DEV Community

Cover image for Deploying AdGuard Home Network Traffic Filtering on Ubuntu 24.04
Vultr profile image Sanskriti Harmukh
Sanskriti Harmukh for Vultr

Posted on with Aashish Chaurasiya • Originally published at docs.vultr.com

Deploying AdGuard Home Network Traffic Filtering on Ubuntu 24.04

#dns #docker #devops #networking

AdGuard Home is an open-source, network-wide ad and tracker blocking DNS server with a web dashboard, parental controls, and DNS-over-HTTPS/TLS support. This guide deploys AdGuard Home using Docker Compose with Traefik handling automatic HTTPS for the dashboard, after freeing the system's port 53. By the end, you'll have AdGuard Home resolving and filtering DNS queries with an HTTPS-secured admin console.

Free Port 53

Ubuntu's systemd-resolved binds port 53 by default. Release it before deploying.

1. Stop and disable systemd-resolved:

$ sudo systemctl stop systemd-resolved
$ sudo systemctl disable systemd-resolved
Enter fullscreen mode Exit fullscreen mode

2. Replace the resolver configuration:

$ sudo rm /etc/resolv.conf
$ echo "nameserver 1.1.1.1" | sudo tee /etc/resolv.conf
Enter fullscreen mode Exit fullscreen mode

Set Up the Directory Structure

1. Create the project directory structure:

$ mkdir -p ~/adguard/{work,conf,letsencrypt}
$ cd ~/adguard
Enter fullscreen mode Exit fullscreen mode

2. Create the environment file:

$ nano .env
Enter fullscreen mode Exit fullscreen mode 
DOMAIN=adguard.example.com
LETSENCRYPT_EMAIL=admin@example.com
TZ=UTC
Enter fullscreen mode Exit fullscreen mode

Deploy with Docker Compose

1. Add your user to the Docker group:

$ sudo usermod -aG docker $USER
$ newgrp docker
Enter fullscreen mode Exit fullscreen mode

2. Create the Docker Compose manifest:

$ nano docker-compose.yml
Enter fullscreen mode Exit fullscreen mode 
services:
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    environment:
      DOCKER_API_VERSION: "1.44"
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.le.acme.httpchallenge=true"
      - "--certificatesresolvers.le.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.le.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.le.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt

  adguard:
    image: adguard/adguardhome:latest
    container_name: adguard
    restart: unless-stopped
    environment:
      TZ: ${TZ}
    volumes:
      - ./work:/opt/adguardhome/work
      - ./conf:/opt/adguardhome/conf
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "3000:3000/tcp"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.adguard.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.adguard.entrypoints=websecure"
      - "traefik.http.routers.adguard.tls=true"
      - "traefik.http.routers.adguard.tls.certresolver=le"
      - "traefik.http.services.adguard.loadbalancer.server.port=80"
Enter fullscreen mode Exit fullscreen mode

3. Start the services:

$ docker compose up -d
Enter fullscreen mode Exit fullscreen mode

4. Verify the services are running:

$ docker compose ps
Enter fullscreen mode Exit fullscreen mode

Initial Configuration

  1. Open https://adguard.example.com and complete the install wizard on first launch (the setup runs on port 3000 initially, then switches to port 80 behind Traefik on subsequent visits).
  2. Create the admin account.
  3. Configure upstream DNS servers and enable the default block lists.

Test Resolution

From an allowed client, confirm blocking and normal resolution:

$ dig @SERVER_IP flurry.com
$ dig @SERVER_IP vultr.com
Enter fullscreen mode Exit fullscreen mode

The first should resolve to 0.0.0.0 (blocked); the second should return real records.

Next Steps

AdGuard Home is running with HTTPS for the dashboard. From here you can:

  • Add custom block lists and allow lists for per-network policies
  • Enable DNS-over-HTTPS or DNS-over-TLS for encrypted client queries
  • Point your LAN's DHCP server at AdGuard for network-wide filtering

For the full guide with additional tips, visit the original article on Vultr Docs.

Top comments (0)