STEP 1: Update Your System

sudo apt update && sudo apt upgrade -y

 

Step 1.5: install vm tools for vmware esxi control (Optional)

sudo apt install open-vm-tools

 

Step 2: Install ufw

sudo apt install ufw -y

 

Step 3: Configure ufw

# 1. Set default policies

# IMPORTANT: This should always be done FIRST to ensure security by default.

# Deny all incoming connections by default

sudo ufw default deny incoming

# Allow all outgoing connections by default (AdGuard needs to reach Unbound and the internet for updates)

sudo ufw default allow outgoing

 

STEP 4: Allow SSH access (so you don’t lock yourself out)

# Adjust port 22 if your SSH server uses a different port.

sudo ufw allow ssh

 

STEP 5: Allow incoming DNS queries to AdGuard Home from your local network

# This allows your router and client devices to send DNS queries to 10.10.10.7

sudo ufw allow from 10.10.10.0/24 to any port 53 proto udp

sudo ufw allow from 10.10.10.0/24 to any port 53 proto tcp

 

STEP 6: Allow incoming AdGuard Home web interface access from your local network

# This allows you to access http://10.10.10.7:3000

sudo ufw allow from 10.10.10.0/24 to any port 3000 proto tcp

 

STEP 7: Enable UFW (this activates all the rules set above)

# This should be the very last command for UFW setup.

sudo ufw enable

# Verify UFW status (optional, after enabling)

sudo ufw status verbose

 

STEP 8: Disable systemd-resolved and configure a permanent external DNS fallback for the OS

sudo systemctl disable systemd-resolved –now

sudo rm /etc/resolv.conf

sudo nano /etc/resolv.conf

nameserver 1.1.1.1

nameserver 8.8.8.8

 

STEP 9: Install essential system utilities (curl, wget, and sudo) required for downloading installation packages, fetching web resources, and executing administrative commands.

sudo apt install curl wget sudo -y

 

STEP 10: Download & Install AdGuard Home (Official Script – Recommended)

#The easiest and safest method is using the official installer:

curl -s -S -L https://static.adguard.com/adguardhome/release/AdGuardHome_linux_amd64.tar.gz -o AdGuardHome.tar.gz

#Extract it:

tar -xvzf AdGuardHome.tar.gz

cd AdGuardHome

#Run the installer:

sudo ./AdGuardHome -s install

 

STEP 11: Access the Web Interface

#By default, AdGuard Home runs at:

http://<your-server-ip>:3000

For example: http://10.10.10.7:3000

#Crucial Note: During the AdGuard Home setup wizard, when it asks for the DNS listening interface, 

#ensure you choose All Interfaces

#This is typically selected during the first-run wizard.

#You’ll be guided through a simple setup wizard where you’ll:

#Set an admin username and password

#Choose the port (keep default 53 for DNS)

 

STEP 12: Choose black list

 

AdGuard DNS filter

https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt

 

Perflyst and Dandelion Sprout’s Smart-TV Blocklist

https://adguardteam.github.io/HostlistsRegistry/assets/filter_7.txt

 

Malicious URL Blocklist (URLHaus)

https://adguardteam.github.io/HostlistsRegistry/assets/filter_11.txt

 

Dandelion Sprout’s Anti-Malware List

https://adguardteam.github.io/HostlistsRegistry/assets/filter_12.txt

 

Phishing URL Blocklist (PhishTank and OpenPhish)

https://adguardteam.github.io/HostlistsRegistry/assets/filter_30.txt

 

Stalkerware Indicators List

https://adguardteam.github.io/HostlistsRegistry/assets/filter_31.txt

 

Dandelion Sprout’s Anti Push Notifications

https://adguardteam.github.io/HostlistsRegistry/assets/filter_39.txt

 

uBlock₀ filters – Badware risks

https://adguardteam.github.io/HostlistsRegistry/assets/filter_50.txt

 

HaGeZi’s Samsung Tracker Blocklist

https://adguardteam.github.io/HostlistsRegistry/assets/filter_61.txt

 

HaGeZi’s Windows/Office Tracker Blocklist

https://adguardteam.github.io/HostlistsRegistry/assets/filter_63.txt

 

#Finalize configuration

 

STEP 13: Set Up Clients (Router or Devices)

#Point your router or individual devices to the Ubuntu server IP (e.g. 10.10.10.7) for DNS.

 

STEP 14: Point AdGuard to Unbound

#Settings → DNS Settings → Upstream DNS servers

#Replace the current entries (e.g., https://dns.google/dns-query, 1.1.1.1, etc.)

with:

10.10.10.4

 

#If Unbound is listening on port 53, just use 10.10.10.4

#If it’s listening on port 5353, then you must specify the port. 10.10.10.4:5353

 

STEP 15: Disable DNS-over-HTTPS or other public resolvers

#Make sure no fallback DNS entries are configured — only Unbound.

#Bonus: Preventing Leaks

#To make sure AdGuard doesn’t fall back to public DNS, go to:

#Settings → General Settings

#Uncheck: “Use AdGuard’s DNS servers if the upstream fails”

 

STEP 16: Configure the local operating system to use its own local DNS resolver (127.0.0.1) instead of external public servers, ensuring the server routes its own DNS queries through AdGuard Home.

sudo nano /etc/resolv.conf

#replace with below

nameserver 127.0.0.1

 

MANAGE THE SERVICE

#To stop/start/restart AdGuard Home:

sudo systemctl enable AdGuardHome

sudo systemctl stop AdGuardHome

sudo systemctl start AdGuardHome

sudo systemctl restart AdGuardHome

 

VERIFY

#On a client device:

nslookup example.com 10.10.10.7

#You should get a valid reply. Then check the AdGuard Home Query Log to confirm it’s working.