I installed AdGuardhome in my linux server (ubuntu 20.0.4).Howver I can't access internet if I set the IP of AdGuadhome server as the only DNS address. So I usually set the a second DNS address for my terminal devices.
I want to know why this happened? The upstream DNS set in AdGuardhome response well. Why I can't use AdGuardhome as the only DNS address?

Dani AI

Generated

Quick diagnostic notes for (building on comments from and ). The failure when AdGuard Home is the sole DNS usually comes from one of a few root causes: AdGuard not actually answering client queries (network/firewall or service binding issue), AdGuard returning “blocked” or NXDOMAIN replies for required resources, upstream forwarding failing (DoH/DoT or plain DNS reachability), or an IPv6/system resolver conflict on the Ubuntu host. The goal is to determine which of those is happening before changing filters.

Minimal, non-destructive checks (run these and compare results):

# from a client on the LAN (replace ADG with AdGuard IP)
nslookup example.com ADG
dig @ADG example.com +short

# on the AdGuard host
sudo ss -tunlp | grep :53
sudo journalctl -u adguardhome -f

# test upstream resolution from the AdGuard host (replace UP with an upstream DNS IP)
dig @UP example.com +short

# if needed, watch DNS packets while reproducing the failure
sudo tcpdump -n -i any port 53

If the client queries never reach AdGuard, check host firewall/UFW and any router-level DNS interception. If AdGuard answers but returns NXDOMAIN/0.0.0.0 for many names, temporarily disable filtering/filters in the AdGuard UI and re-test — that isolates “filtering broke the page” vs “forwarding broke DNS.” If upstream uses DoH/DoT, switch upstream temporarily to a plain IP DNS to rule out TLS/bootstrap issues. Also check IPv6: some clients prefer AAAA lookups and AdGuard might not be listening on IPv6.

Prioritize: 1) confirm AdGuard is reachable and listening, 2) confirm it can resolve via upstream, 3) check query logs (AdGuard UI) while reproducing the error, 4) toggle filters off to test. Caution: changing or stopping systemd-resolved or firewall rules on the server affects its own DNS; perform changes with a rollback plan. These steps will pinpoint whether AdGuard itself or the block rules are causing the loss of connectivity.

Recommended Answers

All 6 Replies

I won't write much about this but the short version is that many sites won't load if you block too much.

If you want to dig into why sites don't load that's going to be you doing that work, I can't write more because each site differs on what you must allow for the site to function.

commented: It seems, as a DNS server, adguardhome can't resolve the domain alone. is this right? +0
commented: I am a Professional SEO Expert +0

I'm not sure what rproffitt is referring to, but as someone who runs a site, the only common thing I can think of that might limit whether we might block traffic or not is a non-standard user agent (e.g. that screams bot).

Many years ago, my cable ISP's DNS servers (Time Warner Cable) were having a lot of downtime. I switched to using 8.8.8.8 and 8.8.4.4 for DNS. (Google's public DNS)

I guess I'm a bit confused by your question though. Does AdGuard Home provide a DNS server for devices on your network to use? It sounds based on what you're saying like AdGuard Home just doesn't have that functionality, unless I'm misunderstanding you?

So I just did some Googling and read that AdGuard Home acts as a DNS server "that re-routes tracking domains to a "black hole".

My guess is that it is set up to be too strict, and you're basically rerouting so much to this black hole that you're not fetching the content you need to build the webpages. For example, if you have it set up to redirect all AJAX requests or CSS or JS or so forth to a black hole, then most websites will cease to function.

The web is probably working for you only when you provide an alternate (proper) DNS server that is correctly finding the real locations of these domains.

commented: Adguardhome acts as a DNS server, but it doesn't seem to be able to resolve domains on its own. Maybe I need to run a second domain resolution service +0

Adguardhome acts as a DNS server, but it doesn't seem to be able to resolve domains on its own. Maybe I need to run a second domain resolution service

When you have a secondary DNS service specified, does AdGuard do its job at rerouting traffic? It's possible it works just as a DNS service for the domains on its blacklist (rerouting them), and everything not on its blacklist needs to go through the secondary (real) DNS server.

If Adguard does not resolve then it's doing exactly what it intended. The site or content remains blocked.

In my view, it's not broken but working as they intended. You may want something else here. I'll go ahead and share I use just a few things. If the browser has an adblocker, I use that. I did add Ublock Origin as well. I can't guess how far you need to go here as to advert blocking.
Daniweb only gets a few blocked items. Such as:

filter logger content

10:29:56​​​www.daniweb.com​1​xhr​https://www.daniweb.com/connect/ajax/sidebar/notifications
10:29:38​​​docs.google.com​0,1​script​https://docs.google.com/static/offline/client/js/33895200-offline_sw_bin_offline_main.js
10:29:38​​​docs.google.com​0,1​script​https://docs.google.com/offline/common/serviceworker.js?ouid=ubdcbb7128fc4a60e&oucvi=true
10:29:37​​​docs.google.com​0,1​xhr​https://clients6.google.com/batch/drive/v2internal?%24ct=multipart%2Fmixed%3B%20boundary%3D%22%3D%3D%3D%3D%3D68l4kw6dsjpb%3D%3D%3D%3D%3D%22&key=AIzaSyDrRZPb_oNAJLpNm167axWK5i85cuYG_HQ
10:29:36​​​docs.google.com​0,1​xhr​https://clients6.google.com/drive/v2internal/changes/getRemainingCount?openDrive=false&reason=301&syncType=0&errorRecovery=false&pageToken=48861&key=AIzaSyDrRZPb_oNAJLpNm167axWK5i85cuYG_HQ

Again, it seems Adguard is working fine.

10:29:56​​​www.daniweb.com​1​xhr​https://www.daniweb.com/connect/ajax/sidebar/notifications

This line does two things: Firstly, it stops the little popup notifications indicating that you've received a new private message. Secondly, it stops the chat list (that shows when you click the little chat icon in the top navigation menu) from updating when there is a new message in a conversation.

As for the other 4 line items you have blocked, I cannot place them at all. The only thing I can think of is that they were sub-requests to a specific ad campaign that might have run at some point in time?

commented: <p>This is the best website <a href="https://bdggame.link/" target="_blank">big daddy login</a> for gaming.</p> +0
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.