AdGuard Home

Last reviewed Aug 26, 2026 · 870 words

The first thing AdGuard Home does on a stock Ubuntu or Debian box is fail to bind port 53, because systemd-resolved already owns it. Fix that before you pull the image and the rest of the install is a 10-minute job: a setup wizard on port 3000, a dashboard on port 80, and every device on your network losing its ads the moment you change one DHCP setting.

Free port 53 first

systemd-resolved runs a stub listener on 127.0.0.53:53. On the host that will run AdGuard Home, turn it off and point the system resolver somewhere sensible in the meantime:

sudo mkdir -p /etc/systemd/resolved.conf.d
printf '[Resolve]\nDNS=1.1.1.1\nDNSStubListener=no\n' | sudo tee /etc/systemd/resolved.conf.d/adguardhome.conf
sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
sudo systemctl restart systemd-resolved

Check with ss -ulnp | grep :53; nothing should be listening. Skip this and Docker reports "address already in use" on port 53 and the container never starts.

The wizard lives on 3000, the dashboard on 80

services:
  adguardhome:
    image: adguard/adguardhome:latest
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "80:80/tcp"
      - "3000:3000/tcp"
    volumes:
      - /opt/adguardhome/work:/opt/adguardhome/work
      - /opt/adguardhome/conf:/opt/adguardhome/conf
    restart: unless-stopped

Open http://host-ip:3000 once. The wizard asks which interface and port the admin UI should use (accept 80 unless something else holds it), which port DNS should listen on, and for an admin username and password. After you finish, the UI moves to port 80 and port 3000 goes quiet. If a reverse proxy already holds port 80 on the host, tell the wizard to keep the UI on 3000 and drop the 80 mapping from the compose file; nothing else changes. Everything it decided is written to /opt/adguardhome/conf/AdGuardHome.yaml, which is the only file you need to back up. The 128 MB RAM figure is generous; on a Raspberry Pi 4 mine idles at roughly half that.

Encrypt the upstream, then make the network use it

Out of the box AdGuard forwards to its own public resolvers. Change that under Settings, DNS settings, Upstream DNS servers, to encrypted upstreams you choose, for example https://dns.quad9.net/dns-query and tls://1.1.1.1. Enable parallel requests so a slow upstream does not stall the others. This is the feature Pi-hole users envy: DNS-over-HTTPS, DNS-over-TLS, and DNS-over-QUIC upstreams without a sidecar container. Read DNS for self-hosters if you would rather run your own recursive resolver behind it.

Then hand out the AdGuard host's IP as the only DNS server in your router's DHCP settings (option 6). Devices pick it up at their next lease renewal, usually within a few hours; toggle Wi-Fi on a phone to force it. If your ISP router cannot change DNS, let AdGuard's built-in DHCP server take over, but only after disabling the router's, because two DHCP servers on one LAN produce the kind of intermittent failure that takes an evening to diagnose.

Per-client rules are the reason to pick it over Pi-hole

Under Settings, Client settings, you can name a device by MAC or IP and give it its own blocklists, safe search, and a blocking schedule. A child's tablet gets Safe Search forced and social media blocked after 21:00; the TV gets the aggressive smart-TV telemetry list; your workstation gets almost nothing blocked because you are debugging ad code. Pi-hole added groups to cover this, but AdGuard's version is one screen and it was there first. The full trade-off, including Pi-hole's larger community and its lower-level tinkering options, is in the AdGuard Home vs Pi-hole comparison.

What it cannot do, so you stop trying

YouTube, Twitch, and most in-app ads are served from the same domains as the content. DNS blocking cannot separate them, and no blocklist will; use a browser extension for YouTube and accept the rest. Sites that notice a blocked tracker and refuse to load are handled from the query log: click the domain, choose Unblock, done. Devices with hard-coded DNS (many smart TVs and streaming sticks) bypass you unless your router redirects outbound port 53 to AdGuard, and browsers with their own DNS-over-HTTPS enabled bypass you unless you turn that off per browser or block the well-known DoH resolver domains, which AdGuard offers as a one-click filter.

What I'd do

Run it on the lowest-power box you own, in Docker with the compose above, after killing the stub listener. Set two encrypted upstreams, enable the default AdGuard DNS filter plus OISD, push the IP via router DHCP, and set query log retention to 7 days. Add per-client rules only when a specific device needs them. Access from outside the house goes over Tailscale with AdGuard set as the tailnet's DNS server, never by exposing port 53 to the internet.