How to Install AdGuard Home on Ubuntu 24.04 — Network-Wide DNS Ad Blocker with DoH/DoT/QUIC

AdGuard Home turns a single small VPS into a network-wide DNS sinkhole that blocks ads, trackers, malware domains, and phishing sites before they ever reach your devices. Unlike a browser extension, it works for every endpoint on your network — phones, smart TVs, game consoles, IoT doorbells, apps with no built-in ad blocker — and unlike most self-hosted resolvers it ships with DNS-over-HTTPS, DNS-over-TLS, and DNS-over-QUIC built in, no helper daemon required.

This tutorial walks you through installing AdGuard Home on an Ubuntu 24.04 VPS, using both the official install script and the Docker image, wiring up encrypted upstream resolvers, adding best-in-class community filter lists, applying per-client settings, and locking the whole stack down behind a firewall.

Skip the setup? Our CloudCore Starter plan has plenty of headroom to run AdGuard Home alongside WireGuard on a single box. Launch in 60 seconds.

Table of Contents

What is AdGuard Home?

AdGuard Home is an open-source, network-wide software for blocking ads and tracking. Unlike the AdGuard apps for desktop or mobile, AdGuard Home sits at the network layer: it runs as a DNS server that every device on your network uses, and it drops queries to ad, tracker, and malicious domains before the TCP connection is ever opened. That means one install protects every phone, laptop, smart TV, game console, and IoT gadget on the network — regardless of whether they can run an ad blocker of their own.

Under the hood, AdGuard Home is a single statically-linked Go binary that serves plain DNS on UDP/TCP 53, DNS-over-HTTPS on TCP 443/853, DNS-over-TLS on TCP 853, and DNS-over-QUIC on UDP 853. It also ships with a built-in HTTP admin UI (default port 3000, typically repointed to 80 after setup) and a minimal JSON API for automation. The full source code is on GitHub under GPL-3.0, and binaries are published for every major Linux architecture plus macOS, Windows, FreeBSD, and an official Docker image at adguard/adguardhome.

Functionally, AdGuard Home covers every use case you'd expect from a DNS sinkhole: blocklist filtering with hundreds of community lists, allowlists and regex rules, SafeSearch enforcement on Google / Bing / YouTube, parental controls, per-client policies, query logging with a live dashboard, and optional DHCP. What sets it apart from alternatives is the built-in support for encrypted upstream resolvers. Where Pi-hole requires a separate cloudflared or unbound daemon to speak DoH, AdGuard Home accepts tls://, https://, and quic:// URLs directly in the upstream list.

Why Self-Host AdGuard Home on a VPS?

The classic deployment is a Raspberry Pi inside your home LAN. Running AdGuard Home on a VPS unlocks several scenarios a home install can't:

• Ad blocking outside your home. Pair a VPS AdGuard Home with a WireGuard tunnel and every device you connect — phone on cellular, laptop at a coffee shop, tablet at a hotel — gets the same filtered DNS.
• One resolver for many networks. Point the home, office, and shop routers at one VPS AdGuard Home over VPN and centralize blocklists, client rules, and query logs.
• Always-on uptime. A VPS won't fall off the network when the power flickers or the home internet drops. DNS is foundational — when it goes down, the whole LAN feels it within seconds.
• Encrypted upstreams that actually work. Residential ISPs often log and sometimes rewrite plaintext DNS. A VPS AdGuard Home talking DoT/DoH/DoQ to Cloudflare, Quad9, or AdGuard DNS means your upstream queries never leak to the ISP.
• White-label DNS for a team. Run AdGuard Home on dns.example.com, hand WireGuard configs to staff, manage one blocklist org-wide.

Do not run AdGuard Home as a public open recursive resolver. Leaving port 53 unauthenticated to the world exposes you to DNS amplification abuse and will get your VPS blocklisted within hours. Always front AdGuard Home with a VPN or restrict port 53 to specific client IPs with a firewall.

AdGuard Home vs Pi-hole Feature Comparison

Both products are excellent at what they do. If you're coming from a Pi-hole background, here's an honest feature-by-feature comparison so you know what you're trading. For the inverse perspective, see our Pi-hole on Ubuntu 24.04 guide.

Prerequisites

• Ubuntu 24.04 LTS VPS with root or sudo access
• SSH access to your server
• A static public IPv4 address — every client will point DNS at this IP
• Ports available on the VPS: 53/udp, 53/tcp, 80/tcp (admin), 443/tcp (DoH), 853/tcp + 853/udp (DoT / DoQ)
• At least 1 GB RAM and 10 GB disk — AdGuard Home itself idles around 50-100 MB

Recommended Plan: Starter

AdGuard Home is intentionally lightweight. Our Starter plan with 2 vCPU, 4 GB RAM, and 50 GB NVMe has more than enough headroom for AdGuard Home plus WireGuard on the same box.

Connect to your server via SSH:

ssh root@your-server-ip

Step 1: Update System Packages

Start with a clean, current system so dependencies resolve cleanly and the kernel has the latest security patches.

sudo apt update && sudo apt upgrade -y

If the kernel was updated, reboot once before continuing:

sudo reboot

Set a clear hostname while you're here:

sudo hostnamectl set-hostname adguard

Step 2: Free Port 53 from systemd-resolved

Ubuntu 24.04 ships systemd-resolved by default, which binds a stub listener to 127.0.0.53:53 and refuses to share port 53 with anything else. Before installing AdGuard Home, disable the stub and repoint /etc/resolv.conf to a real upstream so the server can still resolve names during the install itself.

sudo mkdir -p /etc/systemd/resolved.conf.d
sudo tee /etc/systemd/resolved.conf.d/adguardhome.conf > /dev/null <<EOF
[Resolve]
DNS=1.1.1.1
DNSStubListener=no
EOF

Replace the symlink:

sudo unlink /etc/resolv.conf
echo "nameserver 1.1.1.1" | sudo tee /etc/resolv.conf

Restart systemd-resolved:

sudo systemctl restart systemd-resolved

Confirm nothing is holding port 53:

sudo ss -tulpn | grep ':53 '

Expected output: empty, or no process bound to 0.0.0.0:53 / [::]:53.

Step 3: Install AdGuard Home (Official Script)

AdGuard Home provides a one-line installer that downloads the correct binary for your architecture, creates a systemd unit, and starts the service on boot.

curl -s -S -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -v

Expected output (abbreviated):

[info] Starting AdGuard Home installation script
[info] Channel: release
[info] OS: linux
[info] Arch: amd64
[info] Downloading package from https://static.adguard.com/adguardhome/release/AdGuardHome_linux_amd64.tar.gz
[info] AdGuard Home is now installed to /opt/AdGuardHome
[info] Starting AdGuardHome service
[info] Action install has been done successfully on linux
AdGuard Home is available at the following addresses:
  http://127.0.0.1:3000
  http://YOUR-VPS-IP:3000

The script performs these actions:

Verify the service is running:

sudo systemctl status AdGuardHome

Expected output (truncated):

● AdGuardHome.service - AdGuard Home: Network-level blocker
     Loaded: loaded (/etc/systemd/system/AdGuardHome.service; enabled; preset: enabled)
     Active: active (running) since Thu 2026-04-16 10:12:03 UTC; 10s ago
   Main PID: 2341 (AdGuardHome)
      Tasks: 9 (limit: 4608)
     Memory: 62.4M

Skip to Step 5: Run the Setup Wizard if you want to use this install.

Step 4: Install AdGuard Home with Docker (Alternative)

If you prefer containerized deployments, the official Docker image adguard/adguardhome is maintained by the AdGuard team on Docker Hub. Skip Step 3 and use this method instead.

Install Docker Engine (full guide: how-to-install-docker-ubuntu):

curl -fsSL https://get.docker.com | sh
sudo usermod -aG docker $USER
newgrp docker

Create host directories for configuration and runtime data:

sudo mkdir -p /opt/adguardhome/{work,conf}

Run the container in host-network mode so DNS, DoH, DoT, and DoQ all bind directly to the VPS NIC without Docker port-mapping headaches:

docker run -d \
  --name adguardhome \
  --restart unless-stopped \
  --network host \
  -v /opt/adguardhome/work:/opt/adguardhome/work \
  -v /opt/adguardhome/conf:/opt/adguardhome/conf \
  adguard/adguardhome

Verify the container is up:

docker ps --filter name=adguardhome
docker logs adguardhome | tail -n 20

Expected output includes:

[info] AdGuard Home is available at the following addresses:
[info] go to http://YOUR-VPS-IP:3000

For a declarative setup, here's an equivalent docker-compose.yml you can drop in /opt/adguardhome/docker-compose.yml:

services:
  adguardhome:
    image: adguard/adguardhome:latest
    container_name: adguardhome
    restart: unless-stopped
    network_mode: host
    volumes:
      - ./work:/opt/adguardhome/work
      - ./conf:/opt/adguardhome/conf

Start it with docker compose up -d.

Step 5: Run the Setup Wizard

Open the initial setup wizard in your browser:

http://YOUR-VPS-IP:3000

The wizard walks you through six screens:

After first login, the dashboard at http://YOUR-VPS-IP/ (or :3000) shows live query traffic, top clients, top domains, and filter stats. Config lives at /opt/AdGuardHome/AdGuardHome.yaml (script install) or /opt/adguardhome/conf/AdGuardHome.yaml (Docker install).

Step 6: Configure the Firewall

UFW (Uncomplicated Firewall) should be enabled on any public VPS. Open the ports AdGuard Home needs while keeping SSH reachable:

sudo ufw allow 22/tcp         # SSH - do not lock yourself out
sudo ufw allow 80/tcp         # admin UI
sudo ufw allow 443/tcp        # DoH (if you serve it)
sudo ufw allow 853            # DoT + DoQ (TCP + UDP)
sudo ufw enable
sudo ufw status verbose

Port 53 needs special treatment. Exposed to the public internet it makes you an open recursive resolver — you will be abused for DNS amplification and blocklisted within hours. Pick one of these patterns:

Pattern A — VPN-only. Install WireGuard on the same VPS, bind port 53 only to the wg0 interface, and only allow 53 from the VPN subnet:

sudo ufw allow in on wg0 to any port 53
sudo ufw deny 53

Pattern B — Known-client allowlist. If you have static client IPs (office, home, colo):

sudo ufw allow from 203.0.113.50 to any port 53
sudo ufw allow from 198.51.100.22 to any port 53
sudo ufw deny 53

Pattern C — Encrypted-only. Block plain port 53 entirely and only expose DoH (443), DoT (853), and DoQ (853/udp). Modern clients (Android 9+, iOS 14+, Windows 11) can all talk DoH or DoT directly:

sudo ufw deny 53

Step 7: DNS-over-HTTPS, DNS-over-TLS, DNS-over-QUIC Upstreams

By default AdGuard Home uses plain-text UDP/53 to Quad9. That leaks every query to any network between you and the upstream. Switch to encrypted upstreams under Settings > DNS settings > Upstream DNS servers.

A balanced, fast set:

https://dns.cloudflare.com/dns-query
https://dns.quad9.net/dns-query
quic://dns.adguard-dns.com
tls://1dot1dot1dot1.cloudflare-dns.com

URL scheme reference:

Bootstrap DNS — AdGuard Home needs plaintext resolvers to look up the hostnames in your encrypted upstream URLs at startup. Set it to 1.1.1.1 and 9.9.9.9.

Private reverse DNS servers — leave blank on a pure VPS deployment; set this only if you also resolve a private LAN.

Bonus: Run Unbound for Full Recursive Resolution

If you want zero trust in any third-party resolver, chain AdGuard Home in front of a local Unbound recursive resolver. AdGuard Home handles blocking + encryption to clients, Unbound handles iterative resolution from the root servers. Upstream URL becomes:

127.0.0.1:5335

See the Unbound guide for the matching unbound.conf that listens on 127.0.0.1:5335.

Step 8: Add Custom Filter Lists

AdGuard Home ships with its own default list plus a few recommended ones. For deeper coverage, add community-maintained lists under Filters > DNS blocklists > Add blocklist > Choose from the list (or Add a custom list for arbitrary URLs).

A strong, conservative starting set (low false-positive rates):

Custom filtering rules

Under Filters > Custom filtering rules you can write AdGuard-syntax rules that override blocklist behavior. Useful patterns:

! Allow a domain some list blocks
@@||example-vendor.com^
! Block a specific subdomain
||telemetry.vendor.example^
! Block a whole TLD for a specific client via $client modifier
||*.ru^$client=192.168.1.42
! Force SafeSearch for Google at the DNS layer
|google.com^$dnsrewrite=NOERROR;CNAME;forcesafesearch.google.com

Click Apply after each batch of changes.

Step 9: Per-Client Settings

One of AdGuard Home's best features is per-client policies. You can assign different blocklists, upstream DNS servers, SafeSearch settings, and parental controls to specific devices, then review per-device query history in the dashboard.

Go to Settings > Client settings > Add client.

Identify the client by any combination of:

• IP address — 192.168.1.42 for a LAN device behind a VPN, or the VPS IP for a WireGuard peer.
• MAC address — only if AdGuard Home serves DHCP for the client's network.
• ClientID — a tag sent in the DoH/DoT/DoQ URL path (https://dns.example.com/dns-query/kids-tablet). Ideal for mobile devices that roam.
• CIDR range — 10.0.0.0/24 to apply a policy to an entire subnet.

• Upstream DNS servers — send queries from this client to a different resolver entirely.
• Filtering — enable/disable all filtering, SafeSearch, parental control, SafeBrowsing.
• Blocked services — one-click toggles for 80+ services (YouTube, TikTok, Reddit, Discord, gambling sites, social networks).
• Tags — attach human labels like kids, iot, work-laptop for grouping in the query log.

Step 10: Serve the Admin Panel over HTTPS

The admin panel on port 80 is fine for a LAN or WireGuard-only deployment. For public admin access, put Nginx in front with a real TLS certificate and a strong authentication layer.

Install Nginx and Certbot:

sudo apt install -y nginx apache2-utils certbot python3-certbot-nginx

Move the AdGuard Home admin UI off port 80 first — edit /opt/AdGuardHome/AdGuardHome.yaml (or /opt/adguardhome/conf/AdGuardHome.yaml for Docker), change:

http:
  address: 127.0.0.1:3000

Restart:

sudo systemctl restart AdGuardHome
or: docker restart adguardhome

Create an htpasswd file for an extra layer on top of AdGuard's own login:

sudo htpasswd -c /etc/nginx/.adguard-htpasswd admin

Drop in the Nginx vhost at /etc/nginx/sites-available/adguard:

server {
    listen 80;
    server_name dns.example.com;
    return 301 https://$host$request_uri;
}
server {
    listen 443 ssl http2;
    server_name dns.example.com;
    ssl_certificate     /etc/letsencrypt/live/dns.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/dns.example.com/privkey.pem;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
    location / {
        auth_basic "AdGuard Home Admin";
        auth_basic_user_file /etc/nginx/.adguard-htpasswd;
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # AdGuard's live query log uses WebSockets
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 3600s;
    }
}

Enable and fetch a certificate:

sudo ln -s /etc/nginx/sites-available/adguard /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx
sudo certbot --nginx -d dns.example.com

Now https://dns.example.com/ serves the admin UI over TLS with basic-auth in front of AdGuard's own login.

CloudCore Pricing Tiers

AdGuard Home runs comfortably on any modern VPS. Pick the tier that matches the scale you're protecting.

Troubleshooting

Viewing logs

Service install:

sudo journalctl -u AdGuardHome -f

Docker install:

docker logs -f adguardhome

Config file:

sudo less /opt/AdGuardHome/AdGuardHome.yaml

FAQ

Is AdGuard Home really free and open source?

Yes. AdGuard Home is released under the GNU GPL v3 and is completely free to use. It's a separate product from AdGuard's paid browser / mobile / desktop apps and from AdGuard DNS (the hosted service). The entire source, release binaries, and issue tracker live at github.com/AdguardTeam/AdGuardHome. There is no commercial tier, no feature gating, and no telemetry phoning home.

AdGuard Home vs Pi-hole, which one should I pick?

Both block ads at the DNS layer and are excellent. AdGuard Home bundles DNS-over-HTTPS, DNS-over-TLS, and DNS-over-QUIC natively with no helper daemon, ships as a single Go binary, and has a slightly more modern default UI. Pi-hole has a larger ecosystem, more third-party tutorials, native DHCP, and a longer track record. For a clean modern install with encrypted upstreams out of the box, choose AdGuard Home. For the deepest community and most tutorials, choose Pi-hole. You can even run both and compare live — they don't overlap on port 53, but you can test each on separate VPS before committing.

Can I run AdGuard Home on a VPS safely?

Yes, but never expose port 53 to the public internet as an open recursive resolver. Either restrict port 53 to specific client IPs with UFW, or pair AdGuard Home with WireGuard and firewall port 53 to the VPN interface only. Exposing port 53 to the world invites DNS amplification abuse within hours and will get your VPS blocklisted. The encrypted protocols (DoH on 443, DoT / DoQ on 853) are safe to expose publicly because each client authenticates via TLS before a query is processed.

Do I need a GPU or much RAM to run AdGuard Home?

No. AdGuard Home idles at around 50-100 MB of RAM and a few percent of one vCPU even with several large blocklists loaded. A 1 vCPU / 2 GB VPS is more than enough for a home network. The Starter plan handles AdGuard Home plus WireGuard with room to spare for Unbound recursive resolution and an Nginx reverse proxy on the same box.

What is DNS-over-QUIC and why should I enable it?

DNS-over-QUIC (DoQ) wraps DNS queries in the QUIC transport protocol, which runs over UDP and combines TLS 1.3 encryption with low-latency connection setup. Compared to DNS-over-TLS, DoQ avoids head-of-line blocking on packet loss and has lower handshake overhead on mobile networks. AdGuard Home supports DoQ upstreams out of the box via the quic:// URL scheme, and public resolvers like AdGuard DNS and Cloudflare expose DoQ endpoints. If you're a mobile-heavy household, DoQ measurably improves tail latency.

Can AdGuard Home serve DHCP?

Yes. AdGuard Home has a built-in DHCP server you can enable under Settings > DHCP settings. In a typical VPS deployment you wouldn't use it because the LAN router already runs DHCP. On a home Raspberry Pi or LAN-hosted deployment, AdGuard Home can replace the router's DHCP server and automatically hand out itself as the DNS — which sidesteps the common "router ignores my DNS setting" problem.

How do I stop Chrome and Firefox from bypassing AdGuard Home with DoH?

Three levers: (1) add the Mozilla canary domain use-application-dns.net to the blocklist so Firefox honors system DNS; (2) block the DoH endpoints used by browsers (mozilla.cloudflare-dns.com, chrome.cloudflare-dns.com, dns.google, doh.opendns.com) via custom filter rules; (3) if you manage the fleet, disable browser DoH via Group Policy or MDM and force AdGuard Home as the only resolver. A nice side-effect of encrypted AdGuard upstreams: users still get the privacy of DoH/DoT/DoQ and you keep visibility + blocklist enforcement.

How do I back up and restore my AdGuard Home config?

Everything lives in a single YAML file. For a script install: /opt/AdGuardHome/AdGuardHome.yaml. For Docker: /opt/adguardhome/conf/AdGuardHome.yaml. Copy that plus the data/ directory (contains query log DB and filter cache) to off-box storage. A simple daily cron to S3 or Backblaze B2 is enough. To restore, stop the service, restore both paths, start the service.

Next Steps

Now that AdGuard Home is running, here are the recommended next moves:

• Pair with WireGuard for mobile ad blocking. WireGuard on Ubuntu 24.04 puts every device you own behind your AdGuard Home, even on cellular.
• Chain Unbound for full recursive resolution. Unbound on Ubuntu 24.04 removes your last remaining third-party DNS dependency — AdGuard Home handles blocking and client encryption, Unbound does the iterative work from the root servers down.
• Serve the admin over HTTPS. Nginx reverse proxy guide for Let's Encrypt plus basic-auth in front of the admin UI, as covered in Step 10.
• Compare with Pi-hole. Spin up a second VPS with Pi-hole and test both against the same blocklists and clients for a week. Decide which UI and feature set you actually prefer.
• Automate blocklist updates. AdGuard Home already refreshes lists every 24 hours. Add a cron that checks the status API and alerts on update failures.
• Review query logs weekly. The dashboard's top-blocked and top-queried views reveal noisy telemetry domains you can kill at the filter level, and they expose devices that are leaking DoH traffic past your resolver.

Skip the Manual Install — Get AdGuard Home Pre-Configured

Our Starter plan can come with AdGuard Home pre-installed, WireGuard optionally bundled, and admin HTTPS configured out of the box.

- AdGuard Home latest release with OISD + HaGeZi blocklists pre-loaded

- Encrypted DoH / DoT / DoQ upstreams to Cloudflare + Quad9 + AdGuard DNS

- WireGuard co-installed for remote ad blocking on mobile

- UFW locked down to VPN-only port 53

- Nginx reverse proxy with Let's Encrypt TLS and basic-auth

Deploy Your AdGuard Home VPS Now — Starter plans start at a fixed monthly price.