How to Install AdGuard Home on Linux: Block Ads Network-Wide and Secure Your Home Network - ITFROMZERO - Share tobe shared! A complete guide to installing AdGuard Home on Linux. Learn how to resolve systemd-resolved port 53 conflicts, set up encrypted upstream DoH/DoT, and secure your home network.

Installing uBlock Origin on a personal laptop is straightforward enough. But picture configuring each of the five smartphones in your house one by one, enduring persistent ad banners on a Samsung Smart TV, or managing IoT cameras quietly phoning home telemetry to unknown remote servers. In scenarios like these, deploying a centralized DNS sinkhole at the gateway level is the most effective approach. Every device connecting to your Wi-Fi is automatically protected—without needing any client-side apps installed.

Table of Contents

Comparing Popular Ad-Blocking Solutions

In practice, choosing an ad-blocking strategy usually comes down to three main approaches:

Browser Extensions (uBlock Origin, AdGuard): These work directly inside the browser by manipulating HTML and DOM elements. This method delivers the cleanest filtering, even removing blank ad placeholders on platforms like YouTube or Facebook. The downside? They are completely powerless on Smart TVs, mobile games, and IoT devices.
Pi-hole: The classic open-source DNS sinkhole—lightweight, highly reliable, and battle-tested on Raspberry Pi hardware. However, Pi-hole lacks native support for encrypted DNS protocols out of the box. To route queries over DoH or DoT and prevent ISP snooping, you must configure external companion services like cloudflared or unbound, which adds management overhead.
AdGuard Home: Built with Go and packaged as a single standalone binary. It features native, first-class support for DoH, DoT, and DoQ out of the box. The web interface is clean and intuitive, making client-specific rule management possible in just a few clicks.

Why AdGuard Home Is Ideal for Homes and Small Offices

For network footprints ranging from 10 to 100 devices, AdGuard Home is hard to beat in terms of usability and deployment speed. You can easily spin it up on an older Raspberry Pi 3, an x86 mini PC, or a budget $5/month cloud VPS.

Resource utilization remains modest: AdGuard Home typically consumes around 80MB to 150MB of RAM even with roughly 300,000 active blocklist rules loaded. While slightly higher than Pi-hole, this footprint easily runs within the limits of modern low-power hardware.

A quick prerequisite before installation: ensure your Linux host is assigned a static IP within your local network. This prevents your router from handing out a new IP address after a reboot, which would drop DNS resolution across the entire house. When segmenting your network, consider using an online subnet calculator to clearly divide your DHCP dynamic pool from your static server assignments to avoid IP collisions.

Step-by-Step Guide: Deploying AdGuard Home on Linux

Step 1: Free Up Port 53 Held by systemd-resolved

This is the classic stumbling block where 90% of first-time installations on Ubuntu or Debian fail. By default, systemd-resolved binds to 53/UDP as a local stub listener, preventing AdGuard Home from binding to the standard DNS port.

Open the configuration file with root privileges:

sudo nano /etc/systemd/resolved.conf

Find and modify the following two parameters (uncomment them by removing any leading #):

DNSStubListener=no
DNS=127.0.0.1

Save and exit (Ctrl+O, Enter, then Ctrl+X). Next, symlink your system’s DNS resolver configuration to the active runtime file and restart the service:

sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
sudo systemctl restart systemd-resolved

Verify that port 53 is now open and available:

sudo ss -tulpn | grep :53

If the terminal output is clean and returns no listening processes, port 53 is clear.

Step 2: Install AdGuard Home Using the Official Script

Run the automated installation script below. It detects your CPU architecture (x86_64, ARM64) automatically, downloads the appropriate release, and sets up a systemd service:

curl -s -S -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -v

Check the status of the service to confirm it is up:

sudo systemctl status AdGuardHome

Once you see the green active (running) status indicator, the terminal phase is complete.

Step 3: Complete the Initial Web Setup Wizard

From any computer on the same local network, open your web browser and navigate to:

http://<LINUX_SERVER_IP>:3000

Click Get Started to launch the wizard.
Web Interface: Select your LAN network interface. Keep the default port 80, or change it to 8080 if your server is already hosting Nginx or Apache.
DNS Server: Bind port 53 to your LAN network adapter.
Set up an administrative account (Username and Master Password).
Click Next through the confirmation prompts and log in to the Dashboard.

Step 4: Configure Encrypted Upstream DNS (DoH / DoT)

Standard plaintext DNS queries leave your browsing habits visible to ISPs and open to manipulation. Upgrading to encrypted upstream protocols helps secure your DNS privacy.

Go to Settings > DNS settings. In the Upstream DNS servers field, replace the default configuration with these privacy-focused providers:

https://dns.cloudflare.com/dns-query
https://dns.google/dns-query
tls://1.1.1.1
tls://8.8.8.8

Under Upstream mode directly below, select Parallel requests. This tells AdGuard Home to query all specified upstream servers at the same time and use the fastest response, keeping resolution latency as low as possible.

In the Bootstrap DNS servers section, provide reliable plain IP resolvers to bootstrap the initial host lookups for the DoH hostnames:

1.1.1.1:53
8.8.8.8:53

Click Apply, then click Test upstreams. If the test passes with low response times (typically under 30ms), your upstream configuration is ready.

Bước 5: Add Region-Specific Blocklists and Enable Parental Controls

While default AdGuard lists handle broad global trackers well, region-specific advertising domains and local tracking scripts can slip through. Add localized community lists (such as the ABPVN list for Vietnamese web traffic) to catch regional ads:

Navigate to Filters > DNS blocklists > click Add blocklist > choose Add a custom list.
Name: ABPVN Filter
URL: https://raw.githubusercontent.com/abpvn/abpvn/master/filter/abpvn_AdGuardHome.txt
Click Save to let the system fetch and compile the rules.

If you want to manage screen time or restrict certain apps for children, head over to Filters > Blocked services. You can selectively block platforms like TikTok, Facebook, Roblox, or Discord with a single toggle.

Step 6: Point Router DNS to AdGuard Home

Rather than manually updating network properties on every device, configure your Wi-Fi router to distribute your AdGuard Home DNS server over DHCP:

Log in to your router’s admin portal (commonly 192.168.1.1 or 192.168.0.1).
Find the DHCP Server settings and locate the Primary DNS field.
Enter the static IP address of your AdGuard Home server. Leave Secondary DNS blank (or duplicate the primary IP) to prevent devices from silently falling back to unencrypted ISP DNS.
Save your changes, then disconnect and reconnect Wi-Fi on a client device to refresh its DHCP lease and pick up the new DNS address.

Practical Tips for Smooth, Trouble-Free Operation

Avoid Stacking Too Many Blocklists: Loading dozens of lists containing millions of rules rarely improves protection. Instead, it balloons memory usage and dramatically increases false positives. Family members will quickly complain when affiliate redirects break, mobile banking apps misbehave, or chat image uploads stall. A balanced setup—combining AdGuard’s default list with one well-maintained regional list—routinely blocks 95% to 98% of unwanted traffic.
Enable Optimistic Caching: Turn this option on under DNS Settings. AdGuard Home will immediately return cached records to clients even if their TTL has expired, while quietly refreshing the record in the background. This can drop observed DNS lookup times from 40–70ms down to 1–3ms.
Use the Query Log for Quick Troubleshooting: If a specific service or website fails to load, avoid disabling the entire sinkhole. Jump straight into the Query Log and filter by the affected client’s IP. Blocked queries appear highlighted in red; clicking Unblock immediately adds the necessary domain to your custom whitelist.
Back Up AdGuardHome.yaml Regularly: Your entire server configuration, blocklists, and client assignments live inside /opt/AdGuardHome/AdGuardHome.yaml. Set up a simple weekly cron job to back up this file to cloud storage or a secondary machine. If your storage drive ever fails, you can restore your complete DNS environment in under three minutes.