- Implementation of a centralized DNS server to block advertising and trackers across the entire home network.
- Privacy optimization through the use of encrypted DNS protocols such as DoH and DoT.
- Advanced integration with Unbound to create your own recursive resolver and gain autonomy.
- Detailed customer management and parental controls to protect minors from inappropriate content.
If you're fed up with ads invading your screen and companies tracking your every move online, setting up your own DNS server is the ultimate solution. AdGuard Home is presented as a powerful tool that acts as a barrier against advertising and malware, filtering traffic before it even reaches your devices, making browsing at home much easier.
The best part is that, by running it through Docker containers , we can forget about tedious technical complications and deploy it on almost any hardware, from a Synology NAS or an advanced ASUS router to a Raspberry Pi with AdGuard Home or an Orange Pi with Arch Linux. There's no need to install extensions in each browser; once configured, the entire network is automatically protected, including those Smart TVs or IoT devices that are impossible to modify.
Preparing the ground: Requirements and system
For everything to run smoothly, you need to have Docker and Docker Compose installed . One critical point that often causes headaches is port 53, which is used by DNS. In distributions like Ubuntu or Debian, the systemd-resolved service usually occupies this port by default, so it's essential to disable it so that AdGuard Home can take full control of the queries.
It's crucial that the server hosting the container has a static IP address . If the server's IP address changes, all your devices will lose internet access because they won't know where to query for web addresses. If you're using a Synology NAS, you can manage everything from the Container Manager , creating specific folders for configuration and persistent data, ensuring you don't lose anything when updating the image.
Deployment using Docker Compose
The cleanest way to start the service is using a docker-compose.yml file . In this file, you must map the essential ports: 53 for DNS (TCP and UDP), 80 for the management interface, 3000 for the initial setup wizard, and, if you want advanced features, ports 67 and 68 for the DHCP service . To ensure the service doesn't stop, it's recommended to use the `restart: unless-stopped` directive.
Once the container is running, simply enter the server's IP address followed by port 3000. The wizard is very intuitive and will ask you to define the user and password from the administrator. A trick for those seeking maximum privacy is to configure the DNS upstream encrypted, comparing options such as the Google DNS vs Digi or Quad9, using syntax like tls://dns.googleThis prevents your internet provider from spying on your requests.
Taking privacy to the next level with Unbound
If you want to stop relying on third parties, you can combine AdGuard Home with Unbound . This software works as a recursive resolver, meaning AdGuard will no longer query Google or Cloudflare; instead, Unbound will go directly to the root DNS servers . This eliminates an intermediary and increases your control over your data.
To optimize Unbound in Docker, it is recommended to adjust the receive and send buffers on the host using sysctl.confthus avoiding performance warnings. Furthermore, it is vital to validate that DNSSEC is active, ensuring that DNS responses have not been tampered with along the way, something that can be easily checked with tools like the command dig.
Network settings and parental controls
For this to work, you need to go to your router's settings and change the primary DNS to the IP address of your AdGuard server. An important detail is to manually configure the DHCP name server; if you let the router handle the connection, the AdGuard panel will only show one IP address (the router's) and you won't be able to identify the exact device making each request.
Once the customers appear individually, you can play with the parental controlAdGuard lets you create specific profiles for each family member, blocking gambling services, adult content, or even social media at specific times. You can also use the DNS rewrites to create local domains, allowing you to access your NAS or home automation system by typing something like mi-casa.local instead of remembering a numerical IP address.
Filtering and maintenance lists
The heart of the system lies in its blocklists. While AdGuard provides a solid foundation, adding filters like OISD or Steven Black dramatically improves adware protection and telemetry. If you notice a legitimate website failing to load, don't worry: you can add an exception rule in the custom filtering section using the double @ symbol.
Regarding maintenance, it is vital to carry out backup of the folders config y workYou can automate this with a simple Bash script and a scheduled task in cron that compresses the data into a tar.gz file daily, thus avoiding having to configure everything from scratch if the server disk fails.
Having an ecosystem based on AdGuard Home and Docker allows you to transform a conventional home network into a secure and efficient environment. From the ability to filter malicious domains globally to the ability to manage the network granularly on a per-device basis, the administrator has complete control. By integrating tools like Unbound and encryption protocols, a perfect balance is achieved between browsing speed and absolute privacy, eliminating reliance on public DNS servers and protecting the integrity of every query made within the home.
