Block ALL Ads on Your Network (Even without a Raspberry Pi!)

Let’s be honest, who isn’t fed up with ads? You open a news site: ads. You search for that steamed ham recipe: ads. You get out of the shower and… Antonio Lobato! Do you want to know how much your car is worth?

The Internet has become an advertising minefield.

That’s why many of us rely on browser blockers, which save the day a bit. (Although we turn them off on YouTube to support creators, right? RIGHT?). But of course, you have to install it on your PC, mobile, tablet… and sometimes it’s a pain or downright impossible (ahem, Smart TV).

But what if I told you that you can make ALL gadgets connected to your WiFi automatically block that plague of ads and trackers? And not only that, but also malicious pages, adult content (ideal if you have kids or a business), and those cookies that make the washing machine you looked at three weeks ago chase you AND NOW YOU CAN’T STOP SEEING WASHING MACHINES.

Well yes, there is a solution and it’s called AdGuard Home. Pi-hole might sound more familiar, which is similar, but personally, I like AdGuard a little better.

In this post I’m going to tell you:

How these blockers work at the network level.
The key differences between AdGuard Home and Pi-hole (and why I stick with AdGuard).
The most important part: How to install AdGuard Home FOR FREE on your own server.

Let’s get to it!

What on earth is AdGuard Home? Understanding DNS

Okay, let’s start at the beginning. AdGuard Home is, in essence, a DNS server. “A what?”, you might ask. Don’t worry, I’ll explain it simply.

Imagine your mobile has a contact list. If you want to call someone, you don’t need to know their number by heart, you look for the name and call. Well, a DNS (Domain Name System) does the same but with web pages.

Websites live at weird addresses made of numbers (IPs), like 172.217.160.142 (which is Google’s, for example). Since nobody learns that, DNS acts like the phonebook: you type google.com, the DNS looks for the corresponding IP and connects you. Magic!

The “danger” of your ISP’s DNS

Normally, your router uses your Internet Service Provider’s (ISP) DNS. This means they know all the websites you visit. They don’t see the content thanks to HTTPS, but they do see your browsing history. And yes, they use that data for statistics… or to sell it and show you “personalized” ads like the damn washing machine.

That’s why it’s a good idea to change DNS. You can use public options like Cloudflare’s (1.1.1.1), which also help you bypass absurd blocks. In fact, I have a video where I explain how to do it.

How does AdGuard Home block ads?

AdGuard Home is a DNS server, yes, but a supercharged and configurable one. When you install and configure it on your network (don’t worry, we’ll get to that), this is what happens every time you try to enter a website, for example, edunavajas.com:

Your device asks AdGuard Home: “Hey, what is the IP for edunavajas.com?”.
AdGuard Home looks at its blocklists:
- Is it a known address for serving ads? Blocked! It returns nothing.
- Is it a tracker or a malicious site? Blocked!
- Is it a normal and nice page like mine? Go ahead! It gives you the IP.
If the page loads content from other addresses (ads, tracking scripts…), AdGuard repeats the process for each one. Those on blocklists are blocked and not even downloaded.

Result: You browse faster, consume less data and, best of all, goodbye ads and trackers. And all this, at the same speed as a normal DNS, you won’t even notice.

Plus, you can customize it a lot:

Use specific blocklists (like uBlock Origin’s, for example).
Block specific services (TikTok, Facebook, gambling sites…).
Set blocking schedules (ideal for controlling children’s access).
Block entire categories (adult, social networks…).

AdGuard Home vs. Pi-hole: Why do I stick with AdGuard?

Both are great and open source, point for both, but for me, AdGuard currently has several advantages:

More modern and simple interface: It is more pleasing to the eye and easy to use, especially for configuring HTTPS.
More “out of the box” features:
- Encrypted DNS (DNS-over-HTTPS, DNS-over-TLS).
- Integrated DHCP server (Pi-hole needs extra configuration).
- Integrated phishing and malware blocking.
- Parental control and Safe Search easier to activate.
- All this without installing additional software or editing weird files.
Written in Go: Pi-hole uses PHP. For programmers, Go is usually synonymous with better performance, fewer dependencies, and more maintainability.
Installation and fluidity: In general, AdGuard feels faster and more polished.

Note, Pi-hole is still a fantastic option and there are thousands of tutorials. But if you feel like changing a bit, with something complete out of the box and easy to set up, AdGuard is my recommendation.

What do you need to set up AdGuard Home?

AdGuard is a server, so you need… a server! But don’t panic, you don’t have to spend a fortune. You have several options:

A Raspberry Pi: The classic option. If you have one at home, great, although mine is already asking for retirement from so much use.
An old PC: Any computer gathering dust can work, whether it uses Windows or Linux, we will use Docker.
A VPS Server (Free!): My favorite option if you don’t have hardware available. You can get a FREE server on Oracle Cloud that works wonderfully. I have a complete tutorial here where I explain step by step how to get it (4 cores and 24GB of RAM for free!). This is the one I will use in this tutorial.

Indispensable requirement: The device you choose must be on 24/7, as it will be the one managing DNS requests for your network.

Step-by-Step Installation (VPS Server and Raspberry Pi!)

Let’s see how to install AdGuard using Docker, which makes everything much easier. The steps are almost identical for a VPS or a Raspberry Pi, but there is a small initial difference.

Step 0: Preparation (Raspberry Pi Only)

If you use a Raspberry Pi:

Install Raspberry Pi OS: If you don’t have it, use the Raspberry Pi Imager tool to install it on a microSD card. It’s super easy.
Connect via SSH: Once installed and connected to your network, connect to the Raspberry via SSH. You will need its local IP and your username/password.
IMPORTANT! Assign a Static IP: Since the Raspberry will be on your local network, its IP may change if it restarts. We need it to be fixed. Edit the network configuration file:
```
sudo nano /etc/dhcpcd.conf
```
Add these lines at the end, adapting the IPs to your local network (the IP you assign, your router’s IP and your router’s IP as DNS):
```
interface eth0 # or wlan0 if you use WiFi
static ip_address=192.168.1.104/24 # Choose a free IP in your network
static routers=192.168.1.1 # Your router's IP (gateway)
static domain_name_servers=192.168.1.1 # Your router's IP
```
Save (Ctrl+O), exit (Ctrl+X) and reboot (sudo reboot). From now on, that will be your Raspberry Pi’s static IP. Write it down!

Step 1: SSH Connection to the Server (VPS or Raspberry Pi)

Connect to your server (VPS or the Raspberry Pi with its new static IP) using SSH. If you use the Oracle VPS, you will need the public IP and the SSH key you downloaded when creating it.

# For VPS (example Oracle Cloud with user ubuntu)
ssh -i /path/to/your/key.key ubuntu@<VPS_PUBLIC_IP>

# For Raspberry Pi (example with user pi)
ssh pi@<RASPBERRY_STATIC_IP>

(Optional: I use the Warp terminal, It is very complete. Check it out if you want).

Step 2: Install Docker and Docker Compose

If you don’t have Docker installed, run these commands:

# Update the system
sudo apt update && sudo apt upgrade -y

# Install dependencies
sudo apt install -y ca-certificates curl gnupg lsb-release

# Add Docker's official GPG key
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg

# Set up the Docker repository
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
  $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# Install Docker Engine, CLI, Containerd, and Docker Compose
sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin

Step 3: Prepare AdGuard Home Configuration

Let’s create the folder structure and the Docker Compose configuration file:

# Create the main folder for AdGuard
mkdir adguard-home
cd adguard-home

# Create folders for data and configuration
mkdir adguard
mkdir adguard/work 
mdkri adguard/conf

# Create the docker-compose.yml file
nano docker-compose.yml

Paste the following content into the nano editor. Note! I have set port 8181 for the web interface. You can leave 80 by default if you don’t have it occupied, changing to 80:80/tcp.

services:
  adguardhome:
    image: adguard/adguardhome:latest
    container_name: adguardhome
    restart: unless-stopped
    ports:
      - "53:53/tcp"
      - "53:53/udp"     
      - "67:67/udp"     
      - "8181:8181/tcp" 
      - "443:443/tcp"   
      - "3000:3000/tcp" 
    volumes:
      - ./adguard/work:/opt/adguardhome/work
      - ./adguard/conf:/opt/adguardhome/conf

Save the file (Ctrl+O) and exit (Ctrl+X).

Step 4: Free Port 53! (Important on VPS/Ubuntu)

In many Ubuntu/Debian installations (especially on VPS), a service called systemd-resolved is already using port 53, which we need for our DNS. We have to kick it out!

Check if port 53 is occupied:
```
sudo lsof -i :53
```
If you see something listening (LISTEN) on port 53 (probably systemd-resolve), follow the steps below. If nothing comes up, perfect! You can skip to Step 5.

Stop and disable systemd-resolved:

sudo systemctl disable systemd-resolved.service
sudo systemctl stop systemd-resolved.service

Unlink the resolv.conf file managed by systemd:
```
sudo unlink /etc/resolv.conf
```
Create a new static resolv.conf (we’ll use Cloudflare as an example):
```
echo "nameserver 1.1.1.1" | sudo tee /etc/resolv.conf
```
Verify again that port 53 is free:
```
sudo lsof -i :53
```
Now nothing should appear listening.

Step 5: Open Ports in the Server Firewall (UFW)

If you have ufw (Uncomplicated Firewall) enabled, you need to open the ports that AdGuard will use:

# Allow necessary ports (adapt 8181 if you changed it)
sudo ufw allow 53/tcp
sudo ufw allow 53/udp
sudo ufw allow 67/udp
sudo ufw allow 68/tcp
sudo ufw allow 68/udp
sudo ufw allow 8181/tcp # Web interface port
sudo ufw allow 443/tcp
sudo ufw allow 443/udp
sudo ufw allow 853/tcp # DoT port
sudo ufw allow 3000/tcp # Initial setup port

# Reload UFW to apply rules
sudo ufw reload

# (Optional) Check status
sudo ufw status verbose

Step 6: Open Ports in the Cloud Provider (Example Oracle Cloud)

This step is CRUCIAL if you use a VPS. You have to open the same ports in your cloud provider’s firewall. In Oracle Cloud:

Go to the Oracle Cloud console.
Navigate to Compute -> Instances and select your instance.
Scroll down to Attached VNICs, click on the VNIC (Virtual Network Interface Card).
Click on the Subnet.
Click on the Security List (usually named “Default Security List for …”).
Click on Add Ingress Rules.
Now, IMPORTANT: For security, DO NOT open ports to the entire internet (0.0.0.0/0). Open ports ONLY for your current public IP. Search for it on Google (“what is my IP”).
Add a rule FOR EACH PORT you need (53 TCP, 53 UDP, 67 UDP, 68 TCP, 68 UDP, 8181 TCP, 443 TCP, 443 UDP, 853 TCP, 3000 TCP):
- Source Type: CIDR
- Source CIDR: <YOUR_PUBLIC_IP>/32 (The /32 is important!)
- IP Protocol: TCP or UDP as appropriate.
- Source Port Range: All
- Destination Port Range: The specific port (e.g., 53, 8181, 3000).
- Add a description if you want (e.g., “AdGuard DNS UDP”).
Click Add Ingress Rules at the bottom to save.

(Note: If your public IP changes often, you’ll have to update these rules. For public DNS or access from outside home, you would need to open port 53 (and maybe 853/443 for DoT/DoH) to 0.0.0.0/0, but be careful with security! Make sure to configure “Allowed Clients” correctly in AdGuard).

Step 7: Start AdGuard Home!

Now, the moment of truth

# From the adguard-home folder
sudo docker compose up -d

The -d runs it in the background. To see if it started correctly:

sudo docker compose logs -f

You should see messages indicating that AdGuard Home has started and is listening on ports, especially something like [info] AdGuard Home is available at http://127.0.0.1:3000. Perfect!

AdGuard Home Initial Configuration

Almost there! Now it’s time to configure AdGuard from its web interface.

Open your browser and go to http://<SERVER_IP>:3000 (use the VPS public IP or the Raspberry Pi static IP).
It will welcome you. Click on Get Started.
Admin Interface: It will ask you on which port you want the main web interface. The default is 80. Since we mapped 8181 to internal 80 in docker-compose.yml, leave port 80 here.
DNS Server: It will ask you on which port to listen for DNS requests. Leave it at 53, which is the standard.
Next.
Create admin account: Set a username and a SECURE password. This is the key to your AdGuard!
Next.
Configure devices: It will give you generic instructions. For now, click Next.
Done! Click Open Dashboard. It will redirect you to http://<SERVER_IP>:8181 (or the port you chose).
Log in with the user and password you just created.

Welcome to the AdGuard Home dashboard! You’ll see statistics (still empty) and options.

Recommended Configurations in AdGuard Home

Before configuring your devices, I recommend a couple of adjustments:

(Security) Allowed Clients:
- Go to Settings -> DNS Settings.
- Scroll down to the Allowed clients section.
- Add the public IP you normally connect from (the same one you put in the Oracle/Firewall rules). You can also add ranges from your local network if you use the Raspberry Pi (e.g., 192.168.1.0/24).
- This prevents anyone from using your DNS server. Save changes.
(Optional but Recommended) Enable HTTPS Encryption: So that access to the panel is secure (HTTPS instead of HTTP). You will need a domain or subdomain pointing to your server IP.
- Option A (Let’s Encrypt): Go to Settings -> Encryption settings. Enable encryption, enter your hostname (domain/subdomain) and your email. AdGuard will try to obtain a certificate automatically. You will need to have ports 80 and 443 open to the public (0.0.0.0/0) in your firewall (server and cloud provider) for validation to work.
- Option B (Own Certificate - e.g. Cloudflare Origin): If you use Cloudflare, you can generate an “Origin Certificate” (SSL/TLS -> Origin Server) for your domain/subdomain. Download the .pem (certificate) and .key (private key) files. Upload them to your server (e.g. to a new folder adguard-home/certs). Modify your docker-compose.yml to add these volumes:
```
volumes:
  - ./work:/opt/adguardhome/work
  - ./conf:/opt/adguardhome/conf
  - ./certs/your_certificate.pem:/opt/adguardhome/certificate.pem:ro
  - ./certs/your_key.key:/opt/adguardhome/private.key:ro
```
  Restart the container (sudo docker compose down && sudo docker compose up -d). Then, in AdGuard (Settings -> Encryption settings), enable encryption, put your domain, and specify the paths INSIDE the container: /opt/adguardhome/certificate.pem and /opt/adguardhome/private.key. Save.
- Once HTTPS is configured, you will access the panel through https://<YOUR_DOMAIN_OR_IP>:443 (or the port you mapped to internal 443 if you changed it).
Explore Filters:
- Go to Filters -> DNS blocklists. You will see the default blocklists active. You can add more from “Add blocklist” -> “Choose from the list” or pasting URLs of known lists.
- In Filters -> Blocked services, you can easily block popular services (Facebook, TikTok, etc.) or even set schedules.

Final Step: Configure the Router

The final push! For all devices in your home to use AdGuard Home automatically, you have to tell your router.

Access your router’s administration panel. It is usually at 192.168.1.1 or 192.168.0.1. The password is usually on a sticker under the router. If not, contact your provider.
Look for the LAN, Local Network or DHCP configuration section.
Locate the DNS Server settings.
Disable the “Use ISP DNS” or similar option.
Enter your AdGuard Home server IP (the VPS public IP or the Raspberry Pi static IP) as Primary DNS.
Secondary DNS (Optional):
- You can put a public DNS like 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google) as backup in case your AdGuard server fails.
- If you want to be strict and have EVERYTHING go through AdGuard, leave it blank or put 0.0.0.0.
- If you have another AdGuard server, you can put its IP here for redundancy.
Save changes and apply configuration. The router might restart.

THAT’S IT! Now, any device connecting to your WiFi will automatically use AdGuard Home. You may need to disconnect and reconnect your devices from WiFi to pick up the new DNS configuration.

Start enjoying a cleaner, faster, and safer network. You’ll see how the statistics in the AdGuard dashboard start filling up with blocks.

And that’s it! I hope this tutorial has been useful to you. ! 😉

What do you think?

Leave your opinion, question or suggestion. Comments are synced with GitHub Discussions .