AdGuard Home VPS

Who it suits

Blocking ads and trackers on your phone and laptop wherever you are, usually over WireGuard or Tailscale, or with DNS-over-HTTPS from your own domain. Sending all your home's lookups to a server across the internet adds delay to each one; for a whole home network, a small computer at home does that job better.

Which plan

Budget is plenty for a personal or family resolver. AdGuard publishes no minimum; blocklists and the query log are what use memory, so keep the log's retention modest on Budget.

What we install

AdGuard Home is a DNS server that blocks ads, trackers and malicious domains for every device that uses it. We install it with AdGuard's script to /opt/AdGuardHome as a systemd service, finish its first-run setup through its API, and allow only private, VPN (WireGuard and Tailscale) and loopback addresses to query it.

From order to ready

1. Server ready. We email you when the server is running, and you can log in with SSH. The installer starts on that same first boot.
2. Installer running. It logs to /var/log/vps9-setup.log; tail -f it to watch.
3. Application ready. /var/lib/vps9-setup.exit appears when the installer has finished, holding 0 if it worked. AdGuard Home is ready when systemctl status AdGuardHome shows it running and its web interface answers on 127.0.0.1:3000 with the login in /root/adguard-admin.txt.

What you still do

1. From your computer, run ssh -L 3000:127.0.0.1:3000 root@<your IPv4>, open http://localhost:3000 and log in as admin with the password from cat /root/adguard-admin.txt.
2. Choose how your devices reach it: over WireGuard or Tailscale (their addresses are already allowed), or add your home's IP address in Settings, DNS settings, Access settings.
3. For DNS-over-HTTPS, point a domain at the server, allow ports 80 and 443, run vps9-https dns.example.com, add a ClientID for each device to the allowed clients, and use https://dns.example.com/dns-query/<ClientID> on it.

Exposure and security

An open DNS resolver gets abused for attacks, so AdGuard Home only resolves for 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10 (Tailscale), fc00::/7 and loopback; add your own addresses or ClientIDs in its access settings. Port 53 is open, but it doesn't resolve for anyone else. The web interface listens on 127.0.0.1:3000 behind the admin password, and the setup wizard never faces the internet: the installer keeps port 3000 closed while it completes it. On Ubuntu, systemd-resolved hands port 53 to AdGuard Home and the server uses it for its own lookups.

Backups and upgrades

Update from the web interface when it offers a new version, or with /opt/AdGuardHome/AdGuardHome --update. We turn on the operating system's automatic security updates. Back up /opt/AdGuardHome/AdGuardHome.yaml and the data folder next to it: that's the whole configuration. We run the hardware, the network and the first-boot install; after that, AdGuard Home is yours to run, and we don't manage, update or back it up for you.

Order it from your terminal

$ vps9 servers create --plan budget --image ubuntu-24.04 --app adguard --hostname web-1 --key key_8f2c

{
  "plan": "budget",
  "image": "ubuntu-24.04",
  "hostname": "web-1",
  "app": "adguard"
}