How to Self-Host AdGuard Home on Proxmox LXC — DNS Filtering Guide 2026

AdGuard Home turns a single Proxmox LXC container into a network-wide DNS filtering server — every device on your LAN gets ad blocking and tracker protection without installing anything on individual phones, laptops, or smart TVs. It's one of the most immediately useful services you can add to a homelab, and on Proxmox it runs in a lightweight unprivileged container with almost no ongoing maintenance.

This guide covers the full setup: creating the LXC, installing AdGuard Home, pointing your router at it as the primary DNS resolver, and enabling DNS-over-HTTPS so queries stay encrypted. If you want a broader overview of LXC container management before diving in, start with the Proxmox LXC complete self-hosting guide.

AdGuard Home vs Pi-hole: Which Should You Run in 2026?

Both Pi-hole and AdGuard Home block ads at the DNS level, but they have meaningfully different feature sets. Pi-hole has been around since 2014 and has a large community with an extensive blocklist ecosystem. AdGuard Home, per its official documentation, adds built-in DNS-over-HTTPS, DNS-over-TLS, and DNSCrypt support without any additional software — in Pi-hole you'd need to install a separate dnscrypt-proxy to get the same functionality.

AdGuard Home also ships with parental control enforcement and safe-browsing protection built into the same UI, and its DNS rewrite rules (custom DNS overrides for internal hostnames) are simpler to configure through the web interface. For a homelab running Proxmox LXC containers, AdGuard Home is the more self-contained choice: one container, one statically-linked Go binary, no PHP or lighttpd dependency chain to maintain.

The main case for Pi-hole is the larger community and more third-party integrations — if you're already running it on a Raspberry Pi 5 8GB (~$80) and it's working well, there's no compelling reason to migrate. But for a fresh install in 2026 on Proxmox, AdGuard Home is my recommendation. It's a single binary with a minimal resource footprint per AdGuard's own benchmarks, and the Go runtime adds no meaningful overhead at household DNS query volumes.

What You Need Before Starting

The prerequisites for this setup are minimal compared to most self-hosted services:

• A running Proxmox VE 7.x or 8.x node
• An Ubuntu 22.04 or Debian 12 LXC template downloaded in your local storage
• Admin access to your home router to change its DNS server settings
• A static IP assigned to the LXC — AdGuard Home must be reachable at a consistent address

Hardware requirements are genuinely minimal. Per AdGuard's official documentation, AdGuard Home handles tens of thousands of DNS queries per second on a single CPU core. Even a modest Proxmox node — say, a repurposed mini PC like the GMKtec G3 PRO Mini PC (~$199) — will run AdGuard Home alongside a full stack of other services without any measurable impact. My Beelink GTi13 Ultra (i9-13900HK, 64GB) runs a full rack of LXC containers including this kind of lightweight service, and DNS is genuinely the last thing that ever creates CPU pressure.

One networking consideration: if your homelab is on a cheap 100Mbps switch, DNS latency from the LXC to upstream resolvers won't be a bottleneck, but upgrading to a TP-Link 2.5G 8-Port Switch (~$49) future-proofs your LAN for larger file transfers between Proxmox nodes — worth considering if you're also running NAS services or frequent VM migrations.

Creating the LXC Container on Proxmox

Open the Proxmox web interface and click Create CT. Name it something recognizable like adguard or dns. Under Memory, 256MB is sufficient for a household-scale deployment, though 512MB gives you more headroom for the query log and long-term statistics features. One vCPU is plenty.

The network configuration is the important part here. Assign the container a static IP at a predictable, low-numbered address in your LAN subnet — something like 192.168.1.2 — because you'll be pointing your entire network at this IP for DNS. If the container ever gets a different lease, DNS breaks for every device on your network. In the Proxmox LXC network settings, set the IPv4 address to your chosen static IP and leave the gateway pointing at your router.

AdGuard Home doesn't require any special LXC privileges. An unprivileged container with default Proxmox settings works fine — no nesting, no privileged mode, no special apparmor exceptions. After the container starts, open its console from the Proxmox UI or SSH into it to proceed with installation.

Installing AdGuard Home

AdGuard provides an official install script that downloads the correct binary for your architecture and configures a systemd service. Run it as root inside the LXC:

apt update && apt install -y curl
curl -s -S -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -v

The script installs the binary to /opt/AdGuardHome/ and creates a systemd service named AdGuardHome. Verify it's running:

systemctl status AdGuardHome

If you prefer a pinned manual install — useful when you want a specific version for reproducibility — download the tarball directly from the AdGuard Home GitHub releases page:

VERSION="v0.107.56"   # Check GitHub releases for latest
ARCH="linux_amd64"    # Use linux_arm64 for ARM-based hosts
curl -L "https://github.com/AdguardTeam/AdGuardHome/releases/download/${VERSION}/AdGuardHome_${ARCH}.tar.gz" -o agh.tar.gz
tar -xzf agh.tar.gz
cd AdGuardHome
./AdGuardHome -s install

Either method ends with AdGuard Home running as a systemd service and listening on port 3000 for the initial setup wizard. The service is configured to start automatically on boot, so there's nothing extra to configure for persistence.

Running the Initial Setup Wizard

Navigate to http://<your-lxc-ip>:3000 in a browser. The setup wizard runs through five steps. The key decisions are on the network interfaces screen:

• Admin Web Interface port: set to 80 (or 8080 if you plan to put a reverse proxy in front) — the default 3000 also works if you only access this from your LAN
• DNS Server: set the listen address to your LXC's static IP on port 53 (e.g. 192.168.1.2:53) rather than 0.0.0.0:53 — binding to the specific interface is cleaner and avoids ambiguity on multi-homed systems

Create an admin username and strong password on the next screen. After the wizard completes, AdGuard Home restarts and opens the dashboard. The default upstream DNS resolvers are Cloudflare (1.1.1.1) and Google (8.8.8.8). These work for basic use, but in the next section you'll tune them for better privacy. The main dashboard gives you a live feed of queries, blocked requests, and blocked request percentage — this is what confirms everything is working once you point your router at AdGuard Home.

Pointing Your Router at AdGuard Home

The fastest way to deploy network-wide DNS filtering is to change your router's DNS server settings. Every router admin interface is different, but the setting is usually under LAN → DHCP Server → DNS Server. Set the primary DNS to your AdGuard Home LXC's static IP. Leave the secondary DNS blank — if you set a fallback like 1.1.1.1, some devices will bypass AdGuard Home entirely when it's temporarily unreachable, which defeats the purpose. Instead, keeping AdGuard Home highly available (which is easy given its lightweight footprint) is the right approach.

Devices pick up the new DNS when they renew their DHCP lease. To test immediately on a single machine, flush its DNS cache (ipconfig /flushdns on Windows, sudo dscacheutil -flushcache on macOS) or manually set the DNS to your AdGuard Home IP in that device's network settings. Confirm queries are flowing by watching the Query Log tab in the AdGuard Home dashboard — your device's requests should appear within seconds of any web browsing.

One edge case worth addressing: some smart TVs, Android TV boxes, and IoT devices have hardcoded DNS resolvers (often 8.8.8.8 or 1.1.1.1) that ignore your DHCP-provided DNS entirely. The fix is a firewall rule that intercepts all outbound UDP/TCP port 53 traffic and redirects it to AdGuard Home's IP. If you're running OPNsense on Proxmox — the OPNsense on Proxmox guide covers the full setup — this is a two-rule NAT redirect that takes about five minutes to configure.

Tuning Your Upstream DNS and Filter Lists

Before adding blocklists, consider changing the upstream DNS resolvers to something privacy-focused. In Settings → DNS settings → Upstream DNS servers, replace the defaults with options that don't log queries. Per their respective privacy policies, good choices include Cloudflare's privacy-first resolver (https://cloudflare-dns.com/dns-query for DoH) or Quad9 (https://dns.quad9.net/dns-query), which also blocks known malicious domains at the resolver level.

For blocklists, go to Filters → DNS blocklists → Add blocklist. AdGuard Home's built-in list is a solid starting point, but adding a few community-maintained sources improves coverage meaningfully:

• AdGuard DNS filter (built-in) — general ad and tracker domains
• Steven Black's Hosts — a consolidated list merging multiple sources, updated regularly at https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
• OISD Big — one of the most comprehensive maintained blocklists, available at https://big.oisd.nl

Start with two or three well-maintained lists rather than stacking dozens of them. Overly aggressive blocklists cause false positives that break legitimate sites, and tracking down why a specific site stopped loading is tedious. According to community benchmarks posted on the AdGuard Home GitHub discussions, a household with normal browsing patterns typically sees 15–30% of DNS queries blocked — a useful baseline to compare against once your lists are active. For false positives, Filters → Custom filtering rules lets you whitelist a domain instantly with @@||example.com^ syntax.

Setting Up HTTPS for the Dashboard and DNS-over-HTTPS

For a LAN-only setup, plain HTTP for the dashboard and unencrypted DNS on port 53 is acceptable — traffic never leaves your local network. But if you access your homelab remotely via Headscale or Tailscale, or if you want to use AdGuard Home as your DNS-over-HTTPS resolver on mobile devices, enabling TLS is the next step.

AdGuard Home supports Let's Encrypt certificates natively under Settings → Encryption settings. You'll need a domain pointing at the LXC's IP (or your public IP with port forwarding). Enter the domain name and paste the certificate and private key. If you're using Traefik as your reverse proxy — covered in the Traefik on Proxmox guide — a cleaner approach is to front the AdGuard Home web UI through Traefik with a Let's Encrypt certificate, while leaving port 53 and 853 handled directly by AdGuard Home.

Once HTTPS is configured, clients can use AdGuard Home as a DoH resolver at https://your-domain/dns-query. iOS 14+ and Android 9+ support Private DNS (DoH/DoT) natively in their system network settings per Apple and Google documentation, respectively. This means every query from your phone is encrypted and filtered through AdGuard Home even when you're on a public Wi-Fi network — useful if you also have a Tailscale tunnel routing traffic home.

Per-Client Rules and Internal DNS Rewrites

Two of AdGuard Home's most useful features are per-client filtering profiles and DNS rewrites. Under Settings → Client settings, add entries for specific devices by MAC address or IP. You can assign each client a different protection profile — for example, enabling the Parental Controls filter on a child's tablet while keeping a development machine on a permissive list that allows analytics and error reporting domains that would otherwise be blocked.

DNS rewrites, under Filters → DNS rewrites, let you override resolution for specific hostnames across your entire LAN. This is the cleanest way to access internal services by name: add a rewrite like jellyfin.home → 192.168.1.10 and every device on your network resolves that hostname without needing individual hosts file entries or a full split-horizon DNS setup. This also eliminates hairpin NAT issues where services behind a reverse proxy behave differently from inside vs outside the LAN. Combined with Traefik handling HTTPS termination, you end up with consistent, named access to every self-hosted service.

Keeping AdGuard Home Updated and Backed Up

AdGuard Home includes a self-update mechanism built directly into the dashboard: go to Settings → Update and click Check for updates. When a new version is available, AdGuard Home downloads the binary, replaces itself, and restarts the service — no SSH session required. Per AdGuard's release changelog on GitHub, the project ships updates roughly every four to six weeks, primarily with blocklist rule improvements and minor feature additions.

Before any update, it's worth backing up the configuration file at /opt/AdGuardHome/AdGuardHome.yaml. This file contains all your custom rules, rewrites, and upstream settings — it's everything you'd need to restore to a clean install. A simple daily cron job copying this file to a safe location (or to a MinIO bucket if you're running object storage) keeps a config history without extra tooling. If you've already set up the Proxmox Backup Server, adding the AdGuard Home LXC to its backup schedule is the most straightforward option — PBS snapshots the entire container state including the config file.

AdGuard Home also exposes a REST API documented at /api on your running instance, which makes it straightforward to pull query stats and block rates into a monitoring dashboard. Combined with the Grafana + Prometheus setup, you can build a dashboard that shows DNS block rates alongside all your other homelab service metrics in one place — the community AdGuard Home Prometheus exporter on GitHub is a drop-in integration for this.