.

The logs stay on the device that runs AdGuard Home, and the administrator decides how long to keep them. These configuration file settings control this:

• querylog.interval: how long to keep the query log, from 1 hour (1h) to 1 year (8760h)
• dns.anonymize_client_ip: anonymizes device IP addresses in logs and statistics
• Per-client ignore_querylog: keeps a device’s lookups out of the log

##Cautions

##Read next

• cd ../ublockuBlock Origina browser extension that blocks ads and trackers inside the browser, including some ads DNS can’t block
• cd ../wiresharkWiresharklets you see in packet captures where your DNS lookups actually go