- Implementation of DoH and DoT protocols through SSL certificate management and the opening of specific ports.
- Privacy optimization through the use of encrypted upstream servers and the configuration of trusted reverse proxies.
- Deployment of native configuration profiles to integrate DNS filtering on Android, iOS, and Windows devices.
How to configure DNS over HTTPS and DNS over TLS in AdGuard Home? If you're tired of your internet provider knowing your every move online or want to control your home's advertising from anywhere, setting up your own encrypted DNS server is the ultimate solution. AdGuard Home It has become the star tool for those seeking privacy and visual cleanliness, allowing us to manage network traffic without having to install annoying extensions on each device.
The real magic happens when we stop using traditional plaintext DNS and jump to protocols like DNS-over-HTTPS (DoH) y DNS-over-TLS (DoT)It's not just about blocking ads, but about building an encryption wall that prevents third parties from snooping on your searches, making your browsing much safer and more private, whether you're on your living room sofa or connected to a public Wi-Fi network. To learn more, you can... How to encrypt your DNS using DNS over HTTPS.
Prerequisites for starting assembly
For all of this to work, ideally you need a server that has a dedicated public IP addressIf you don't have one at home, there are very inexpensive cloud-based options like DigitalOcean, Vultr, or Linode. If you prefer something more local, you can use a NAS or even advanced routers that support it. Docker and Docker Compose, since it is the cleanest way to install the service without messing up the operating system.
A critical point is port 53. On Ubuntu or Debian systems, the service systemd-resolved This port is often monopolized, so you'll need to disable it for AdGuard Home to take control of DNS traffic. To do this, simply stop the service and disable it via the terminal before launching the container.
Obtaining SSL certificates: The heart of encryption
Without a valid SSL certificate, encryption simply won't work. You have two options: pay a certificate authority or go for the free and efficient option with Let's EncryptTo automate this, the tool Certbot It is the most widespread method, allowing you to obtain the necessary files through a DNS challenge, which is the simplest way to avoid complications.
Another very powerful alternative is LEGOwhich is especially useful for those looking to automate certificate renewal. Regardless of the tool, the goal is to obtain two fundamental files: the fullchain.pem (the certificate) and the privkey.pem (the private key), which are what AdGuard Home will ask for to validate the encrypted connection.
Step-by-step configuration of DoH and DoT
Once you have AdGuard Home up and running, log into the control panel and navigate to the section for Encryption settingsThis is where the action happens. You must activate encryption and assign a server name, which will be the subdomain (for example, dns.your-domain.com) that your devices will connect to.
- Certificates: Copy the contents of the fullchain.pem file into the certificate field and the private key into the corresponding field.
- Ports: For HTTPS (DoH), the standard port is 443, although you can change it if it's already in use. For TLS (DoT), you must open and redirect port 853.
- Validation: Don't forget to save the changes and verify that the system indicates the configuration is correct.
Integration with Reverse Proxy and Nginx
If you want to access the AdGuard Home web interface through a nice subdomain using Nginx Proxy ManagerYou need to be careful with IPs. By default, AdGuard Home may reject DoH requests coming from a proxy if it doesn't trust it. To fix this, you need to edit the file AdGuardHome.yaml and add your proxy's IP address to the list of trusted_proxies.
In the Nginx configuration, it is vital to include the headers X-Real-IP o X-Forwarded-ForThis allows AdGuard Home to see not only the proxy's IP address, but also the client's real IP address which makes the query, allowing you to apply individual filtering rules per device and not treat your entire network as a single user.
Using encrypted DNS like Upstream
Not only can you provide encrypted DNS to your devices, but AdGuard Home can also query other servers using encryption. Instead of using plain IPs, you can configure upstream servers using TLS or HTTPS syntax. For example, you can Use Google DNS through tls://dns.google or use tls://1.1.1.1 for Cloudflare.
This creates a secure tunnel from your device to AdGuard Home and then another tunnel from AdGuard Home to the final provider, ensuring that no intermediary can read the content of your DNS requests all the way through.
Configuration on end devices
The advantage of DoH and DoT is that many operating systems already support them natively. Android 9 or higherYou can go to your network settings and configure the "Private DNS" simply by entering your domain. iOS and macOSThings are simpler if you use the AdGuard Home "Setup Guide", or if you prefer to know How to change DNS on iPhone manually.
For Windows, the configuration of DNS-over-HTTPS This is done directly in the privacy and security settings by entering your server URL. If you need help, you can consult How to change DNS in Windows 11This way, you no longer depend on being connected to your local network or using a VPN to continue enjoying ad blocking and privacy.
Advanced filtering and parental controls
Once the encrypted tunnel is ready, you can unleash the full potential of the block listsWe recommend starting with AdGuard's native list and adding OISD or Steven Black for complete malware and telemetry protection. If any website stops loading, you can use the custom filtering rules to add quick exceptions.
For those with families, the option of blocked services It's amazing. It allows you to disable dating apps, games, or social networks for specific clients with a single click, turning your server into a powerful system of parental controls centralized and easy to manage.
Having an optimized AdGuard Home server with encryption protocols transforms home browsing into a private and distraction-free experience, eliminating reliance on ISP DNS and protecting traffic from eavesdropping. By combining SSL certificates, reverse proxy management, and native mobile device configuration, we ensure that content filtering and data protection are available anywhere in the world without sacrificing response speed.
Passionate about technology since he was little. I love being up to date in the sector and, above all, communicating it. That is why I have been dedicated to communication on technology and video game websites for many years. You can find me writing about Android, Windows, MacOS, iOS, Nintendo or any other related topic that comes to mind.