AdGuard Home

Sign in to the AWS Management Console, open the EC2 service and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for AdGuard Home. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of t3.medium or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, then create or select a security group. The group must allow inbound port 22 from your management network, inbound port 80 from where you will reach the admin console, and inbound port 53 on both UDP and TCP from the networks you want to filter.

Keep the root volume at the default size or larger. The image adds a separate data volume for AdGuard Home's state automatically.

Select Launch instance. First-boot initialisation takes under a minute after the instance state becomes Running and the status checks pass.

Run the following command to launch an instance from the SecureAnyCloud AdGuard Home Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens port 22, port 80 and port 53 (UDP and TCP) as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.medium \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":20,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=adguardhome-01}]'

On success, the command prints a JSON document. Note the instance ID. When the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect over SSH with the key pair you selected and the public IP address from Step 2. The SSH login user depends on the operating system of the AMI variant you launched.

AMI variant: AdGuard Home 0.107.77 on Ubuntu 24.04. SSH login user: ubuntu.

The first-boot service runs before the SSH daemon becomes ready, so the credentials file is in place when you first log in. Read it with:

ssh <login-user>@<public-ip>
sudo cat /root/adguardhome-credentials.txt

The plain-text file contains the admin console URL, the username admin and the per-instance admin password. From the same SSH session, confirm that the deployment is healthy. nginx serves an open health endpoint:

curl -fsS http://127.0.0.1/healthz

ok

An ok response confirms that nginx is fronting the admin console. Next, confirm that the two services that make up the stack are running:

systemctl is-active AdGuardHome nginx

active active

Confirm AdGuard Home is answering DNS on port 53 for both UDP and TCP:

ss -H -lntu 'sport = :53'

udp *:53 tcp *:53

Open a web browser and go to http://<public-ip>/. AdGuard Home shows its sign-in page, served behind nginx, and prompts for a username and password. Sign in as admin with the password from the credentials file.

Enter admin and the password from /root/adguardhome-credentials.txt, then select Sign in. The dashboard opens. It shows DNS query statistics, the number and percentage of requests blocked by your filters, your top clients and the top blocked domains.

AdGuard Home filters traffic only for devices that use it for DNS. Point your whole network, or an individual device, at the instance's IP address:

• Whole network: in your router's DHCP or DNS settings, set the primary DNS server to the instance's IP address. Every device that gets its network settings from the router then resolves through AdGuard Home.
• A single device: in the device's network settings, set the DNS server to the instance's IP address.

When traffic is flowing, verify filtering from the instance itself. A normal domain resolves to a real address:

dig @127.0.0.1 example.com +short

104.20.23.154 172.66.147.243

A known ad or tracker domain is blocked, returning 0.0.0.0 instead of a real address:

dig @127.0.0.1 adservice.google.com +short

0.0.0.0

Select Filters > DNS blocklists in the top navigation to control what AdGuard Home blocks. The image ships with the default AdGuard DNS filter enabled, with more than 150,000 rules for broad ad and tracker coverage.

Choose Add blocklist to subscribe to additional community filter lists by URL. Choose Check for updates to refresh the rule counts. To write your own allow and block rules for domains specific to your environment, open Filters > Custom filtering rules.

Select Query Log in the top navigation to watch DNS requests in real time. Each row shows the time, the requested domain, the response and the client that asked. Processed requests show their upstream response. Blocked requests, such as adservice.google.com, are marked as blocked by the filter that matched them, for example the AdGuard DNS filter.

Use the search box and the query type filter to narrow the log to a single client or domain. Select any request to allow or block that domain directly from the log.

Serve the admin console over HTTPS so that your session cannot be intercepted. The image ships with nginx, which certbot can configure automatically.

These commands assume that a DNS record points your fully qualified domain name at the instance's public IP address.

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d adguard.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example \
  --redirect

certbot obtains a certificate and rewrites the nginx server block to serve HTTPS and redirect HTTP. The certbot systemd timer renews the certificate automatically. This secures the admin console on ports 80 and 443. DNS filtering on port 53 is unaffected.

AdGuard Home keeps its configuration, query log, statistics and downloaded filter lists under /var/lib/adguardhome on the dedicated data volume. Because this is a separate EBS volume, you can take a coordinated EBS snapshot for point-in-time backups, or archive the tree to object storage:

sudo systemctl stop AdGuardHome
sudo tar czf <backup-dir>/adguardhome-$(date +%F).tgz -C /var/lib adguardhome
sudo systemctl start AdGuardHome

Ship the archive to an Amazon S3 bucket or another object store.

The admin password is stored as a hash in /var/lib/adguardhome/AdGuardHome.yaml. Change it from the web console under Settings, or edit that file and run sudo systemctl restart AdGuardHome. The services run under systemd. Check their state at any time:

systemctl is-active AdGuardHome nginx

active active

• For resilience, run a second instance in another Availability Zone and set it as the secondary DNS server on your router or devices.
• Grow the state store by extending the EBS data volume and running sudo resize2fs on /var/lib/adguardhome.
• Configure your upstream DNS servers, DNS-over-HTTPS or DNS-over-TLS, and cache settings under Settings > DNS settings.
• Pin the AdGuard Home version for a fleet by controlling which AMI version you launch.

The official AdGuard Home documentation is available at https://github.com/AdguardTeam/AdGuardHome/wiki.