DNS Filtering with AdGuard Home or Pi-hole - with or without OpenWrt

No more ads - and parental control. Those are two use cases for ad blockers and DNS Filters like AdGuard Home or Pi-hole (R). Privacy and protection of your data in the internet, blocking ads and the use of DNS White Lists or Black Lists. The main challenge for many people is the integration in the network, i.e. the redirection of DNS traffic to the Pi-hole or AdGuard Home machine. We will have a look into 4 options, using DHCP option 6, the DNS Forwarder option, iptables filter rules on port 53 as well as running AdGuard Home directly on an OpenWrt Router.
MANY THANKS TO MY PATRONS on / onemarcfifty !!!
Please visit my channel page: / onemarcfifty
Want to talk to me? Join my Discord Server: / discord
Marc on Patreon: / onemarcfifty
Marc's channel on youtube: / onemarcfifty
Marc on Twitter: / onemarcfifty
Marc on Facebook: / onemarcfifty
Marc on Reddit: / onemarcfifty
Chat with me on Discord: / discord
0:00 Please use the chapters
0:40 Why filter DNS ? Use cases
2:40 How DNS Filtering works
4:10 How Clients get to DNS
6:28 Solution 1: Announce DNS with DHCP
8:20 Solution 1: Implementation
9:50 Solution 1: Separate DHCP Server
13:45 Call To Action
14:25 Solution 2: DNS forwarder
16:40 Solution 3: Enforcement/iptables
19:40 Solution 3: Implementation
25:10 Solution 4: adguard home on OpenWrt
26:30 Solution 4: Implementation
The firewall rule for the redirect:
iptables -t nat -A PREROUTING -m mac "!" --mac-source XX:XX:XX:XX:XX:XX -p tcp --dport 53 -m addrtype "!" --src-type LOCAL -j DNAT --to 192.168.1.245
iptables -t nat -A PREROUTING -m mac "!" --mac-source XX:XX:XX:XX:XX:XX -p udp --dport 53 -m addrtype "!" --src-type LOCAL -j DNAT --to 192.168.1.245
(replace 192.168.1.245 witht he IP of your DNS filter and XX:XX:XX:XX:XX:XX with its MAC)
The commands that are used or mentioned in this video:
nslookup (host name)
opkg install iptables-mod-extra
ip route
ip route del 192.168.1.0/24
netstat -tulpn |grep 53

[@OneMarcFifty]

Please visit my channel page: kzbin.info Want to talk to me? Join my Discord Server: discord.com/invite/DXnfBUG

[@unknown_channel_name]

The timing couldn't be any better. I recently bought a new router and flashed Openwrt. I was struggling this morning to setup DNS as it was a bit confusing at first glance. I am already running AdGuard Home on a separate machine. Keep up the good work Marc ! Looking forward to the Sunday discord session.

[@OneMarcFifty]

Awesome - many thanks Vibhu ;-)

[@greatestunknown]

I am on Luci 21.02 and I just bought a Raspberry Pi4 and installed Pihole. I saw three ways to try this; Network > Interfaces > WAN > Common Configuration > Advanced Settings > Use custom DNS servers Network > Interfaces > LAN > DHCP Server > Advanced Settings > DHCP-options Network > DHCP and DNS > Server Settings > DNS forwardings Confused I searched Google. Then it occurred to me, OneMarcFifty, of course! Wow, this really demystified these settings and then you showed even more advanced ones I never imagined. I'm going to try the Network->DHCP and DNS first, and when I'm pretty comfortable, move on to your third option. Thanks Marc, now I won't have to stay up till 4:00 a.m. trying to figure it out!

[@OneMarcFifty]

Awesome feedback - many thanks - glad you can get some more sleep now ;-)

[@endthefighting]

You have singlehandedly saved my mental health! I've been wrecking my brain trying to figure out what I've been doing wrong, and thanks to your detailed and great explanations, I now have everything working (new openwrt router, adguard running on home assistant pi), and as an added bonus, I've also learned a lot! Thank you a billion times!

[@OneMarcFifty]

Hi Ragnar, thank you so much for the feedback. I am happy that the video could help.

[@nonomnismoriar9601]

Great video and so well explained with lovely visuals!!! I have to tackle this soon for my home network which I use for work and family too and need to sort out ads and parental restrictions. I will be watching this video a lot in the near future! Perfect length and level of detail, please continue with this kind of material! Get the sense you really enjoy making these from the big smile you always seem to have 😊

[@OneMarcFifty]

awesome - glad you like it - many thanks for the feedback!

[@goppinaththurairajah760]

Very detailed tutorial. I am using AdGuard since 2021 with Raspberry Pi 4 and I started with OpenWrt in 2022. Now I am using OpenWrt as my main router and installed the AdGuard manually to get the control over the latest versions.

[@OneMarcFifty]

Many thanks for sharing ;-)

[@rubab44ih]

I am using PiHole as a network wide ad blocker. I started using it around 3 years ago. I used it as a DHCP server too. At some point an update messed up something on the rpi and I had to start using the router as DHCP again. I am watching this video to see if I can turn off the router DHCP and use the Pihole's DHCP to filter ads. Thank you for making a very informative and beginner friendly video.

[@SantaRosaBmx]

I can't believe how do u manage to reply to everyone, that's an outstanding work!! Im super thankful of you doing what u do for all of us who wants to learn about openwrt and solutions. Its way better than reading a page, specially with the quality of ur vids.

[@OneMarcFifty]

Hey, thank you very much for your friendly feedback. Yes, I firmly believe that in the long run viewers prefer to be able to interact with the creators. As long as I can manage it I'll reply to everyone ;-)

[@xtremeideaz]

I'm running both Adguard & pihole on a LXC as DNS 1 & 2. Nice video. Very explanatory

[@OneMarcFifty]

Many thanks for your feedback!!

[@zebop917]

This was very useful! It helps you to understand a bit more of the underlying principles rather than just being a sequence of instructions. You gained another subscriber :-)

[@quicolillo1937]

Deine Videos sind so unglaublich gut erklärt und hilfreich! Tausend mal Danke!

[@arf8891]

Hi Marc, thanks for your videos, you're awesome! I used to be a techie but I'm trying to come back slowly. I'd love to see more videos what we can do with a Raspberry Pi (recently bought it) and OpenWRT. I've been using OpenWRT for OpenVPN (Security mainly) on a Archer C7 but thanks to you I implemented a couple of thing on my OpenWRT. I installed AdGuard (after this video) I used implementation n1 (DNS Ad by DCHP) however, I forward my DNS traffic directly from AdGuard to my Public secure DNS Server. I'm really excited about my Raspberry Pi and looking forward to have different use cases.

[@OneMarcFifty]

Excellent ! Many thanks for the feedback !

[@tomduca]

Call to action!!! Hi Mark! I am using pihole + unbound in a raspy zero with GB ethernet adapter as dns attached to my Archer C7 with OpenWrt. I have firewalled 53 & 853 ports in OpenWrt, so there is no other way than the pihole (or VPN) to get DNS service inside my networks. It works like a charm. I use it for ads/track blocking and parental control. There are several useful, well maintained list out there. Thank you as always, excellent video! Regards!

[@tomduca]

config rule option name 'DNS-Forward-Allow-raspy' option src 'lan' option dest 'wan' option dest_port '53 853' option target 'ACCEPT' list src_mac 'raspy mac addr' config rule option name 'DNS-Forward-Reject-lan' option src 'lan' option dest 'wan' option dest_port '53 853' option target 'REJECT'

[@tomduca]

Of course I need a reject rule for every zone I have configured. But I did the setup unce and it works great. Without having to install new packages :) An now I am thinking... Those rules I set up before deploying unbound, when I had public DNS set up in the pihole. I think now I could even block ports 53 &853 completely since all DNS are resolved inside the pihole. Right?

[@OneMarcFifty]

Hi Tomás, you could block the ports but you would need to make sure that you don't block them between the pihole and router.

[@sumarouno]

The best and the most comprehensive tutorial for openwrt and adguardhome/pihole. Thanks

[@OneMarcFifty]

Cool - many thanks for the positive feedback !

[@bryanrobinson1980]

i've used PiHole in two different instances. First, at home for ad blocking and was utilized as a docker container in OMV5/6 running on a Raspberry Pi setup as a home NAS. Secondly, I have a similar setup for an RV trailer I live in during the week at my job, that bridges a connection to the work wifi, setting up a small wifi network within the trailer. It has a desktop hardwired via ethernet to a Netgear router running OpenWRT and broadcasting for the wireless devices to also connect. It has PiHole also setup as a container on the RV trailer NAS on a Raspberry Pi running OMV6. Took several nights after work to research on Google and KZbin methods to set it up. I used some information from other videos you have done, and other have done as well, to set it all up. I generally use the RV trailer NAS to host media and use Jellyfin to serve up the movies and TV shows I have saved on it.

[@OneMarcFifty]

Wow - I can imagine that this took a while to be configured ;-) Many thanks for sharing !!!

[@yasaralzakout7691]

I just want to say thank you for the great work, your videos very helpful and easy to understand.

[@JaimeGonzalez-tt4kk]

I have been using OpenDNS as a parent control system, however adguard looks like a more private solution. I will try it this weekend. Thanks for the detailed explanation!

[@OneMarcFifty]

Hi Jaime! Great stuff - let me know how it goes!

[@albertoleo9529]

Great video as usual! Always a lot to learn from your interesting videos Thank you

[@OneMarcFifty]

Thank you very much !

[@yakumark]

been waiting for this video. thank you!

[@OneMarcFifty]

Perfect - glad you like it ;-)

[@sarkybugger5009]

In answer to your questions: Yes. Network wide adverts and nasties blocking. Five minutes to download and configure. PiHole. Been running it for nearly three years, on a first batch Pi 1 Model B. (256MB RAM version) Had to reinstall after about a year due to cheap crap SD card. No other problems at all. It's great, and visitors appreciate the ad free experience.

[@OneMarcFifty]

Awesome - many thanks for the feedback !

[@manojcmenon]

Wow. Really loved option No.3 where you force all DNS lookups to the Pi-hole. (I didn't know that this was even possible). Perhaps, you should do an advanced iptables/netfiler tutorial with a few scenarios like this.

[@OneMarcFifty]

Hi, many thanks for the feedback. I've noted your suggestion ;-)

[@francocastilloAR]

You might even have to update it because in the next version of OpenWrt iptables will be replaced by nftables.

[@ramakrishnanagaraj7071]

Hi, Your video's are educational for me. I started to watch lot of your video's and learning about lot of tools I did not know before. Appreciate your help and support. In my setup I use pfsense with Pfblockerng .

[@OneMarcFifty]

Awesome - many thanks for your feedback.

[@d00dEEE]

Note that those DNAT rules can also be rewritten a little bit to provide NTP from a single local source. This can help if you want all your machines to have the same clock settings as close as possible. (Simply set up your router or one of your servers as an NTP server and redirect all UDP port 123 queries to it.)

[@OneMarcFifty]

Yes - absolutely right! I actually had the use case for a couple of Tasmota devices which are hard coded to use an ntppool server in the netherlands and were flooding my logs with ntp requests. What I did is that I even excluded them from being served on DNS as they really should go to my router for Time ;-) thanks for sharing !!!

[@LeoGitarzysta]

@@OneMarcFifty I wonder if just setting the right DHCP option would suffice. I did this in local hackerspace, so hosts in its network pick up the same time, so they could properly stream sound over PulseAudio, which is very picky in terms of clock synchronization. I did it by adding "list dhcp_option_force '42,' to the 'config dhcp' section for my LAN interface. Linux hosts did pick it up, however I had to use 'force' variant because they didn't ask for this option explicitly. Not sure about Tasmota, will have to check that as well, as I have quite a couple of devices too.

[@RutNij]

I use pihole on an old pi3. Asus router. Works perfect. Don't forget to redirect dns request pushed to the default gateway to the pihole. More and more apps / games on phones try this route to skip dns filtering. Also, if you have isolated guest wifi access, you need to go through the default gateway

[@OneMarcFifty]

Many thanks for your feedback !

[@robertspencer3553]

Good job Marc. Thank You !!!

[@OneMarcFifty]

Many thanks Robert!

[@ha55kr]

Hi Marc, always a pleasure to look at your videos. To the point and very helpful. Please keep up the good work! I use Adguard home on a Raspberry 4 with 4 Gb. This is a bit of an overkill hardware wise. You could use a smaller Pi. I have various VMs and PC's which who are all directed via my Fritz to the Pi. It was a breeze to install and I am keeping track of all the relevant blocking lists and updates. So far so good.

[@OneMarcFifty]

Awesome - many thanks for sharing Hans !

[@j.c.5011]

Nice, informative video. I've been and still using pFsense for a few years in combination with a virtualized AdGuard Home. Works absolutely perfect. All outgoing (V)LAN DNS traffic on port 53, 853 etc. is getting blocked and being forced through AGH. This a good way to also catch the rotten apples that use hardcoded DNS.

[@OneMarcFifty]

Hi, many thanks for the feedback and sharing ;-)

[@Maleko48]

I have a similar setup to this using pfBlockerNG, but still working through some woes it causes such as KZbin apps on SmartTV not working and Adobe Creative Cloud complaining and throwing errors among other things

[@somegeek7126]

Very interesting video and very well explained, as always ! I will try to use another router as DHCP because my ISP router has no option for customizing the DNS. Looking forward to test this with my raspberry Pi 3.

[@OneMarcFifty]

Perfect - let us know how it goes!

[@janoskovacs3237]

Hi! Thanks for the video, it's explains plenty of basic stuff, and I like your style. In my case my isp deals with pppoe, my owrt just acting as a router as dhcp client/server. About forwarding to a raspbey pi in my network on version 23.05 I found the following step somehow working: Network -> Interfaces -> Edit WAN -> Advanced Settings -> Use DNS servers advertised (untick, that reveal a new option) -> Use custom DNS servers -> set raspbery pi IP where adguard run. somehow without this It worked just for few query, even if I set under Interfaces » lan -> DHCP Server -> Advanced Settings -> DHCP-Options 6,IP-of-Rpi I don't know why, but strange. Marry x-mass

[@nIgnasn]

Would be nice if you updated this with instructions on v22 :) It uses nftables. The iptables-mod-extra does not work anymore. And in OpenWRT wiki there are instructions, but weirdly they don’t take effect on my router. These nftables are kinda new, so I guess not widely adopted and the ecosystem is not there yet. Great work btw!

[@OneMarcFifty]

Hi, yes - you are spot on - a lot of solutions still have dependencies on iptables. I'd say e just have to wait a bit in order to have all package maintainers switch to nftables.

[@gppproton]

Just all the information i need, thank

[@OneMarcFifty]

Thank you very much!

[@jdancouga]

PiHole with unbound running on a Pi Zero. Used it for ad blocking which works like a charm. Only regret was I should've done it sooner.

[@OneMarcFifty]

Same here ;-)

[@ChubbaStun]

I played with PiHole as well as AdGuard Home. AdGuard Home is better (supports DoH out-of-the-box) but the best is OpenWrt built-in Adblock package ;-).

[@OneMarcFifty]

I've heard that a couple of times now - need to check it out - thanks for sharing ;-)

[@lgrullon854]

awesome video, waiting on the Batman-Adv OpenWRT integration.

[@OneMarcFifty]

Hi - yes -it's in the making - peae also see github.com/openwrt/luci/pull/5698 ;-)

[@patcheen]

Thanks for the info. 😊

[@daggaactual]

great video, thanks 4 sharing....

[@followthetrawler]

Great video. Currently I use PiHole as DHCP/DNS server on a Pi4. It is additionally configured using UNBOUND so it queries root servers directly rather than providing the usual suspects with browsing information. I also have a firewall rule blocking all DNS requests except from the PiHole, so if someone does try to manually assign a DNS server they wont get resolution. I am going to start using OpenWRT and so am interested in how ad blocking can be achieved. Thanks for putting time into these videos!

[@OneMarcFifty]

Hi Stuart, many thanks for your feedback - querying the root servers is a great idea! Is that something that unbound does by design or does it need to be configured for that ?

[@ernstoud]

I run Pi-hole in a docker Ubuntu WSL2 container on a separate Windows PC. Runs great.

[@OneMarcFifty]

Oh wow - that's probably the first WSL2 comment here on this channel ;-) The Windows PC that you are running docker on - is it a workstation or server ? Is it always on - I mean, woul dit be used by others or is it just your own workstation ?

[@CAMOBAP795]

Thanks a lot for the video

[@guido7696]

Nice!, I do this differently, I can do this through a port forward and I can use the ! Sign aswell at src ip to whitelist the router and pihole ips in luci.

[@OneMarcFifty]

Hi guido - yes that works as well. You would just need to make sure that your IP address doesn’t change. I personally prefer rules based on MAC addresses

[@familytamelo8140]

Thank you for this amazing episode! But I do not have "Custom Rules" tab on my installation of openWRT. Is this installed via an additional LuCi package?

[@bendrabble6186]

Firstly, thank you so much for all your videos. They're great and have taught me loads! Secondly a hopeful request, is there any chance of getting and update on how to perform the enforcement with nf-tables? I tried using the iptables-nft but the --to command is not recognised.

[@OneMarcFifty]

Hi Ben, you might not even need a custom rule. Try using DNAT ( on the port forward tab of firewall)

[@alexs5588]

Thanks Marc, great video!!!! last video you mentioned the Batman protocol, do you still plan to release this video?

[@OneMarcFifty]

Hi Alex, yes it's still on. But before I do that my pull request needs to go through github.com/openwrt/luci/pull/5698 - I wrote a LuCI interface for that video ;-)

[@alexs5588]

Awesome! Can't wait🎉🎉

[@idaanx]

I've set my DNS settings under Interfaces > WAN > Advanced > Use custom DNS servers. Also disabled the DNS by peers, to not use my ISP's DNS and setup a DNSCrypt container to resolve the queries encrypted.

[@OneMarcFifty]

Many thanks for the feedback and sharing !

[@PiotrK2022]

@ OneMarcFifty Adguard/Pihole has DHCP function as well - you forgot to mention it. :)

[@OneMarcFifty]

Yes, you are right. The initial script for this episode was much longer, initially I wanted to go through some settings of Adguard Home in the end but I found that 30 minutes would be more than enough ;-)

[@radamanthys847]

wow, best explication tks

[@jrnhl]

Another great video of yours, Marc! How would you announce your pihole/adguard home service for IPv6? For IPv4 we'd set option 6 but where would we announce the DNS filter for IPv6? Would you simply add the bitmask to your LAN interface's IPv6 Settings as a DNS server inside the DHCP settings tab? Let's say ::5:0:0:0:245 according to your example from the IPv6 with OpenWRT video?

[@OneMarcFifty]

On the Interface - DHCP Server tab - IPv6 Settings - Announced IPv6 DNS servers. Here you can put addresses of DNS Servers that would be announced via DHCPv6

[@slavakorenblit1180]

Appreciate the excellent tutorial! I attempted to install AdGuard on my device (and forwarded it to port 5383). However, the guest network is no longer functioning. Should I apply a firewall rule, and if so, which one would be appropriate?

[@igormoeller]

I run PiHole in container on one of my NAS'. 2x WRT19000 routers with fast roam and af couce OpenWRT. Netgear managed switch to beef it up (link aggregation)

[@OneMarcFifty]

Awesome, thanks for sharing !

[@sansy9568]

YOU’RE THE BEST

[@OneMarcFifty]

Thank you ;-)

[@rachidyekini1898]

Thanks Marc, great video as usual with easy way to understand. I have question: if we have a device connected to vpn, can we still direct its traffic to pihole or adguard?

[@OneMarcFifty]

Yes, that is possible but it requires very thorough routing rules in order to prevent DNS leaking.

[@VK5ZSH]

@OneMarcFifty Hi I have been following along with some your howto's, but for this one when I install the iptables-mod-extra, I don't get any custom tab in 23.05.2, have you come across this issue and how did you fix it?

[@anonymousview1127]

In option 4 why not keeping adguard home as downstream dns and dnsmasq as upstream dns? I also see there's a dns filter module for openwrt, could that conflict with adguard home?

[@user-zr7kz4vs7c]

Great explanation!! Thanks a lot! How about SNI-based web filtering on OpenWRT? Because DNS over HTTPS cloud be used to bypass Pi-hole, many smart devices now implement DOH which is impossible for us to block them from phone home. Personally I use AdGuard home and redirect all dns (Port 53)

[@OneMarcFifty]

For SNI - wouldn't you still need a blacklist behind that ?

[@user-zr7kz4vs7c]

@@OneMarcFifty yup, but SNI based web filtering can prevent DOH or DOT

[@yungclowns]

It's pretty easy to set up a blacklist with openwrt 22.03-rcx or newer. Ships with dnsmasq 2.86 which improves blacklist performance. Put a blacklist in /tmp/dnsmasq.d and you're good to go. I setup a cron job to update the blacklist from oisd daily and restart dnsmasq. You need 10MB of space and a decent amount of memory, but it's working well on my modest router with the full list.

[@OneMarcFifty]

Hi, many thanks for that info - I didn't know that !

[@MrYal-gh9yj]

Thank you

[@OneMarcFifty]

You’re welcome- thanks for watching;-)

[@Anonymouzee]

Marc... I have a question... when do I seek for quality content on this topics I always end up in one of your videos??? ?did you installed some tracking cookies in my browsers?? ?or redirected my port 53 TCP/UDP to your DNS servers?? ;-)

[@OneMarcFifty]

Yeah ;-) Actually you're not far from the truth - If you have watched one of my videos, then youtube is quite likely suggesting another one to you ;-) Thanks for the feedback ;-)

[@IMBlakeley]

I added a Pi-hole running on a Pi 4b a year+ ago, this has a Stubby instance running which the Pi uses and hence all my DNS is also via TLS, the Pi also is a PVR getting me programs from Iplayer via a script otherwise it would be overkill as a Pi-hole only. I have another Pi 4b running OpenWrt as my router. I block port 853 for everything but the Pi-hole, hijack all requests to port 53 to stop bypasses from mostly mobiles. I do the same for time so my router is also the NTP for the whole network.

[@OneMarcFifty]

Hi, many thanks for the feedback and sharing!

[@JesseBluePunk]

For my home network I use an old Windows 10 laptop running 24/7. Since I have no idea about Linux, I built my own DNS blocker on Windows 10. All my internet traffic now goes through Adguard Home, Unbound and dnscrypt-proxy (ODoH). It took me a while to build it because there are few instructions for Windows.

[@OneMarcFifty]

Hi Sven, many thanks for the feedback.

[@cam0ke]

i have no idea how i got here, but thank you algorithm

[@OneMarcFifty]

Glad you like it ;-)

[@SultanAlharbii]

In the OpenWRT router is there any way to change where the DNS queries are stored from AdGuard Home (usb , another partion,....etc) , Great explanation as usual keep it up

[@OneMarcFifty]

Unfortunately there is no way to set this in /etc/adguardhome.yaml as the feature does not exist yet: github.com/AdguardTeam/AdGuardHome/discussions/4467 - what you could do is create a symbolic link in /tmp/adguardhome/data to another location prior to starting the service in /etc/init.d/adguardhome...

[@skug978]

For me at home, I'm running an Archer C7 with OpenWRT with AdBlock package (not Adguard Home). Also I use uBlock Origin on my browsers (Firefox, Chromium, LibreWolf) and AOSP (no google services on my mobile). My aim is to block anyone, especially Big Tech (Google, others) from invading my privacy and profiling me. When I'm away from home, I have a 4G router which has limited configuration options and doesn't permit me to choose DNS provider, so similar to your solution - I turned off DHCP on the 4G router, and have a Raspberry Pi running Pi-Hole and providing the DHCP service instead. I like your tutorial, however one thing that it doesn't seem to cover (and I'd like to do something about it myself - but it seems very tricky): DNS over HTTPS (DoH) - Proprietary applications, the Chrome browser, devices like Amazon Echo - All these things can potentially use DoH to punch DNS requests out of your home network to their DNS servers because they hide the queries in the HTTPS traffic. I believe the solution involves proxying HTTPS and/or blacklisting DoH server addresses. On the other side of the coin, I quite like DNS over TLS (DoT) because it gives you the privacy benefits of your DNS requests being encrypted (i.e. from your Pi-Hole to your preferred DoT server) but it runs on specific 853 port, which means that you can easily control access to it with your firewall rules. (For instance, block all 853 port traffic, except to this one trusted DoT server.)

[@OneMarcFifty]

You are totally spot on with your comment - many thanks ! A lot of comments here seem to point into the DoH direction - please also see my post here: kzbin.infocommunity

[@wojciech.z.opinia]

Hi Marc, I've Xiaomi AX3600 with recent snapshot build + luci. I've installed Adguard Home following your tutorial exactly. It was working fine until device reboot. After that I'm able to login to luci and adguard interface, but there is no outside internet connection. I found few similar threads, so I tried to: 1. change ntp servers to their ip addresses (and reboot) 2. disable dnsmasq (and reboot) None of that helps. Do you have any idea what might be wrong? I don't know if this is relevant, but I have additional network interface for guest network, also configured using your video help ;)

[@garypaulson5202]

I am using pi-hole on a Raspberry Pi, in a docker container. The Ubiquity router is set up to pass the local address of RPi first, with Cloudflare 1.1.1.1 second. Found a thouruogh tutorial online si it didn't take very long to set up. It works quite well, the only problem is that the blacklists i use don't seem to stay real current. pi-hoie will reload them automatically once a week, but if they aren't being maintained stuff gets thru.

[@OneMarcFifty]

Hi Gary, many thanks for the feedback. Yes - maintaining blacklists is a never-ending race ;-)

[@marcinalagor9782]

Two years ago I've installed Pi-Hole on T620 quad core thin client with Ubuntu Server. It's running perfectly. Power consumption about 5-6W. The difference between Pi-Hole and AdGuard is a consumption of RAM. Pi-Hole with ubuntu server use about 14-15% from 4GB ( Domains on Adlist more 2.339.000), when I run AdGuard it use more 50% with less Domains on Adlist then Pi-Hole). I think the better solution in AdGUard is the blocking all stuff like KZbin, Instagram... with one click on menu. The Pi-Hole requaire to add a specify adress to block list.

[@OneMarcFifty]

That's great feedback Marcin - many thanks for sharing!

[@francocastilloAR]

You have to use lists designed for AdGuardHome.

[@IpunkP]

great explanation as always, been a year using adguardhome running on raspbery pi openwrt, it filtering almost everything, except all requests from client using DoH. how to handle it?

[@OneMarcFifty]

Many thanks for the feedback ! DoH is a nasty thing - I'll make a community post about this - might be worth an episode... kzbin.infocommunity

[@papelaminemane2575]

Thanks for your video. I plan to use openwrt x86 on a powerful firewall with 8 ports. I would add adguardhome. My concern is how to configure the remaining 7 ports as a switch. eth0 will be wan and eth1 to eth7 will have the same ip.

[@OneMarcFifty]

Have you checked my OpenWrt playlist ? kzbin.info/aero/PLZXNpqQDHIJrgzaR7h1V1AT4bdaNjS0zZ

[@danielpinto9307]

Hi Marc, Amazing video, thank you, I'm currently using solution 3, is there any way to know which device made the request in AdGuard? It identifies as my router made the request. Also, it's possible to still access hostname of the main router? Thank you

[@OneMarcFifty]

Hi Daniel, unfortunately no - as we are rewriting the packets (or rather masquerading / DNATting) - there is no way to know that.

[@oskar3514]

I'm using a Pihole with your solution 1, using the OpenDNS, Quad9 and Cloudflare servers... Its a fine setup, and I get rid of the adds

[@OneMarcFifty]

I've had a look at the Quad9 offering - it looks quite solid - many thanks for the feedback !

[@davidbellamy4334]

Currently I use Adblock under openwrt on a raspberry pi cm4 on a specialist router board.

[@OneMarcFifty]

Many thanks for sharing David!

[@chickennugget3362]

I run a synology nas and have adguard home on it with a seperate ip for its DNS. I have however started to run a domain server from the nas too. All of the workstation computers were set to use the dns ip of adguard home, however for the domain controller to work, i now need to set the dns ip of the nas for the work stations to be on the domain. Being that I can only use one or the other for the dns ip, i have to choose between adguard or the domain. Is there a way around this?

[@OneMarcFifty]

Hi, it's not entirely clear to me how you set this up. Maybe you want to jump on the Discord Server and post a drawing there?

[@user-ow2gj8iy1c]

I can't see "Custom Rules" tab on Firewall settings. What am I missing here ?

[@pcislocked]

i use adaway on my phone(rooted ofc). that's all. ublock serves me pretty well on pc.

[@OneMarcFifty]

Great feedback, many thanks !

[@pcislocked]

can pihole or adguard use dns over https? if so, then you can block pihole servers' udp53 as well, to prevent dns leakage from that server as well.

[@OneMarcFifty]

They both can. You could even use dns over https with dnsmasq on your router if you wanted to completely close the chain. There is a software package called http-dns-proxy here: openwrt.org/docs/guide-user/services/dns/doh_dnsmasq_https-dns-proxy

[@tonydo29]

How can I block access from certain domain with certain MAC address client by openwrt version 21?

[@claudiopgjr]

Hi Marc, thank you for sharing your knowledge. I still need to understand a simple solution for DNS. How can I configure OpenWrt (via Luci or CLI) to use a specific DNS? In my case, I'm looking to use the OpenDNS. I hope you can help me.

[@Mike28081991]

He described the different methods explicitly for openwrt in solution 1 (8:42 over DHCP) and solution 2 (15:46 DNS Forward).

[@sukhdeepzz]

Using pfsense on HP-T620 with pfsense blocker . Though the thin client have only 1NIC i have converted an openwrt router into vlan managed switch . Now the router being used as both access point and managed switch.

[@OneMarcFifty]

Nice solution - thanks for sharing ;-)

[@huanly9234]

i used pihole for a while, but it can't block youtube ads, so i am trying adblock on openwrt in hope it could help. Do i need to delete the route on dnmasq like you did with adguard home? Would Iptable command on your description help with youtube ads? I followed your tutorial on Belkin RT3200, I can't find The Firewall > Custom Rules after flashing Belkin RT3200 to openwrt snapshot. Am I missing something?

[@OneMarcFifty]

Hey, you shouldn't block KZbin ads - YT creators need the income ;-) Just kidding - it would help with the overlay ads (i.e. the ones that pop up) but not the embedded video ads.

[@ramosel]

Or, if you ARE using pfSense, you run pfBlockerNG. A VERY powerful DNS filter and DNSBL utility that runs ON the router integrated with Unbound. (in response to your Call For Action)

[@OneMarcFifty]

Hi - many thanks for the feedback - yes, pfBlockerNG has come up a couple of times in the comments. Need to have a look at it :-)

[@jairunet]

Excellent one Marc, I am wondering if the Netgear WNDR4300 v2 with 120 MiB memory will be enough to run AdGuard on it, I have 68 MiB of memory free. I hope to catch up on your discord server soon. Thank you very much for all the great content!

[@OneMarcFifty]

That should work - just watch out for the log file growth!

[@jairunet]

@@OneMarcFifty Thank you!

[@whitelightning5661]

I have a Belkin 3200, with openwrt, and Wireshark with vpn. Will adding Adguard home package on it slow down my internet speed?

[@OneMarcFifty]

It will slow things down for some things as it needs to do an additional hop. It will however speed up a lot of pages as you won't get ads any more. My personal experience is that the "felt" speed is the same, but without the ads.

[@jonathanpayne9956]

Mark! I say mark! been waiting, holding my breath, for the video you announced on vlan over lan as opposed to wifi! is it coming? ehh? i have turned blue and will shortly have to start breathing again! well at least i can now add add guard to my setup while i wait!

[@OneMarcFifty]

Please keep breathing 😂 - the batman-adv video just takes a bit of time because I had to write the user interface which is currently in the testing phase - please see my community postings on that ;-)

[@rperanen]

@@OneMarcFifty thank you for making extra effort with the luci interface. I am tweaking the batman configuration myself with the config files. Luci with your changes included is definitely more user friendly

[@OneMarcFifty]

Hey Jonathan - hope you had started breathing in between - - your video is life kzbin.info/www/bejne/qmWkYZ6cnJeiotE

[@garyprice464]

Hi great video as usual, can I use adguard home as well as adblock on my openwrt router? Also when are you going to start uploading your videos to odyssey?

[@OneMarcFifty]

Hi Gary - I have not tested adblock and adguard home in parallel - but why would you want to do that ? I'd rather strive to have the lists integrated into one solution. W/r to odyssey - I probably won't use it - due the fact that it is blockchain based I could see issues if I wanted to edit or remove content. I am currently examining the possibility to provide Vimeo ad-free content to my Patrons.

[@garyprice464]

@@OneMarcFifty Hi thanks for the reply adblock is working very well for me tbh but always nice to have other options Regards odysee I always think its better for creators to have back up options if youtube decides you have broken one of their 'rules'

[@subhobroto]

Going to start watching now, but Im thinking: It would be awesome if the DNS server/filter on the router could be configured via a rest API

[@OneMarcFifty]

Oh - thats a very interesting aproach - what would you like to configure - I mean which type of interface or application would you like to hook into this ?

[@subhobroto]

@@OneMarcFifty The most popular DNS service/server that can be configured via a rest API is PowerDNS - but Im unsure if it will run on a router. The next best option would be CoreDNS. So you use something like Ansible to manage the state/configuration of your DNS server using more "traditional devops" process than custom/adhoc process

[@Millilitree]

Its possible to use !IP_TO_ADGUARDHOME for source IP address in firewall setting to prevent adguard-home to loop back

[@OneMarcFifty]

Hi, I didn't know that - thanks for sharing

[@nehajain2974]

Thanks alot for the video. Can we do MAC address filtering with adguardhome. I am using adguardhome for dhcp and want to block all devices which are not added in dhcp static lease

[@OneMarcFifty]

This should be done on the router’s dhcp settings, not in Adguard

[@nehajain2974]

@@OneMarcFifty ok... thank you so much for the reply...

[@vancedyap]

Hi, I'm trying to follow the enforcement step but after upgrading to openwrt 22.03, custom rules tab no longer available even after installing the iptables extra. Will you be releasing an updated guide? Ty.

[@OneMarcFifty]

Hi Vance, there are a coupe of videos that need updating really ;-) W/r to the custom rules you can also use DNAT (in the port forwarding section) for that

[@vancedyap]

@@OneMarcFifty ty. Looking forward to an updated guide/s. Your videos help me a lot as it is easy to follow and understand for a beginner in networking like me

[@pikkons]

updated guide on installing adguard on openwrt would be nice!

[@OneMarcFifty]

Hi, this is currently not on my road map - but I'll think it over.

[@FigmentalMonkey]

I'm currently running Pi-Hole on a RPi3 which is acting as both DHCP and a recursive DNS server via Unbound. Ads be damned, and with Wireguard on my phone the blocking even extends outside of my home network.

[@OneMarcFifty]

Awesome- thanks for the feedback !

[@pichonPoP]

Hey there, is me again. I'm trying to do this on openwrt 21 nftables, but it is not working. I translate the rules here, but it does not fit. The router itself has connection to the world, but my devices does not have. Could you help me here.?

[@OneMarcFifty]

Hi - welcome back ;-) I am afraid that I need to skill up myself on nftables before I can give compelling advice here ;-) But I think I need to do a couple of follow-up videos on OpenWrt rather sooner than later anyhow. fw4, nftables - big changes under the hood.

[@u2ramess666]

I have and OpenWrt router setup as the main internet router. On it I have DHCP setup for 4 vlans. I use a PiHole configured to be accessible in all vlans through adding the vlans to the configuration of the PiHole, servicing those vlans with blocking from 1 device. My setup works as I have it currently configured. My main OpenWrt router is an old Cisco EA3500 which I am only using as a wired router and which connects another OpenWrt router (configured as AP) and a Mesh pair of Asus routers (Stock Firmware and configured as AP) The vlans are mostly over the 2 OpenWrt routers, with the Asus routers being in their own vlan. I'm wanting to upgrade the whole mess at some point to be a Mikrotik hEX POE gigabit router and 2 cAP XL ac (Access Points) configured with vlans. Can't get either currently due to the chip shortages

[@OneMarcFifty]

Many thanks for sharing - and yes - the chip shortage is a curse....

[@RahulSomasundaramssrahul96]

i think we cannot enforce if we use doh! it would be over 443 rite?

[@OneMarcFifty]

Hi Rahul, there are two aspects to DoH - the one where you want it (like set a forwarder to DoH) and the one where you don't want it ("rogue" DoH, i.e. devices preventing enforcement). I am thinking of addressing this maybe with an SSL proxy.

[@AlexeyPirogov]

It would be great to enable DOH/DOT for extra privacy.

[@acehoodman]

OpenWrt 23.05.3 doesn't have the custom rules tab anymore! I think you need an updated video for current OpenWRT (23.05.x).

[@jeronimo3054]

Hi OneMarcFifty. First of all, crangratulations for yout content! I watched all of your videos and now i have more knowledges about tecnology! I would like to ask you about one important thing about my net: Here I have basicly 2 wi-fi networks, the main one and the guest one, with diferent IP addresses. Well, I would like to use the pihole to filter DNS ads on both of them, but I am not shure how to do that because I have 2 differents networks trying to use it. Could you help me? I'm looking forward to the next videos, especially for B.A.T.M.A.N. ! Thank you

[@OneMarcFifty]

Either you allow DNS traffic from both networks to the DNS filter on the firewall or tou use solution 3

[@jeronimo3054]

@@OneMarcFifty I tryed to use the last solution with the iptables comands, but after that problem, i just created some "virtual ethernet devices" on raspberry and i put each one in a different vlan and then now my dhcp send to the clients the ip of the dns server for each vlan. It works, but i would like to redirect through the main router...

[@jeronimo3054]

@@OneMarcFifty I forgot to say that I use VLANs running in the same infrastructure without physical separation

[@greencrunchy]

I'm using the adblock package from openwrt. Is the adguard home any better?

[@OneMarcFifty]

I did not have a detailed look at adblock. I think adguard home is a bit feature-richer but adblock has an integrated LuCI interface (which AdGuard does not)

[@qcsupport2594]

@@OneMarcFifty Indeed, adblock's luci interface has a simple checkbox for "Force local DNS" which automatically takes care of the firewall settings needed to redirect (aka: hijack) all DNS requests on the LAN. (There are sub-fields for zones and ports, but defaults work for me.) This alone would make it my first recommendation for most people, with the proviso to check the memory usage (via status->overview->memory->used) and trim the block list selection accordingly.

[@d00dEEE]

I run nsd on an Alma server for authoritative DNS for the home network. An Ubuntu server running Samba talks to it to get/serve LAN names and acts as its own DNS server. AdGuard is running on my OPNsense router/gateway, with unbound behind it talking to the quad9 recursor. We have a PiHole instance running as backup for AdGuard (but since AG is on the router, if AG stops working it's probably because something else is wrong, so the PiHole isn't going to be much help).

[@OneMarcFifty]

Wow - I didn't know Quad9 - Swiss made ;-) I'll need to have a closer look here ;-) Thanks for sharing!

[@d00dEEE]

@@OneMarcFifty Yeah, I only heard about them about a year(?) ago from Tom Lawrence. He did a long video talking to one of their principals about how the company was founded, their commitment to privacy and so on. I switched from cloudflare immediately... 😀

[@d00dEEE]

@@OneMarcFifty Found it, kinda long, but stuffed with good info. kzbin.info/www/bejne/mJikYaptmsuEeZo

[@jyvben1520]

just installed pi-hole via dietpi (which runs on many different sbc ,not only raspberry pi) , can run a webserver so you manage/view the pi-hole remotely (after setup) to manage you need password ...

[@OneMarcFifty]

Hi, many thanks for the comment! Believe it or not - I didn't know dietpi ;-( I'll have a look at that !!!

[@CezarySiw]

There are also public AdGuard DNS servers that can be used. Of course, it will be slower than the private ones. BTW, do you know an easy way of switching IP/DNS used by clients? Sometimes you just want to see the ads ...

[@OneMarcFifty]

Hi Cezary, many thanks for the feedback! Well, you could either change the network settings on the client, you could use privacy badger on the client and switch it off or - you could have two different Wi-fi networks. One being filtered and the other one being unfiltered

[@francocastilloAR]

With OpenWrt you can assign each device a different DNS IP in case you want ads on a certain device.

[@saotekwong3276]

I used solution 4. It work for a few hours. And the next day, I start unable to resolve any dns names. Don’t know why.

[@wojciech.z.opinia]

Did you find any solution?