Privacy-Focused DNS Filtering with AdGuard Home

# Install on Linux (x86_64)
curl -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh

# Or manual install
wget https://github.com/AdguardTeam/AdGuardHome/releases/latest/download/AdGuardHome_linux_amd64.tar.gz
tar xzf AdGuardHome_linux_amd64.tar.gz
cd AdGuardHome
sudo ./AdGuardHome -s install

# Check service status
sudo systemctl status AdGuardHome

wget https://github.com/AdguardTeam/AdGuardHome/releases/latest/download/AdGuardHome_linux_arm64.tar.gz
tar xzf AdGuardHome_linux_arm64.tar.gz
cd AdGuardHome
sudo ./AdGuardHome -s install

# Verify devices are using your DNS
# On a device on the network:
nslookup doubleclick.net
# Should return 0.0.0.0 (blocked) instead of the real IP

# AdGuard Home config: /opt/AdGuardHome/AdGuardHome.yaml
tls:
  enabled: true
  server_name: "dns.yourdomain.com"
  force_https: true
  port_https: 443
  port_dns_over_tls: 853
  port_dns_over_quic: 784
  certificate_path: "/etc/letsencrypt/live/dns.yourdomain.com/fullchain.pem"
  private_key_path: "/etc/letsencrypt/live/dns.yourdomain.com/privkey.pem"

# Get a certificate with certbot
sudo certbot certonly --standalone -d dns.yourdomain.com

# Restart AdGuard Home
sudo systemctl restart AdGuardHome

# Query log is stored at (default):
/opt/AdGuardHome/data/querylog.json

# Count top blocked domains
jq -r 'select(.Result.IsFiltered == true) | .QH' /opt/AdGuardHome/data/querylog.json \
  | sort | uniq -c | sort -rn | head -20

# Count queries per client
jq -r '.IP' /opt/AdGuardHome/data/querylog.json \
  | sort | uniq -c | sort -rn | head -10

# Find clients that bypass your DNS (query from unexpected IPs)

# Export stats via API
curl http://localhost:3000/control/stats \
  -H "Authorization: Basic $(echo -n 'admin:yourpassword' | base64)" | jq '{
    total_queries: .num_dns_queries,
    blocked: .num_blocked_filtering,
    block_ratio: (.num_blocked_filtering / .num_dns_queries * 100 | round)
  }'

#!/bin/bash
# Debug script to find problematic blocklist

BROKEN_DOMAIN="service-that-should-work.com"
CURL_TIMEOUT=5

echo "Testing: $BROKEN_DOMAIN"
curl -s --max-time $CURL_TIMEOUT $BROKEN_DOMAIN

if [ $? -ne 0 ]; then
  echo "ERROR: Connection failed or timed out"
  echo "Checking which blocklist is blocking this..."

  # Query AdGuard Home debug API
  curl -s "http://localhost:3000/control/filtering/check?name=$BROKEN_DOMAIN" \
    -H "Authorization: Basic $(echo -n 'admin:password' | base64)" | jq '.rules'

  # Output will show which filter(s) are blocking
fi

#!/bin/bash
# analyze-queries.sh - Find patterns in DNS blocking

# Top blocked domains
echo "=== Top 20 Blocked Domains ==="
jq -r 'select(.Result.IsFiltered == true) | .QH' /opt/AdGuardHome/data/querylog.json \
  | sort | uniq -c | sort -rn | head -20

# Percentage of queries blocked
echo "=== Blocking Statistics ==="
TOTAL=$(jq 'length' /opt/AdGuardHome/data/querylog.json)
BLOCKED=$(jq 'select(.Result.IsFiltered == true) | .QH' /opt/AdGuardHome/data/querylog.json | wc -l)
PERCENTAGE=$((BLOCKED * 100 / TOTAL))
echo "Blocked: $BLOCKED out of $TOTAL ($PERCENTAGE%)"

# Queries by client (who's being filtered most)
echo "=== Top Clients by Query Count ==="
jq -r '.IP' /opt/AdGuardHome/data/querylog.json \
  | sort | uniq -c | sort -rn | head -10

# Failed/timed out queries (potential issues)
echo "=== Failed Queries ==="
jq -r 'select(.Result.Reason == "NotFiltered" or .Result.Reason == "Blocked") | .QH' /opt/AdGuardHome/data/querylog.json \
  | sort | uniq -c | sort -rn | head -10

#!/bin/bash
# backup-adguard.sh - Regular AdGuard Home backup

BACKUP_DIR="/backup/adguard"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)

mkdir -p "$BACKUP_DIR"

# Backup configuration
cp -r /opt/AdGuardHome/data "$BACKUP_DIR/data-$TIMESTAMP"

# Backup database
cp /opt/AdGuardHome/AdGuardHome.db "$BACKUP_DIR/AdGuardHome-$TIMESTAMP.db"

# Export settings as JSON via API
curl -s http://localhost:3000/control/config \
  -H "Authorization: Basic $(echo -n 'admin:password' | base64)" \
  > "$BACKUP_DIR/config-$TIMESTAMP.json"

# Keep only last 30 days of backups
find "$BACKUP_DIR" -name "data-*" -mtime +30 -exec rm -rf {} \;
find "$BACKUP_DIR" -name "*.db" -mtime +30 -exec rm {} \;

# Encrypt backups
tar czf - "$BACKUP_DIR" | openssl enc -aes-256-cbc -out "$BACKUP_DIR/backup-$TIMESTAMP.tar.gz.enc"

echo "Backup complete: $BACKUP_DIR/backup-$TIMESTAMP.tar.gz.enc"