AdGuard Home
Reverse Proxy & GatewaysNetwork-wide DNS ad and tracker blocker
Replaces Pi-hole, NextDNS
Network-wide DNS filtering
Network Privacy & Remote Access Stack
DNS ad-blocking plus WireGuard access to your whole network.
AdGuard Home filters ads and trackers at the DNS level for every device on the network, wg-easy gives you a WireGuard VPN with a web UI for road-warrior access back home, and Headscale lets you run a Tailscale-compatible mesh coordination server so devices connect directly wherever they are. Together they cover the two questions every homelab hits early: how do I block junk network-wide, and how do I reach my services securely from outside.
The apps and their roles
Last reviewed Oct 11, 2026 · 656 words
This is the cheapest stack in the directory and one of the most useful: about 384 MB of RAM in total by the directory's estimates, 128 MB for each of the three apps. AdGuard Home filters DNS for the house, and wg-easy or Headscale gets you back into the house from outside. The wiring that ties them together is one setting: point your VPN clients' DNS at AdGuard Home, so ad and tracker blocking follows your phone onto mobile data.
What talks to what
AdGuard Home sits on a static LAN address and answers DNS on port 53. Your router hands that address to every device via DHCP. Upstream, AdGuard can forward over encrypted DNS.
wg-easy runs a single WireGuard interface with a web UI that creates clients and shows QR codes for phones. You forward one UDP port on the router to it, and each client config names a DNS server; set that to AdGuard Home's LAN address.
Headscale is a self-hosted coordination server for the official Tailscale clients. Instead of a hub that all traffic passes through, devices register with Headscale and then connect to each other directly. Its DNS settings can push your AdGuard address to every node, which gives you the same filtering wherever a device is.
| App | Rated | Directory RAM estimate | Exposed to internet |
|---|---|---|---|
| AdGuard Home | Easy | 128 MB | Never |
| wg-easy | Easy | 128 MB | One UDP port |
| Headscale | Medium | 128 MB | HTTPS, behind your proxy |
Do you need both wg-easy and Headscale?
Usually not for long. wg-easy is the quicker route when the goal is "my phone can reach my home network", because it is one container and one forwarded port. Headscale earns its Medium rating and its extra moving parts when you have several sites or devices that should reach each other directly, and it has no official GUI. Many people start with wg-easy and move to Headscale when a second location appears. The remote access comparison lays out that fork.
Deploy in this order
AdGuard Home first, because everything else should resolve through it. On most Linux hosts port 53 collides with systemd-resolved, so disable its DNSStubListener before starting the container. The first-run wizard listens on port 3000 and the UI moves to port 80 afterwards. Test it from one device before changing the router's DHCP settings.
Then wg-easy, with the client DNS pointed at AdGuard. Then Headscale if you need it, behind your reverse proxy with valid TLS, since the Tailscale clients talk to it over HTTPS.
The mistake: making one box the only DNS server
When AdGuard Home is the sole DNS server on the network and the host reboots, updates or dies, the whole household loses the internet and blames you. Worse, if the host itself resolves through AdGuard, it can fail to pull the image it needs to recover. Give the host a static upstream resolver of its own, and either run a second AdGuard instance or hand out a fallback resolver you accept will bypass filtering during outages.
The second mistake is publishing port 53 to the internet. Open resolvers get found by scanners and used for amplification attacks. AdGuard Home should only ever answer the LAN and VPN clients.
Backups
Each app keeps small state: AdGuard's conf and work directories, wg-easy's client configs, and Headscale's database and keys. Losing Headscale's or wg-easy's state means re-enrolling every device, so back these up even though they are tiny.
What I'd do
Deploy AdGuard Home first and live with it for a week, then add wg-easy with its DNS pointed home. Reach for Headscale only when you have a second site to join. If you are still choosing a DNS filter, read Pi-hole vs AdGuard.