AdGuard Home on Raspberry Pi: The Complete 2026 Setup Guide (Network-Wide Ad Blocker)

If you’re sick of ads, trackers, and malware on every device in your house — not just your browser — you need AdGuard Home running on a Raspberry Pi. It blocks ads at the DNS level, which means phones, smart TVs, laptops, and even your Wi-Fi fridge get cleaned up automatically. No browser extensions, no app-by-app setup. One small box, whole-network protection.

This guide walks through the complete setup on a Raspberry Pi 5 (or Pi 4, or even a Pi Zero 2 W if you’re on a budget) in under 30 minutes. By the end, every device on your network will see zero ads.

Why AdGuard Home Beats Pi-hole in 2026

Pi-hole was the king of DNS-based ad blocking for years. AdGuard Home is now objectively better for most people, and here’s why:

Built-in DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) — Pi-hole needs an extra service (cloudflared or stubby) to do this. AdGuard does it natively.
Per-client rules — Block TikTok only on the kids’ iPad, allow it on your own phone. One dashboard, multiple profiles.
Cleaner UI — AdGuard’s web interface is more modern and mobile-friendly.
Parental controls — Built-in safe search and adult content blocking out of the box.
Single binary — No dependency mess. Install, run, done.

The only real reason to stick with Pi-hole is if you already have a working setup you love. For a fresh install in 2026, AdGuard Home wins.

What You’ll Need

Minimal hardware checklist:

Raspberry Pi 5 (8GB) — overkill for DNS, but future-proof and you can run Home Assistant, Pi-hole, Uptime Kuma, and Docker containers alongside it. A Pi 4 or Pi Zero 2 W works too.
Active cooling — the Pi 5 runs warm under sustained load. The official active cooler keeps it quiet and stable.
Quality microSD card (32 GB or bigger) — a SanDisk Extreme or Samsung Pro Endurance card. Don’t cheap out here — bad cards corrupt under 24/7 load.
Ethernet cable — use wired, not Wi-Fi. DNS latency matters and Wi-Fi adds jitter.
Your router’s admin password — you’ll need it to change the DNS settings at the end.

Step 1: Flash Raspberry Pi OS Lite

Download the Raspberry Pi Imager from raspberrypi.com/software. Install it, plug in your microSD card, and launch Imager.

Click Choose OS → Raspberry Pi OS (other) → Raspberry Pi OS Lite (64-bit). You don’t need a desktop — this is a headless server.
Click the gear icon to set advanced options:
- Hostname: adguard
- Enable SSH with password or key authentication
- Set a username (e.g. pi) and strong password
- Configure Wi-Fi if needed (but prefer ethernet)
- Set locale and timezone
Click Write. Wait 3–5 minutes.
Insert the card into the Pi, plug in ethernet, connect power.

Step 2: SSH In and Set a Static IP

Find the Pi’s IP from your router admin page (look for adguard.local or the hostname you set). Then SSH in from your computer:

ssh [email protected]
# or use the IP address
ssh [email protected]

Update the system first:

sudo apt update && sudo apt upgrade -y

Set a static IP. This is critical — if the Pi’s IP changes, your entire network loses DNS and the internet breaks. You have two options:

Recommended: Reserve the IP in your router’s DHCP settings (find the MAC address in the router, add a reservation). This is the cleanest approach because the Pi still uses DHCP but always gets the same address.
Alternative: Set the static IP on the Pi itself by editing /etc/dhcpcd.conf.

Step 3: Install AdGuard Home

AdGuard provides a one-line installer that handles everything — download, install as a systemd service, and enable auto-start on boot:

curl -s -S -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -v

The script prints progress and usually finishes in about 30 seconds. When done, AdGuard Home is running and listening on port 3000 for the initial setup wizard.

Step 4: Run the Setup Wizard

Open a browser on any device on your network and go to:

http://adguard.local:3000

Or use the Pi’s IP: http://192.168.1.50:3000. You’ll see the AdGuard setup wizard. Walk through it:

Admin web interface port: change from 3000 to 80. (Port 3000 is for setup only.)
DNS listen interface: keep it on the ethernet interface, port 53.
Admin username and password: set something strong. This controls the whole dashboard.
Click Next → Open Dashboard.

AdGuard Home is now running. The dashboard is at http://adguard.local/ (no port needed anymore).

Step 5: Point Your Router to the Pi

This is the step that actually activates network-wide ad blocking. Log into your router’s admin panel (usually http://192.168.1.1 or http://192.168.0.1) and find the DNS settings — they’re usually under WAN, Internet, or DHCP Server.

Set the primary DNS to your Pi’s IP (e.g. 192.168.1.50). Leave the secondary blank or set it to the Pi too — do not set a public DNS as secondary, because devices will fall through to it and bypass AdGuard.

Save the settings, then either reboot the router or wait a few minutes. All your devices will renew their DHCP lease, pick up the new DNS, and start routing through AdGuard.

Test it: visit a test site like test.adblock.turtlecute.org. If you see no ads, it’s working.

Step 6: Configure Filter Lists

The default filter is decent but you can do much better. In the AdGuard dashboard, go to Filters → DNS blocklists → Add blocklist.

The essential filter lineup I recommend for 2026:

AdGuard DNS filter (on by default)
AdGuard Tracking Protection filter
OISD Full — the gold standard. Blocks ads, tracking, and most malware with almost zero false positives. URL: https://big.oisd.nl/
StevenBlack’s Unified Hosts — combines Steven Black’s list with many others. URL: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
HaGeZi’s Pro DNS blocklist — aggressive but reliable. URL: https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/pro.txt

Don’t add more than 5–6 lists. More is not better — you’ll just get false positives (legit sites broken) without blocking anything new.

Step 7: Enable Encrypted DNS Upstream

By default, AdGuard forwards queries to its own public DNS in plain text. For privacy, switch to DNS-over-HTTPS. Go to Settings → DNS settings → Upstream DNS servers.

Replace the default upstreams with:

https://dns.quad9.net/dns-query
https://cloudflare-dns.com/dns-query
https://dns.google/dns-query

Set Load balancing mode to distribute queries across all three. Click Test upstreams — all three should respond in under 30ms. Then Apply.

Your DNS is now encrypted end-to-end from the Pi to the resolver. Your ISP can no longer see which sites you visit.

Step 8: Set Up Safe Search and Parental Controls (Optional)

If you have kids on the network, AdGuard Home makes parental controls trivial:

Go to Settings → General settings.
Enable Use AdGuard browsing security web service (blocks phishing and malware).
Enable Block services and check the categories or specific services you want blocked (TikTok, adult sites, gambling, etc.).
Under Safe search, toggle on Enforce safe search. This forces SafeSearch on Google, YouTube, DuckDuckGo, and Bing for all devices using the Pi for DNS.

For per-device rules (e.g. block TikTok on one iPad but not another), go to Settings → Client settings and add the device by MAC address. Each client can have its own filter lists and blocklists.

Step 9: Monitor and Maintain

Check the AdGuard dashboard after 24 hours. You should see:

Queries blocked: typically 10–40% of all DNS queries on a busy home network.
Top blocked domains: usually Google Ads, Facebook tracking, Doubleclick, and app telemetry (Windows, macOS, Samsung TV, etc.).
Top clients: see which device is making the most DNS queries. Smart TVs and IoT gadgets usually top the list — and now you know exactly what they’re phoning home about.

AdGuard Home updates itself via the one-line script: run AdGuardHome -s uninstall then re-run the install script. Or just leave it — AdGuard is very stable and you don’t need to update often.

Troubleshooting Common Problems

“Some sites don’t load at all.” A filter list is blocking a legit domain. Go to Query log in the dashboard, find the blocked domain, and click Unblock. It gets added to the custom allow list.

“Devices still show ads in apps.” Some apps use hardcoded DNS (Netflix, some Google apps) or their own DoH resolver that bypasses your network DNS. Nothing you can do at the DNS level. This is why a full ad-blocker VPN at the app level exists.

“Slow internet after setup.” Your upstream DNS is the problem. Test different upstreams in DNS settings — Quad9, Cloudflare, and Google are all fast. Avoid OpenDNS or ISP DNS.

“Router won’t let me change primary DNS.” Cheap ISP routers sometimes lock DNS. Workarounds: (1) buy a decent router like a UniFi Dream Machine, (2) set static DNS on each device individually, or (3) set up DHCP on the Pi and disable DHCP on the router.

Going Further: Docker, DHCP, and Integration

Once AdGuard is solid, consider these next steps:

Run it in Docker — easier backups, easier upgrades, easier to migrate. Pull adguard/adguardhome:latest and map ports 53 (UDP), 80, and 3000.
Run AdGuard as the DHCP server — disable DHCP on your router, enable it on AdGuard. You get device names in the dashboard instead of IPs, and every device is guaranteed to use AdGuard.
Pair with Home Assistant — AdGuard has a native HA integration that lets you toggle filtering, monitor blocked queries, and create automations (“turn off kids’ Wi-Fi at 9pm”).
Back up the config — AdGuard stores everything in /opt/AdGuardHome/AdGuardHome.yaml. Copy it to your NAS weekly. If the SD card dies, you can restore your entire setup in minutes.

Final Thoughts

AdGuard Home on a Raspberry Pi is one of the highest-impact homelab projects you can do in 2026. It costs under $100, takes 30 minutes to set up, and silently blocks 30%+ of the internet garbage coming at every device in your house. It improves privacy, reduces data usage, speeds up page loads, and — most importantly — it removes ads from apps and smart devices where browser extensions can’t reach.

The Pi handles millions of DNS queries without breaking a sweat. You can use the same Pi to run Uptime Kuma, Pi-hole (yes, alongside AdGuard if you want), or a dozen Docker containers. It’s the best $80 you can spend on your home network this year.

Once you’re running AdGuard, the natural next step is locking down the rest of your homelab — firewall rules, VLAN segmentation, and a proper backup strategy. Those are the projects that turn a collection of Raspberry Pis into a real homelab.