How to Self-Host AdGuard Home and Block Ads Across Your Entire Network

What Is AdGuard Home?

AdGuard Home works by acting as the DNS server for your home network. Every time a device on your network tries to look up a domain name, the request goes through AdGuard Home first. If the domain is on a blocklist an ad network, a tracker, a known malware domain AdGuard returns nothing and the request dies there. The device never loads the ad or sends data to the tracker. Everything else passes through to your upstream DNS provider as normal.

Because it operates at the DNS level, it works on every device automatically. Smart TVs, games consoles, IoT sensors, phones on your Wi-Fi none of them need an app installed. You configure one server and the whole network benefits.

Fix Port 53 Conflict on Ubuntu and Debian

DNS runs on port 53. On Ubuntu and most modern Debian-based systems, a service called systemd-resolved is already listening on 127.0.0.53:53. When Docker tries to bind AdGuard Home to port 53, it fails with an address-in-use error. You need to disable the stub listener before starting the container.

sudo mkdir -p /etc/systemd/resolved.conf.d

sudo tee /etc/systemd/resolved.conf.d/adguardhome.conf <<'EOF'
[Resolve]
DNS=127.0.0.1
DNSStubListener=no
EOF

sudo mv /etc/resolv.conf /etc/resolv.conf.backup
sudo ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf
sudo systemctl reload-or-restart systemd-resolved

Port 53 is now free. You can verify this by running sudo ss -tulpn | grep :53 the output should be empty.

Install AdGuard Home with Docker Compose

mkdir adguard && cd adguard
mkdir -p work conf

services:
  adguardhome:
    image: adguard/adguardhome:latest
    container_name: adguardhome
    restart: unless-stopped
    volumes:
      - ./work:/opt/adguardhome/work
      - ./conf:/opt/adguardhome/conf
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "3000:3000/tcp"
      - "127.0.0.1:8080:80/tcp"

Port 53 handles DNS queries from your devices. Port 3000 serves the initial setup wizard. Port 8080 on the host maps to port 80 inside the container, which is the admin dashboard after setup is complete. Binding the admin dashboard to 127.0.0.1:8080 keeps it off your local network you will access it through a Localtonet tunnel.

docker compose up -d
docker compose ps

Open http://localhost:3000 in your browser to start the setup wizard.

Complete the Setup Wizard

# Cloudflare DNS-over-HTTPS
https://dns.cloudflare.com/dns-query

# Google DNS-over-HTTPS
https://dns.google/dns-query

# Quad9 DNS-over-HTTPS (malware blocking)
https://dns.quad9.net/dns-query

Using DNS-over-HTTPS upstream means your DNS queries to the internet are encrypted. Your ISP cannot see which domains your devices are looking up.

Point Your Router at AdGuard Home

The most effective way to use AdGuard Home is to set it as the DNS server in your router's DHCP settings. When the router hands out IP addresses to devices, it also tells them to use AdGuard Home for DNS. Every device on your network uses it automatically with no per-device configuration.

ip route get 1.1.1.1 | awk '{print $7; exit}'

Add Blocklists

AdGuard Home ships with a default blocklist, but you can add more for broader coverage. Go to Filters → DNS blocklists → Add blocklist → Choose from the list to browse curated lists, or add any URL directly.

Access the AdGuard Home Dashboard Remotely with Localtonet

The AdGuard Home admin dashboard is bound to 127.0.0.1:8080 in the Compose file above, so it is only reachable on the machine running the container. To check your query statistics, manage blocklists, or whitelist a domain from your phone or a remote computer, create a Localtonet HTTP tunnel for port 8080.

curl -fsSL https://localtonet.com/install.sh | sh
localtonet --authtoken <YOUR_TOKEN>

Keep Everything Running After a Reboot

The Compose file has restart: unless-stopped so the AdGuard Home container comes back with Docker after every reboot. Register Localtonet as a systemd service so the dashboard tunnel also returns automatically:

sudo localtonet --install-service --authtoken <YOUR_TOKEN>
sudo localtonet --start-service --authtoken <YOUR_TOKEN>

Verify both services are active:

docker compose ps
systemctl status localtonet

After this, rebooting the host brings AdGuard Home and the remote dashboard URL back automatically. Your network keeps blocking ads even if you are not home, and you can manage it from anywhere.

Frequently Asked Questions

docker compose pull
docker compose up -d