Jang go Beakanya AdGuard Home mo VPS

AdGuard Home ke DNS sinkhole e o e tshwarang ka bowena le resolver ya mofuta wa recursive e e nang le interface ya web. E ka thibela di-ad, di-tracker le di-domain tsa malware bakeng sa sedirisiwa sengwe le sengwe se se e dirisang jaaka DNS — megala, di-laptop, di-TV tsa botlhale, le diporojeke tse dingwe tsa VPS. Go farologana le extension ya browser, e bereka le mo di-app tse di sa reetseng difaele tsa hosts. Go e tsamaisa mo VPS go mosola fa o batla filtering e e tshwanang o le mo tseleng, kgotsa fa o sa batle Raspberry Pi mo network ya gago ya kwa gae.

Default e kotsi e o sa tshwanelang go e romela ke resolver e e bulegileng: fa UDP/TCP 53 e ka fitlhelelwa go tswa mo internet yotlhe ntle le taolo ya pono, batho ba o sa ba itseng ba tla dirisa VPS ya gago bakeng sa DNS amplification mme o tla amogela dingongorego tsa tiriso e e sa siamang. Kaelo e e tsenya AdGuard Home mo Ubuntu, e golaganya DNS kwa localhost kgotsa interface ya sephiri ya WireGuard ntle le fa o senola ka maikaelelo DNS e e sireleditsweng, e baya dashboard mo HTTPS, mme e bontsha gore di-laptop le megala di ka dirisa DNS-over-HTTPS (DoH) kgotsa DNS-over-TLS (DoT) jang ntle le go bulela lefatshe port 53 ya kgale.

Se AdGuard Home e siametseng

Pi-hole ke tshwaniso e e tlwaelegileng. AdGuard Home ke binary e le nngwe e e nang le web UI e e agilweng mo teng, di-frontend tsa DNS tse di sireleditsweng tse di sa tlhokegeng, le ditlhophiso ka client. O ka e tsamaisa mo Docker kgotsa jaaka tirelo ya systemd. Mo VPS ya Hiddence e tsamaya sentle le VPN ya sephiri: disedirisiwa di tsena mo WireGuard, di romela DNS kwa VPS ka tunnel, mme ga di ise tsa senola port 53 mo setšhabeng.

• Go thibela mo network yotlhe ntle le go tsenya app mo sedirisiweng sengwe le sengwe
• DoH (443) le DoT (853) gore DNS e se ka ya nna mokwalo o o bulegileng mo Wi-Fi e e bulegileng
• Log ya dipotso le dipalopalo gore o bone sedirisiwa se se buang le domain efe
• Di-upstream tsa gago (Quad9, Cloudflare, kgotsa Unbound ya gago)
• Sebopego se sennye — VPS ya 1 GB e ka filter lelapa le di-client tse di mmalwa tse dingwe

Ditlhokego

O tlhoka domain fa o batla setifikeiti se se tshepagalang sa DoH/DoT le sa dashboard. O ka testa mo HTTP le IP ya server pele, mme o se ka wa e tlogela jalo. Fa systemd-resolved e setse e tshwere port 53 mo Ubuntu, re tla e golola pele ga AdGuard Home e golaganya DNS.

• VPS ya Ubuntu 22.04 kgotsa 24.04 e e nang le root/sudo
• 1 GB RAM e a lekana bakeng sa tiriso ya gago
• Domain kgotsa subdomain (dns.example.com) e e nang le A record kwa VPS
• Pono ya SSH; WireGuard e e sa tlhokegeng fa o batla DNS fela mo teng ga tunnel

Kgato 1: Golola port 53 mme o tsenye AdGuard Home

Ubuntu Server gantsi e tsamaisa systemd-resolved jaaka stub mo 127.0.0.53:53. AdGuard Home e batla 53 mo di-interface tse o di tlhophang. Installer e ka dira se, mme go se dira ka tlhamalalo go tila DNS e e senyegileng ka bontlha mo VPS ka boyona (server e santse e tlhoka go rarabolola di-package).

ssh root@YOUR_VPS_IP
apt update && apt -y upgrade
apt -y install curl ca-certificates

# See who owns port 53:
ss -tulpn | grep ':53'

# Typical Ubuntu fix: stop stub listener, point the OS at a temporary resolver
mkdir -p /etc/systemd/resolved.conf.d
cat >/etc/systemd/resolved.conf.d/adguardhome.conf <<'EOF'
[Resolve]
DNS=1.1.1.1
DNSStubListener=no
EOF
ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
systemctl restart systemd-resolved

curl -s -S -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -v

Kgato 2: Wizard ya go tsamaisa la ntlha

Installer e gatisitse URL, gantsi http://YOUR_IP:3000/. E bule, tlhama modirisi wa admin ka password e telele, mme o tlhophe di-address tsa go reetsa. Bakeng sa VPS e e bulegileng, peakanyo e e sireletsegileng ya ntlha ke: Admin Web mo 127.0.0.1:3000 (o tla baya Caddy kwa pele) kgotsa mo 80/443 morago ga TLS; DNS e reetsa mo 127.0.0.1:53 mmogo le interface ya VPN, e seng mo 0.0.0.0:53. Fa o tlhoka tota DNS ya mofuta wa LAN bakeng sa ditsala, rata DoH/DoT mo 443/853 ka authentication, e seng 53/udp e e bulegileng.

Tlhopha di-server tsa DNS tsa upstream tse o di tshepang. Batho ba bantsi ba dirisa https://dns.quad9.net/dns-query kgotsa Cloudflare. Tshuba dipotso tse di tsamayang mmogo fa o batla failover e e bonako. Tshuba lenaane la default la filter, mme o tsenye tse dingwe moragonyana — go tshuba lenaane le le masome a matlhano mo letsatsing la ntlha go dira gore go rarabolola go nne thata fa saete e senyega.

Kgato 3: Reverse proxy le HTTPS ya dashboard

Fa wizard e fetsa, AdGuard Home gantsi e sutisetsa UI kwa port 80. Se se thulana le Caddy kgotsa Nginx fa o tshwarela le di-saete. Mokgwa o o phepa ke: web ya AdGuard Home mo 127.0.0.1:8080, DNS mo 127.0.0.1:53, Caddy mo 443 bakeng sa dashboard le DoH.

# In AdGuard Home settings, bind the web UI to 127.0.0.1:8080
# Example Caddyfile:

dns.example.com {
    reverse_proxy 127.0.0.1:8080
}

# After Caddy is up:
curl -I https://dns.example.com

Kgato 4: Tshuba DNS-over-HTTPS le DNS-over-TLS

Mo ditlhophisong tsa Encryption, tshuba encryption, baya leina la server go dns.example.com, mme o bontshe AdGuard Home kwa difaeleng tsa gago tsa setifikeiti — tse Caddy e di bolokang, kgotsa disetifikeiti tse AdGuard Home e di amogelang ka boyona fa e reetsa mo 443. DoH gantsi ke https://dns.example.com/dns-query. DoT ke dns.example.com:853. Fa Caddy e setse e tshwere 443, letla Caddy e feleltse TLS mme e reverse-proxy tsela ya DoH kwa port e e bulegileng ya HTTP DoH ya AdGuard Home, kgotsa letla AdGuard Home e reetse mo 443 mme o baya dashboard mo subdomain e nngwe.

Netefatsa ka client pele ga o fetola sedirisiwa sengwe le sengwe. Mo laptop e e nang le curl e e sesha:

curl -H 'accept: application/dns-json' 'https://dns.example.com/dns-query?name=example.com&type=A'

# DoT test (kdig from knot-dnsutils, if installed):
# kdig @dns.example.com +tls-ca +tls-host=dns.example.com example.com

Kgato 5: Baya disedirisiwa tsa mmatota kwa resolver ya gago

Windows 11 le dikago tsa Android tse di sa tswa go nna teng di ka dirisa template ya DoH. iOS e ka dirisa profile ya peakanyo kgotsa client e e tshegetsang DoH. Firefox le Chromium le tsona di letlelela URL ya DoH ya gago. Bakeng sa router ya kwa gae, baya WAN DNS fela fa router e tshegetsa DoT/DoH; go seng jalo tsamaisa WireGuard mme o baya DNS kwa IP ya VPN ya VPS gore DNS ya kgale e se ka ya tshela internet.

• Android 9+: Private DNS (DoT) → dns.example.com
• Firefox: Settings → Network → DNS over HTTPS → URL ya gago https://dns.example.com/dns-query
• Disedirisiwa tsa Apple: mobileconfig e e saennweng kgotsa app e e tshegetsang DoH/DoT
• VPS e nngwe: baya resolv.conf kgotsa systemd-resolved kwa IP ya WireGuard ya instance e ya AdGuard
• Tila go baya IP e ya VPS jaaka DNS mo di-network tse di bulegileng tse di sa solofelwang ntle le encryption

Kgato 6: Firewall — tswalela DNS e e bulegileng ya recursive

Se ke karolo e e thibelang kgakgamalo e e maswe. Letlelela SSH, HTTPS, le ka boithaopo 853/tcp bakeng sa DoT. O se ka wa letlelela 53/udp go tswa mo 0.0.0.0/0 ntle le fa o na le peakanyo e e kgethegileng thata, e e nang le moedi wa lebelo, e e nang le authentication — mme le fa go ntse jalo, gongwe ga o a tshwanela.

ufw allow OpenSSH
ufw allow 443/tcp comment 'dashboard + DoH'
ufw allow 853/tcp comment 'DoT'
# If DNS is only on WireGuard (example iface wg0, 10.8.0.1):
# ufw allow in on wg0 to any port 53 proto udp
ufw enable
ufw status verbose

# Confirm 53 is not public:
ss -tulpn | grep ':53'

Di-filter, di-allowlist le di-client

Simolola ka DNS filter ya default ya AdGuard le lenaane le le lengwe la malware. Fa saete e itshwara sentle, tlhola log ya dipotso, mme o tsenye molao o o kgethegileng wa allowlist go na le go tima go thibela gotlhe. Dirisa maina a di-client (ka IP kgotsa ka ClientID mo URL ya DoH) gore o kgone go dirisa lenaane le le thata mo TV ya botlhale le le le bofefo mo laptop ya tiro. Tshuba safe search fela fa o e batla tota — e gakgamatsa batho ba ba sa kang ba kopa dipholo tsa Google tse di kwadilweng sesha.

• Log ya dipotso: fitlhelela domain e e thibetsweng, mme o e whitelist fa e le false positive
• Ditlhophiso tsa client: di-blocklist tse di farologaneng ka sedirisiwa
• Di-client tse di sa letlelelwang: thibela di-range tse o sa di tshwareng
• Moedi wa lebelo: o tshube fa o ka senola badirisi ba ba fetang ba ba se kae

Go rarabolola mathata

Fa VPS ka boyona e sa kgone apt update, o senyeditse DNS ya selegae fa o ne o golola port 53 — baya resolver e e sa fetogeng mo resolved.conf jaaka go bontshitswe fa godimo. Fa disedirisiwa 'di na le internet' mme di-ad di santse di laela, di feta DNS ya gago (di-resolver tse di kwadilweng mo khoutu, DoH mo browser, kgotsa app e e dirisang DNS ya yone). Fa dashboard e le lolea, o leba instance e e fosagetseng kgotsa o santse o otla port 3000 morago ga gore wizard e sutisitse UI.

• apt e a palelwa: tlhola /etc/resolv.conf le systemd-resolved
• Port 53 e a dirisiwa: ss -tulpn, tima stub listener
• Diphoso tsa setifikeiti sa DoH: hostname e tshwanetse go tshwana le SAN ya setifikeiti
• Di-ad di santse di bonala: DoH ya browser kwa mofani yo mongwe e feta OS
• RAM e kwa godimo: log ya dipotso + di-filter tse dintsi thata — kgaola lenaane le khutshafatsa nako ya go nna ga di-log

Lenaane la tshireletso

Web UI ke panel ya admin. Password e e kgethegileng, HTTPS fela, mme o se ka wa gatisa URL. Nna o ntšhwafaditse AdGuard Home; script ya go tsenya le UI ka bobedi di naya tsela ya ntšhwafatso. Kgaola 443 fa ke disedirisiwa tsa gago fela tse di tshwanetseng go dirisa DoH — HTTP basic auth mo tseleng ya DoH kgotsa pono ya WireGuard fela e sireletsegile go feta resolver e e bulegileng e e tumileng.

• Ga go na 53/udp e e bulegileng
• HTTPS mo dashboard
• Password e e nonofileng ya admin, e e bolokilweng mo password manager
• Rata WireGuard + DNS ya mo teng bakeng sa disedirisiwa tsa lelapa
• Boloka AdGuardHome.yaml kwa ntle ga server

Dikeletso

• Boloka /opt/AdGuardHome/AdGuardHome.yaml pele ga ntšhwafatso nngwe le nngwe
• Dirisa subdomain e e kgethegileng; o se ka wa e abelana le CMS e e sa amaneng
• Fa o setse o tsamaisa Caddy, letla Caddy e tshware 443 mme o nne le AdGuard Home mo localhost
• Kwala URL ya DoH bakeng sa disedirisiwa tsa gago — o tla e lebala
• E kopanye le dikaelo tsa go nonotsha SSH le firewall gore VPS e se ka ya nna 'e e sireletsegileng ka DNS' fela

AdGuard Home mo VPS e motlhofo: golola port 53 mo selegae, tsamaisa installer, wetsa wizard ka password e e nonofileng ya admin, baya UI mo HTTPS, tshuba DoH/DoT, mme o nne le DNS ya kgale kwa ntle ga internet e e bulegileng. Baya disedirisiwa kwa ntlheng ya gago e e sireleditsweng kgotsa kwa IP ya VPN, simolola ka setlhopha se sennye sa di-filter, mme o dirise log ya dipotso fa sengwe se senyega. Seo ke resolver ya sephiri e o e laolang tota — e seng DNS e e bulegileng e e bulegetsweng setšhaba e e tla tsenyang VPS ya gago mo di-database tsa tiriso e e sa siamang.