DEV Community

Cover image for How to Set Up AdGuard Home as Network-Wide DNS and DHCP on an Airtel Router
Caleb Ajibade
Caleb Ajibade

Posted on AI-assisted

How to Set Up AdGuard Home as Network-Wide DNS and DHCP on an Airtel Router

#networking #docker #tutorial #linux

Many Airtel home routers provide DHCP but do not expose a setting for
choosing the DNS server distributed to connected devices.

That creates a problem if you want to run AdGuard Home for the entire
network. You can install AdGuard and manually configure every phone,
laptop, and TV to use it, but that quickly becomes inconvenient.

A cleaner solution is to let AdGuard Home provide both DNS and DHCP,
while the Airtel router continues to provide Wi-Fi, NAT, and internet
access.

This tutorial shows how to build that setup using:

  • an Airtel home router
  • a Fedora computer
  • Docker and Docker Compose
  • AdGuard Home

The example network used here is:

Router:        192.xxx.x.1
Fedora:        192.xxx.x.13
Network:       192.xxx.x.0/24
Subnet Mask:   255.255.255.0
DHCP Pool:     192.xxx.x.100 - 192.xxx.x.200
Enter fullscreen mode Exit fullscreen mode

Your Airtel router may use different addresses. Check your own network
before copying the IP addresses in this tutorial.

What We Are Building

The final architecture will look like this:

                         Internet
                            │
                            ▼
                    ┌───────────────┐
                    │ Airtel Router │
                    │ 192.xxx.x.1  │
                    │               │
                    │ Gateway + NAT │
                    │ DHCP: OFF     │
                    └───────┬───────┘
                            │
              ┌─────────────┴─────────────┐
              │                           │
              ▼                           ▼
    ┌──────────────────┐             Other Devices
    │ Fedora Computer  │
    │ 192.xxx.x.13    │
    │                  │
    │ AdGuard Home     │
    │ DNS  → Port 53   │
    │ DHCP → Port 67   │
    └──────────────────┘
Enter fullscreen mode Exit fullscreen mode

The responsibilities are split like this:

Airtel Router
├── Wi-Fi
├── Internet connection
├── Default gateway
└── NAT

Fedora + AdGuard Home
├── DNS
├── DNS filtering
├── DNS caching
└── DHCP
Enter fullscreen mode Exit fullscreen mode

Your normal internet traffic does not pass through the Fedora
computer.

DNS:
Phone → AdGuard → Upstream DNS

Normal internet traffic:
Phone → Airtel Router → Internet
Enter fullscreen mode Exit fullscreen mode

This distinction is important. AdGuard is the DNS and DHCP server, not
the router.

Before You Start

You should already have Docker and Docker Compose available on Fedora.

Verify them:

docker --version
docker compose version
Enter fullscreen mode Exit fullscreen mode

You should also know the name of your active network interface.

Run:

ip link
Enter fullscreen mode Exit fullscreen mode

For this tutorial, the Wi-Fi interface is:

wlo1
Enter fullscreen mode Exit fullscreen mode

You can find your router's address with:

ip route | grep default
Enter fullscreen mode Exit fullscreen mode

For example:

default via 192.xxx.x.1 dev wlo1
Enter fullscreen mode Exit fullscreen mode

Here:

192.xxx.x.1
Enter fullscreen mode Exit fullscreen mode

is the Airtel router.

Step 1: Create the AdGuard Home Docker Compose Project

Create a directory for AdGuard:

mkdir -p ~/Documents/Dev/compose/adguard
cd ~/Documents/Dev/compose/adguard
Enter fullscreen mode Exit fullscreen mode

Create:

compose.yaml
Enter fullscreen mode Exit fullscreen mode

with:

services:
  adguardhome:
    image: adguard/adguardhome:edge
    container_name: adguardhome
    restart: unless-stopped

    network_mode: host

    volumes:
      - adguard_work:/opt/adguardhome/work
      - adguard_conf:/opt/adguardhome/conf

volumes:
  adguard_work:
  adguard_conf:
Enter fullscreen mode Exit fullscreen mode

Start it:

docker compose up -d
Enter fullscreen mode Exit fullscreen mode

Check:

docker ps
Enter fullscreen mode Exit fullscreen mode

You should see the adguardhome container running.

Step 2: Why We Use Host Networking

The important line in the Compose file is:

network_mode: host
Enter fullscreen mode Exit fullscreen mode

AdGuard will eventually act as the DHCP server.

DHCP clients initially have no IP configuration, so they use broadcast
packets to discover a DHCP server.

The process is:

Client                         AdGuard
  │                               │
  │──── DHCP Discover ───────────►│
  │                               │
  │◄──── DHCP Offer ──────────────│
  │                               │
  │──── DHCP Request ────────────►│
  │                               │
  │◄──── DHCP ACK ────────────────│
Enter fullscreen mode Exit fullscreen mode

This is commonly called the DHCP DORA process.

Using host networking lets AdGuard interact directly with Fedora's
physical network interface instead of sitting behind Docker's normal
bridge network.

Do not add a ports: section when using this configuration. With host
networking, AdGuard binds directly to ports on the Fedora host.

Step 3: Complete the Initial AdGuard Setup

Open the AdGuard Home interface in your browser.

Depending on the initial AdGuard setup state, the installation wizard
may initially use another port. Complete the wizard and configure the
final administrative interface to listen locally.

For the finished configuration, use:

Web interface:
127.0.0.1:80
Enter fullscreen mode Exit fullscreen mode

This keeps the administrative dashboard accessible from the Fedora
computer without exposing it unnecessarily to every device on the Wi-Fi.

After configuration, open:

http://127.0.0.1
Enter fullscreen mode Exit fullscreen mode

Step 4: Give the Fedora Computer a Static IP

Before making Fedora the network's DNS and DHCP server, give it a
predictable address.

Find the active NetworkManager connection:

nmcli connection show --active
Enter fullscreen mode Exit fullscreen mode

Copy its UUID.

You may have multiple saved connections with the same Wi-Fi name, so
using the UUID is safer than using the connection name.

For this example, Fedora will use:

192.xxx.x.13/24
Enter fullscreen mode Exit fullscreen mode

Configure it:

sudo nmcli connection modify <CONNECTION-UUID> \
  ipv4.method manual \
  ipv4.addresses "192.xxx.x.13/24" \
  ipv4.gateway "192.xxx.x.1" \
  ipv4.dns "127.0.0.1" \
  ipv4.ignore-auto-dns yes
Enter fullscreen mode Exit fullscreen mode

Reconnect:

nmcli connection down <CONNECTION-UUID>
nmcli connection up <CONNECTION-UUID>
Enter fullscreen mode Exit fullscreen mode

Verify:

ip addr show wlo1 | grep 'inet '
Enter fullscreen mode Exit fullscreen mode

You should see:

192.xxx.x.13/24
Enter fullscreen mode Exit fullscreen mode

without the dynamic flag.

Check the default route:

ip route | grep default
Enter fullscreen mode Exit fullscreen mode

It should still point to the Airtel router:

default via 192.xxx.x.1 dev wlo1
Enter fullscreen mode Exit fullscreen mode

The Airtel router remains your gateway.

Step 5: Reserve the Fedora Address on the Airtel Router

Open the Airtel router's administration page.

For this network:

http://192.xxx.x.1
Enter fullscreen mode Exit fullscreen mode

Look for a feature named something similar to:

MAC-IP Bind
IP-MAC Binding
Address Reservation
Static Lease
Enter fullscreen mode Exit fullscreen mode

The exact name depends on the Airtel router model and firmware.

Find Fedora's active Wi-Fi MAC address:

ip link show wlo1
Enter fullscreen mode Exit fullscreen mode

Create a binding between that MAC address and:

192.xxx.x.13
Enter fullscreen mode Exit fullscreen mode

This prevents the router from accidentally assigning the server address
to another device.

Be aware that modern Wi-Fi systems may use randomized MAC addresses. Use
the MAC address actually active on the Airtel Wi-Fi connection rather
than assuming the adapter's permanent hardware address is being used.

Step 6: Configure AdGuard's DNS Listeners

AdGuard should listen for DNS requests on:

127.0.0.1
192.xxx.x.13
Enter fullscreen mode Exit fullscreen mode

with DNS port:

53
Enter fullscreen mode Exit fullscreen mode

The purpose of each listener is:

127.0.0.1:53
    Fedora itself can use AdGuard.

192.xxx.x.13:53
    Other devices on the LAN can use AdGuard.
Enter fullscreen mode Exit fullscreen mode

Keep the dashboard on:

127.0.0.1:80
Enter fullscreen mode Exit fullscreen mode

if you only want it accessible from the Fedora machine.

Restart AdGuard if necessary:

docker restart adguardhome
Enter fullscreen mode Exit fullscreen mode

Verify:

sudo ss -lntup | grep ':53'
Enter fullscreen mode Exit fullscreen mode

You should see AdGuard listening on both:

127.0.0.1:53
192.xxx.x.13:53
Enter fullscreen mode Exit fullscreen mode

Step 7: Do Not Disable systemd-resolved

Fedora normally runs systemd-resolved.

You may see:

127.0.0.53:53
127.0.0.54:53
Enter fullscreen mode Exit fullscreen mode

when checking port 53.

For example:

sudo ss -lntup | grep ':53'
Enter fullscreen mode Exit fullscreen mode

may show:

127.0.0.1:53     AdGuardHome
192.xxx.x.13:53 AdGuardHome
127.0.0.53:53    systemd-resolved
127.0.0.54:53    systemd-resolved
Enter fullscreen mode Exit fullscreen mode

This is valid.

The processes use different IP addresses even though they use the same
port number.

There is no need to disable systemd-resolved.

Step 8: Test AdGuard Locally

Test DNS directly against AdGuard:

dig @127.0.0.1 google.com
Enter fullscreen mode Exit fullscreen mode

Then test the LAN address:

dig @192.xxx.x.13 google.com
Enter fullscreen mode Exit fullscreen mode

Both should return successful DNS responses.

At this point:

Fedora → AdGuard DNS → Upstream DNS
Enter fullscreen mode Exit fullscreen mode

is working.

Do not disable Airtel DHCP yet.

Step 9: Open DNS in Fedora's Firewall

Other LAN devices need permission to reach Fedora on port 53.

Open UDP DNS:

sudo firewall-cmd \
  --zone=FedoraWorkstation \
  --add-port=53/udp \
  --permanent
Enter fullscreen mode Exit fullscreen mode

Open TCP DNS:

sudo firewall-cmd \
  --zone=FedoraWorkstation \
  --add-port=53/tcp \
  --permanent
Enter fullscreen mode Exit fullscreen mode

Reload:

sudo firewall-cmd --reload
Enter fullscreen mode Exit fullscreen mode

Verify:

firewall-cmd --zone=FedoraWorkstation --list-ports
Enter fullscreen mode Exit fullscreen mode

You should see:

53/tcp
53/udp
Enter fullscreen mode Exit fullscreen mode

among the configured ports.

Step 10: Test AdGuard from Another Device

Before changing DHCP, test whether another device can reach AdGuard.

Temporarily configure a phone or another computer to use:

DNS Server:
192.xxx.x.13
Enter fullscreen mode Exit fullscreen mode

Browse normally and check:

AdGuard Home → Query Log
Enter fullscreen mode Exit fullscreen mode

You should see DNS requests from the device.

This proves that LAN DNS works before making the entire network
dependent on it.

Return the test device to automatic DNS afterward if desired. DHCP will
distribute the AdGuard address automatically later.

Step 11: Allow DHCP Through Fedora's Firewall

AdGuard also needs to receive DHCP traffic.

Run:

sudo firewall-cmd \
  --zone=FedoraWorkstation \
  --add-service=dhcp \
  --permanent
Enter fullscreen mode Exit fullscreen mode

Reload:

sudo firewall-cmd --reload
Enter fullscreen mode Exit fullscreen mode

Verify:

firewall-cmd --zone=FedoraWorkstation --list-services
Enter fullscreen mode Exit fullscreen mode

You should see:

dhcp
Enter fullscreen mode Exit fullscreen mode

Do not confuse this with dhcpv6-client, which is a separate service.

Step 12: Configure AdGuard's DHCP Server

Open:

http://127.0.0.1
Enter fullscreen mode Exit fullscreen mode

Go to AdGuard's DHCP settings.

Select the physical Wi-Fi interface:

wlo1 - 192.xxx.x.13
Enter fullscreen mode Exit fullscreen mode

Do not select one of Docker's bridge interfaces.

Configure IPv4 DHCP as:

Gateway:       192.xxx.x.1
Range Start:   192.xxx.x.100
Range End:     192.xxx.x.200
Subnet Mask:   255.255.255.0
Lease:         86400
Enter fullscreen mode Exit fullscreen mode

The pool deliberately does not contain 192.xxx.x.13.

Save the configuration and enable AdGuard's DHCP server.

Verify:

sudo ss -lunp | grep ':67'
Enter fullscreen mode Exit fullscreen mode

A successful configuration should show AdGuardHome listening on UDP
port 67 on wlo1.

For example:

0.0.0.0%wlo1:67
Enter fullscreen mode Exit fullscreen mode

At this point AdGuard is ready to provide DHCP.

Step 13: Disable DHCP on the Airtel Router

Only do this after confirming that AdGuard is listening on port 67.

Open:

http://192.xxx.x.1
Enter fullscreen mode Exit fullscreen mode

Navigate to the Airtel router's LAN/DHCP settings.

A typical Airtel interface may show something similar to:

IP Address:      192.xxx.x.1
Subnet Mask:     255.255.255.0
DHCP Server:     Enable
DHCP IP Pool:    192.168.18.2 - 192.168.18.253
DHCP Lease Time: 24 hours
Enter fullscreen mode Exit fullscreen mode

Change:

DHCP Server: Enable
Enter fullscreen mode Exit fullscreen mode

to:

DHCP Server: Disable
Enter fullscreen mode Exit fullscreen mode

Apply the change.

Do not change the router's LAN address.

It should remain:

192.xxx.x.1
Enter fullscreen mode Exit fullscreen mode

because it is still the network's gateway.

Step 14: Reconnect a Client

Take a phone or another computer and make sure its network configuration
is set to:

IP:  Automatic / DHCP
DNS: Automatic
Enter fullscreen mode Exit fullscreen mode

Disconnect and reconnect it to the Airtel Wi-Fi.

Then open:

AdGuard Home → DHCP → DHCP Leases
Enter fullscreen mode Exit fullscreen mode

The device should appear as a dynamic lease.

A client should receive something similar to:

IP:      192.xxx.x.105
Gateway: 192.xxx.x.1
DNS:     192.xxx.x.13
Enter fullscreen mode Exit fullscreen mode

The exact IP can be anywhere inside:

192.xxx.x.100 - 192.xxx.x.200
Enter fullscreen mode Exit fullscreen mode

Step 15: Verify DNS Filtering

From Fedora:

dig @192.xxx.x.13 google.com
Enter fullscreen mode Exit fullscreen mode

Then open websites from another connected device and inspect:

AdGuard Home → Query Log
Enter fullscreen mode Exit fullscreen mode

You should see the client's DNS requests.

If you have a domain intentionally blocked through a custom rule, you
can test it directly:

dig @192.xxx.x.13 blocked-example.com
Enter fullscreen mode Exit fullscreen mode

Depending on AdGuard's configured blocking mode, a blocked request may
return 0.0.0.0, NXDOMAIN, or another configured blocking response.

Step 16: Add Blocklists Carefully

AdGuard Home can use DNS blocklists to block advertising, tracking,
telemetry, malicious domains, and other unwanted endpoints.

It is tempting to enable every available list.

Avoid doing that.

Several lists can contain substantial overlap:

List A
├── ads.example.com
├── tracker.example.com
└── telemetry.example.com

List B
├── ads.example.com
├── tracker.example.com
└── another-tracker.example
Enter fullscreen mode Exit fullscreen mode

More rules do not automatically mean better filtering.

Large numbers of overlapping lists can increase:

  • memory usage
  • update time
  • filter reload time
  • false positives
  • application breakage
  • troubleshooting difficulty

Start with a reputable general-purpose filter and add complementary
lists only when you identify a specific gap.

Step 17: Configure Per-Device Policies

Not every device on a home network needs identical filtering.

AdGuard Home can maintain persistent clients and apply different
policies.

For example:

Personal Laptop
└── Standard filtering

Parent Phone
└── Standard filtering

Child Phone
├── Filtering
├── Parental controls
├── Safe Search
└── Restricted services
Enter fullscreen mode Exit fullscreen mode

You can create static DHCP leases for devices that should always receive
predictable addresses.

This provides policy control at the DNS layer without applying parental
restrictions to every person on the network.

Remember that DNS filtering is not equivalent to full network isolation.
Devices using encrypted DNS, hard-coded IP addresses, VPNs, or other
bypass mechanisms may require controls at the router/firewall level.

Step 18: Understand the Query Log

The Query Log is one of AdGuard Home's most useful diagnostic tools.

It shows:

Client
  ↓
Requested Domain
  ↓
Allowed / Blocked
  ↓
Matching Filter
Enter fullscreen mode Exit fullscreen mode

However, a DNS request does not prove that someone intentionally visited
a website.

Applications frequently contact domains in the background for:

  • advertising
  • analytics
  • telemetry
  • notifications
  • updates
  • content delivery

For deeper investigation, combine AdGuard with packet-capture tools such
as Wireshark or PCAPdroid.

A useful mental model is:

AdGuard Query Log
        │
        └── What DNS name was requested,
            and was it blocked?

Wireshark / PCAPdroid
        │
        └── What network connection
            was actually attempted?
Enter fullscreen mode Exit fullscreen mode

Step 19: Observe DHCP with Wireshark

This setup also provides a useful networking exercise.

Start Wireshark on Fedora and capture traffic on:

wlo1
Enter fullscreen mode Exit fullscreen mode

Use the display filter:

dhcp
Enter fullscreen mode Exit fullscreen mode

Disconnect and reconnect another device to Wi-Fi.

You should be able to observe:

DHCP Discover
DHCP Offer
DHCP Request
DHCP ACK
Enter fullscreen mode Exit fullscreen mode

The DHCP process that is normally hidden inside the router is now being
performed by a service running on your own Fedora machine.

For DNS traffic, use:

dns
Enter fullscreen mode Exit fullscreen mode

as the display filter.

Step 20: Remember That Fedora Is Now Infrastructure

Once Airtel DHCP is disabled, the Fedora computer becomes an important
part of the network.

If Fedora:

  • shuts down
  • sleeps
  • disconnects from Wi-Fi
  • leaves the house
  • stops Docker
  • stops the AdGuard container

then new devices may fail to obtain DHCP leases and existing clients may
lose DNS resolution.

The Airtel router can still have a perfectly good internet connection
while devices appear unable to browse.

For experimentation, a laptop is fine.

For a permanent deployment, move AdGuard to an always-on device such as:

  • Raspberry Pi
  • low-power mini PC
  • home server
  • dedicated networking appliance

Once family members start asking why the internet stopped when you
rebooted your laptop, the experiment has officially become
infrastructure.

Emergency Recovery

If something goes wrong during the DHCP handover, the fastest recovery
is:

AdGuard DHCP → OFF
Airtel DHCP  → ON
Enter fullscreen mode Exit fullscreen mode

Reconnect your devices afterward.

That restores the Airtel router as the DHCP server.

Full Rollback

If you want to return Fedora to normal router-managed networking, first
disable AdGuard DHCP and re-enable DHCP on the Airtel router.

Then restore NetworkManager:

sudo nmcli connection modify <CONNECTION-UUID> \
  ipv4.method auto \
  ipv4.addresses "" \
  ipv4.gateway "" \
  ipv4.dns "" \
  ipv4.ignore-auto-dns no \
  ipv6.dns "" \
  ipv6.ignore-auto-dns no
Enter fullscreen mode Exit fullscreen mode

Reconnect:

nmcli connection down <CONNECTION-UUID>
nmcli connection up <CONNECTION-UUID>
Enter fullscreen mode Exit fullscreen mode

Verify:

ip addr show wlo1 | grep 'inet '
Enter fullscreen mode Exit fullscreen mode

You should see an address marked:

dynamic
Enter fullscreen mode Exit fullscreen mode

Check the route:

ip route | grep default
Enter fullscreen mode Exit fullscreen mode

It should resemble:

default via 192.xxx.x.1 dev wlo1 proto dhcp
Enter fullscreen mode Exit fullscreen mode

Check DNS:

resolvectl status wlo1
Enter fullscreen mode Exit fullscreen mode

The router should once again appear as the DNS server, for example:

Current DNS Server: 192.xxx.x.1
Enter fullscreen mode Exit fullscreen mode

Remove the firewall rules added for AdGuard:

sudo firewall-cmd \
  --zone=FedoraWorkstation \
  --remove-port=53/tcp \
  --permanent

sudo firewall-cmd \
  --zone=FedoraWorkstation \
  --remove-port=53/udp \
  --permanent

sudo firewall-cmd \
  --zone=FedoraWorkstation \
  --remove-service=dhcp \
  --permanent

sudo firewall-cmd --reload
Enter fullscreen mode Exit fullscreen mode

If you created a MAC-IP binding for Fedora in the Airtel router, remove
it as well.

You do not have to delete AdGuard.

You can keep the container and its configuration for future use. With
AdGuard DHCP disabled and Fedora returned to router-provided DNS, the
normal network no longer depends on it.

Final Architecture

When everything is enabled, the network is:

                         Internet
                            ▲
                            │
                      Airtel Router
                      192.xxx.x.1
                       Gateway + NAT
                            ▲
                            │
          ┌─────────────────┼─────────────────┐
          │                 │                 │
        Phone              TV              Laptop
          │                 │                 │
          └──────── DNS + DHCP ──────────────┘
                            │
                            ▼
                       Fedora Host
                      192.xxx.x.13
                       AdGuard Home
                        DNS + DHCP
Enter fullscreen mode Exit fullscreen mode

The important idea is not simply that AdGuard blocks advertisements.

The setup separates services that consumer routers normally hide inside
one device:

Routing ≠ DHCP ≠ DNS
Enter fullscreen mode Exit fullscreen mode

The Airtel router can remain the internet gateway while another machine
provides DHCP and DNS to the LAN.

That makes AdGuard Home a useful filtering tool, but it also turns a
normal home network into a practical environment for learning how DNS,
DHCP, Linux networking, Docker, firewalls, and client configuration work
together.

Top comments (1)

Some comments may only be visible to logged-in visitors. Sign in to view all comments.