AdGuard Home setup guide

[yeraycito]

Unbound - General

Unbound - DNS over TLS

[yeraycito]

Adguardhome - DNS settings - Upstream DNS servers

Adguardhome - DNS settings - Bootstrap DNS servers

[blue_shift]

Hi everybody,

I just found your post. Does your AdGuard Home start without any problems? I tried to install it using GitHub versions (beta & final) but I am not even able to start it - same using the Max-It plugin. I see posts that it can use port 53, right after that I get the message "dhcpv4 srv: nil ist not an IP address".

Then I see posts for the IP addresses of my opnsense and the used ports 3000 and 3001. But there is no webinterface available. I got nothing on port 3000 and 3001.

Thought I try configuring it on a clean virtual machine, ended up in exactly the same problem!

Any idea what could be the reason for that?

[aduwing]

Hello,

I am trying to install AdGuard Home using the guide provided. But when I change the listening port in Unbound to 5353 the service is not starting. When I return it to 53 the service starts. Any ideas why Unbound service would not start?

Currently on version 22.7.4.

Thank you.

[yeraycito]

Solution to Auto-update failed error when trying to install update 0.107.15 on Adguard Home:

1 - In Opnsense stop Adguard Home

2 - Donwload and unzip AdGuardHome_freebsd_amd64.tar.gz ( https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.15 )

3 - Access Opnsense via ssh to /usr/local/AdGuardHome and replace the old files with the new ones respecting the permissions of those files.

[yeraycito]

4 - In Opnsense launching Adguard Home

[Nekromantik]

anyone else not able to update adguard?
it says cannot update error

[svengru]

Yes, running into the same error trying to update to v0.107.15. Never had this issue before.
Just did the manual upgrade and all works fine.

[Inxsible]

Just setup AdGuard Home with Unbound as the upstream server. Everything seems to be working except my configuration for SSL offloading via HAProxy plugin on Opnsense. I can access AdGuard Home using the IP, but not via a domain name. I can however access all my other services (password manager, local cloud etc) via the domain names.

I have already set up the necessary Overrides under Unbound for it and also created the Real Server, Backend Pool, Condition & Rules in HAProxy. Are there some headers that are required for this to work?

[opnbnuser]

Hi, I have an OPNSense running fine with mimugmails AdGuard@Home.
When moving to a different PC (Fujitsu S920 AMD 4x1,5 + Intel NIC) and booting, then OPNSense is working fine. But Adguard@Home is not starting.

Where can/should I look for issues?

Never mind, the config in /usr/local/AdGuardHome/AdGuardHome.yaml was empty - crazy I copied over the existing one from agh-backup to make it work again.

[yodaleaff]

Hi Guys,

if i followed this guide - but i have one problem

I cannot fetch Firmware - Updates/Plugins anymore
I need to set an DNS under General and Tick "Do not use the local DNS service as a nameserver for this system"
to make my system fetch these

I ran into this problem also. I think it is caused by only selecting the LAN interface during initial adguard setup. My thinking was "why would I want to have DNS on the WAN?" I guess the answer is that, without it, opnsense doesn't get dns. Maybe it could have also been fixed by putting the router IP in the opnsense gui? Anyway,  I fixed it by editing the AdGuardHome.yaml file.

Code: [Select]

# Different network interfaces.
'dns':
    'bind_hosts':
    - '127.0.0.1'
    - '192.168.1.1'

https://github.com/AdguardTeam/AdGuardHome/wiki/Configuration

[techsolo12]

Hello Guys,

at first, a big thank you to @yeraycito for your tutorial!

I have some addional steps for the tutorial, if you want to use a wildcard certificate from acme client and domain name in your local network.
For me i can't get adguard webui with ssl working on the domain name from opnsense. My goal was to use the webui like this: https://opnsense.your-local-domain.tld or on a another port like opnsense.your-local-domain.tld:4443 with ssl wildcard certificate.


Opnsense 22.7.4 Install:

1 - Activate mimugmail's community repository

2 - Install AdGuardHome from System --> Firmware --> Plugins

3 - Opnsense - System - Settings -General

      DNS Servers: empty

      Untick: Do not use the local DNS service as a nameserver for this system

      Untick: Allow DNS server list to be overridden by DHCP/PPP on WAN

4 - Services – DHCPv4 – [LAN] : DNS Servers all empty

5 – Opnsense – Services - Unbound DNS – General

       Tick: Enable Unbound ( Listen Port: 5353 )

       Tick: Enable DNSSEC Support
       
       Network Interfaces: All

6 - Opnsense - Services - Unbound - Dns Over Tls

      Server IP: 1.1.1.1

      Server Port: 853

      Verify CN: cloudflare-dns.com

7 - Open SSH Tunnel to OPNSense and edit the following config file
     

Code: [Select]

nano /usr/local/AdGuardHome/AdGuardHome.yaml
7.1 - You need to change following parts:

Code: [Select]

bind_host: 0.0.0.0
dns:
  bind_hosts:
    - 0.0.0.0

7.2 - Activate and start AdGuardHome from Services --> AdGuardHome

8 - Navigate to http://Opnsense ip:3000/ ( 127.0.0.1:3000 ) to complete the setup Adguard

9 - Adguard Home - DNS Configuration - Upstream Servers:

       Add 127.0.0.1:5353    !!!Delete those that exist!!!

10 – Adguard Home – DNS Configuration – Bootstrap DNS servers

       Add 127.0.0.1:5353    !!!Delete those that exist!!!
     
11 - Adguard Home - DNS Configuration - Private reverse DNS servers:

       Add 127.0.0.1:5353

12 - Now go Settings -> Encryption

       Pick "Encrytion activation"

       Servername = opnsensehostname.your-local-domain.tld

       Tick: "Automatic HTTPS redirect"
 
       If you want change HTTPS do it in "HTTPS-Port"

       Under Certificate choose your certificate from acme client which should be located in:

Code: [Select]

/var/etc/acme-client/home/*.your-local-domain.tld/fullchain.cer
       Under Private Key choose your certificate from acme client which should be located in:

Code: [Select]

/var/etc/acme-client/home/*.your-local-domain.tld/*.your-local-domain.tld.key
13 - Save the settings
       
If you get a warninghint like: "validating certificate pair: certificates has no IP addresses; DNS-over-TLS won't be advertised via DDR" it's a known bug since version 0.127.16 with update to version 0.127.19 the color is only white and not red like in x.16, x.17, x.18

With best regards
techsolo12

EDIT: If you want to check if your setup works correctly you can use this website https://www.cloudflare.com/de-de/ssl/encrypted-sni/

[Lip90]

DNS over IPsec did't work with Adguard and unbound. Only with unbound ist worked. Can someone help?

[Lip90]

nobody has an idea? Or can someone test it to see if it works?

[Woodie75]

Hi all,

in addition to all the great manuals in this thread (because it drove me crazy):

if you use the mDNS repeater plugin you shouldn't use port 5353 for unbound. It interfers with the repeater plugin and in my case it caused adguard not starting up after rebooting opnsense. I had to start adguard manually then.
After using a different port in unbound the problem has gone.