AdGuard Home Docker Setup: Network-Wide Ad Blocking for Your Homelab

Reading time: ~14 minutes Audience: Homelab and self-hosting enthusiasts

What Is AdGuard Home?

Overview

AdGuard Home is a network-wide ad and tracker blocking DNS server. Like Pi-hole, it acts as a DNS sinkhole, but it offers a modern web interface, built-in DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) support, and parental controls out of the box. It is written in Go, lightweight, and actively maintained by the AdGuard team.

A Brief History

AdGuard Home was released in 2019 as an open-source alternative to Pi-hole and AdGuard’s own commercial DNS. It gained popularity for its polished UI, native HTTPS support, and aggressive filtering engine. By 2026, it has become the default recommendation for users who want a modern DNS sinkhole without the plugin ecosystem of Pi-hole.

Why Use AdGuard Home in Your Homelab?

Modern DNS Privacy

AdGuard Home supports DoH, DoT, and DNS-over-QUIC natively. This encrypts DNS queries between your network and the upstream resolver, preventing ISPs and middlemen from snooping on your browsing history.

Built-in Parental Controls

Block adult websites, enforce safe search, and set time limits per client. This is useful for family networks and guest Wi-Fi without requiring client-side software.

Fast, Lightweight Engine

AdGuard Home’s filtering engine is written in Go and is faster than Pi-hole’s FTL for large blocklists. It handles millions of queries per day on a Raspberry Pi without strain.

Installation

Prerequisites

Linux server or Raspberry Pi with Docker
Port 53 (TCP/UDP) and 3000 (web UI) available
A static IP or DHCP reservation for the AdGuard host

Method 1: Docker Compose

version: "3.8"

services:
  adguardhome:
    image: adguard/adguardhome:latest
    container_name: adguardhome
    restart: always
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "80:80/tcp"
      - "443:443/tcp"
      - "3000:3000/tcp"
      - "853:853/tcp"
    volumes:
      - ./workdir:/opt/adguardhome/work
      - ./confdir:/opt/adguardhome/conf
    cap_add:
      - NET_ADMIN

Deploy:

docker compose up -d

Complete the setup wizard at http://your-server:3000.

Method 2: Docker Run

docker run -d --name adguardhome \
  --restart=always \
  -p 53:53/tcp -p 53:53/udp \
  -p 80:80/tcp -p 443:443/tcp \
  -p 3000:3000/tcp -p 853:853/tcp \
  -v $(pwd)/workdir:/opt/adguardhome/work \
  -v $(pwd)/confdir:/opt/adguardhome/conf \
  --cap-add=NET_ADMIN \
  adguard/adguardhome:latest

Basic Setup and Configuration

Step 1: Configure Upstream DNS

In Settings → DNS settings, choose encrypted upstreams:

https://dns.cloudflare.com/dns-query (Cloudflare DoH)
tls://dns.quad9.net (Quad9 DoT)
https://dns.adguard-dns.com/dns-query (AdGuard DoH)

For maximum privacy, run a local Unbound recursive resolver and set 127.0.0.1:5335 as the upstream.

Step 2: Add Filter Lists

AdGuard Home ships with default lists. Add more in Filters → DNS blocklists:

StevenBlack hosts
AdGuard DNS filter
MalwareDomainList
NoCoin filter list

Step 3: Set Up Client-Specific Rules

In Client settings, add devices by MAC or IP and assign custom filtering rules. Block social media for kids, allow all traffic for the home server, and enforce safe search for guests.

Advanced Features

DNS Rebinding Protection

AdGuard Home blocks DNS rebinding attacks by default. This prevents malicious websites from resolving private IP ranges (e.g., 192.168.x.x) to attack your router or internal services.

HTTPS Encryption for the Web UI

AdGuard Home can generate a Let’s Encrypt certificate for its web interface. In Encryption settings, enable automatic HTTPS and redirect HTTP to HTTPS.

Statistics and Query Log

The dashboard shows query volume, blocked percentage, top queried domains, and top clients. The query log is searchable and exportable. Use this to identify misbehaving IoT devices or tune your blocklists.

Integrating with Your Homelab

Reverse Proxy

Place AdGuard Home behind Traefik or Nginx Proxy Manager:

labels:
  - "traefik.enable=true"
  - "traefik.http.routers.adguard.rule=Host(`dns.yourdomain.com`)"
  - "traefik.http.routers.adguard.tls.certresolver=letsencrypt"
  - "traefik.http.services.adguard.loadbalancer.server.port=80"

VPN Integration

Set your VPN’s DNS to AdGuard Home for ad blocking on mobile devices. In WireGuard, set DNS = 192.168.1.10 in the client config.

Migration from Pi-hole

AdGuard Home can import Pi-hole blocklists and custom rules. Export your Pi-hole whitelist and blacklist, then import them via Filters → Custom filtering rules. The statistics history will not transfer.

Alternatives to Consider

Tool	Best For	DoH/DoT	Parental Controls	UI
AdGuard Home	Modern DNS filtering	Yes	Yes	Excellent
Pi-hole	Community, plugins	Via Unbound	No	Functional
Technitium DNS	Full DNS server	Yes	No	Advanced
NextDNS	Cloud-based, no hardware	Yes	Yes	Excellent

Frequently Asked Questions

Can I run AdGuard Home and Pi-hole together?

Not recommended on the same host due to port 53 conflicts. Choose one. If you need both features, use AdGuard Home as the primary and forward specific queries to Pi-hole for custom plugins.

Does AdGuard Home block YouTube ads?

Partially. DNS-level blocking cannot block all YouTube ads because they are served from the same domains as content. Use a browser extension for complete YouTube ad blocking.

How do I update AdGuard Home?

docker pull adguard/adguardhome:latest
docker compose up -d

Conclusion

Summary

AdGuard Home is the modern successor to Pi-hole for users who want DNS privacy, parental controls, and a polished UI in a single package. With Docker, it deploys in minutes. With DoH/DoT, it protects your queries from ISP surveillance. For new homelabs, AdGuard Home is the recommended default DNS sinkhole.

Next Steps

Deploy AdGuard Home and set it as your router’s DNS
Enable DoH or DoT for encrypted upstream queries
Configure client-specific rules for family devices
Monitor query statistics and tune blocklists

Affiliate Opportunities

installation: hardware — Raspberry Pi kits, mini PCs
integration: tool — VPN services, parental control subscriptions
alternatives: tool — NextDNS, AdGuard VPN

Internal Linking Strategy

installation → setup_guide: Docker Compose for beginners
integration → related_guide: Pi-hole vs AdGuard Home comparison
alternatives → comparison: DNS filtering in the homelab

CTA

[comment] AdGuard Home or Pi-hole? Which do you prefer and why?
[newsletter] Subscribe for weekly homelab networking and privacy guides.
[internal_link] Next: compare AdGuard Home with Pi-hole