111Adguardhome - amagerard/Powerdns GitHub Wiki

Home

RedHat10/Powerdns

1- Network 2- Pdns 3- Mariadb 4- PowerAdmin 5- PdnsRecursor 6- Selinux
7- GnomeShell 8-Synoptic 09-ManageDns 10-Troubleshoots 11-Adguardhome

11. Adguardhome.

Install Adguard Home if you don't like ads or prohibited websites.

11.1 Install.

Create an AdGuard user.
groupadd adguard
useradd -g adguard -d /opt/AdGuardHome adguard

Log in to adguard.
su - adguard

Download the latest version of AdGuardHome.
wget -c https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.71/AdGuardHome_linux_amd64.tar.gz

Decompress AdGuardHome.
tar xvzf AdGuardHome_linux_amd64.tar.gz -C /opt

Add and edit a personal script.
This is to prevent AdGuardHome from launching as root.
vi run.sh

#!/bin/sh  
  
/usr/sbin/setcap 'CAP_NET_BIND_SERVICE=+eip CAP_NET_RAW=+eip' /opt/AdGuardHome/AdGuardHome  
#su - adguard  
/opt/AdGuardHome/AdGuardHome  "-s" "run"

chmod +x run.sh
Exit the AdGuard user.
exit

Add and edit the script to launch AdGuardHome.

vi /etc/systemd/system/AdGuardHome.service

[Unit]  
Description=AdGuard Home: Network-level blocker  
ConditionFileIsExecutable=/opt/AdGuardHome/AdGuardHome  
  
After=syslog.target network-online.target  
  
[Service]  
StartLimitInterval=5  
StartLimitBurst=10  
  
ExecStart=/opt/AdGuardHome/run.sh  
  
WorkingDirectory=/opt/AdGuardHome  
  
User=adguard  
Group=adguard  
  
StandardOutput=journal  
StandardError=journal  
  
Restart=always  
  
RestartSec=10  
EnvironmentFile=-/etc/sysconfig/AdGuardHome  
  
  
[Install]  
WantedBy=multi-user.target

Do not start the AdGuardHome service.

The first installation of AdGuardHome is in root mode.
But first you need to open the firewall.
ufw allow in proto tcp from any to any port 3000:3001

And also redirect DNS queries to AdGuardHome.
That's the role of pdns-redirector.

DNS requests that are not for the ol26modk.com domain are forwarded to 1.1.1.1.
From now on, DNS requests not belonging to the ol26modk.com domain will be forwarded to port 5345.
Port 5345 is the port AdGuard Home uses to listen for DNS requests.
You will need to change the port to 5345 in the AdGuard Home configuration.

vi /etc/pdns-recursor/recursor.conf

# forward-zones-recurse Zones .  
# By default, anything not listed above is returned as another DNS server.  
  forward_zones_recurse:  
  - zone: .  
    recurse: true  
    forwarders:  
    - 127.0.0.1:5345

systemctl restart pdns-recursor

Run these two command lines as root.

/usr/sbin/setcap 'CAP_NET_BIND_SERVICE=+eip CAP_NET_RAW=+eip' /opt/AdGuardHome/AdGuardHome

/opt/AdGuardHome/AdGuardHome "-s" "run"

Leave the adguadhome process and find another computer for the setup.
In this example, AdGuardHome is located on the server 192.168.90.41.

From another computer.
http://192.168.90.41:3000
You must change :

  • internet for another port as : 3001
  • DNS listen port as : 5345
  • give a username and password

more /opt/AdGuardHome/AdGuardHome.yaml

http:  
  pprof:  
    port: 6060  
    enabled: false  
  doh:  
    routes:  
      - GET /dns-query  
      - POST /dns-query  
      - GET /dns-query/{ClientID}  
      - POST /dns-query/{ClientID}  
    insecure_enabled: false  
  address: 0.0.0.0:3001  
  session_ttl: 30d  
users:  
  - name: teacher  
    password: $2a$10$PvU/TllJfI5uNfKph/E2lu1agvqOrVvFAhEQ03JDRuzcz4EGl5w4O  
auth_attempts: 5  
block_auth_min: 15  
http_proxy: ""  
language: ""  
theme: auto  
dns:  
  bind_hosts:  
    - 0.0.0.0  
  port: 5345

Return to the server for stop AdGuardHome.
CTRL + c for exit.

chown -R adguard:adguard /opt/AdGuardHome

Start the AdGuardHome service.
systemctl enable --now AdGuardHome.service

Open AdGuardHome.
http://192.168.90.41:3001

11.2 Open AdguardHome to https.

Port 443 is already in use by poweradmin.
This will be port 448 for HTTPS.

You must have:

  • CA authority (already exists)
  • srv certificates (already exists).

Go to 6.2.2 Generate ECC CA Authority .
Go to 6.3.2 Generate ECC srv1 certificates .

Give permission to adguard.
setfacl -m u:adguard:rx /etc/pki/tls/certs/CA-ecc.crt
setfacl -m u:adguard:rx /etc/pki/tls/certs/srv1-ecc.crt

setfacl -m u:adguard:rx /etc/pki/tls/private/CA-ecc.key
setfacl -m u:adguard:rx /etc/pki/tls/private/srv1-ec.key

Log in to adguard.
su - adguard
vi AdGuardHome.yaml

tls:  
  enabled: true  
  server_name: ""  
  force_https: false  
  port_https: 448  
  port_dns_over_tls: 853  
  port_dns_over_quic: 853  
  port_dnscrypt: 0  
  dnscrypt_config_file: ""  
  allow_unencrypted_doh: false  
  certificate_chain: ""  
  private_key: ""  
  certificate_path: /etc/pki/tls/certs/srv1-ecc.crt  
  private_key_path: /etc/pki/tls/private/srv1-ecc.key  
  strict_sni_check: false

Exit the adguard user.
exit

Open port 448 in the firewall only to those you trust.

Add ADGUARD app.
vi /etc/ufw/applications.d/ufw-custom

[ADGUARD]  
title=adguard  
description=adguard  
ports=448/tcp

Add the rule.
ufw allow in from 192.168.80.0/29 to any app adguard

Close port 3000:3001.
ufw status numbered

[12] 3000:3001/tcp              ALLOW IN    Anywhere

ufw delete 12

systemctl restart AdGuardHome

Open AdguardHome to https:
https:192.168.90.41:448

11.3 Update.

Log in to adguard.
su - adguard

Create update folder.
mkdir update

Download the latest version of AdGuardHome.

cd update
wget -c https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.78/AdGuardHome_linux_amd64.tar.gz

Exit adguard.

exit

Return to root.
Stop service AdGuardHome.
systemctl stop AdGuardHome

Log in to adguard.
su - adguard

Decompress AdGuardHome.
cd update
tar xvzf AdGuardHome_linux_amd64.tar.gz

Move all files.
cd ./AdGuardHome
mv * ../..

Exit adguard.
exit

Return to root.
Run AdGuardHome manually.
/opt/AdGuardHome/run.sh
Ctrl Cto stop.

Change the owner of AdGuardHome.yaml.
chown adguard:adguard /opt/AdGuardHome/AdGuardHome.yaml

Restart the AdGuardHome service.
systemctl restart AdGuardHome

Check the status.
systemctl status AdGuardHome

Check the listening port
netstat -plnt | grep AdGuardHome

tcp6       0      0 :::448       :::*       LISTEN      3041/AdGuardHome