Installing AdGuard Home on PFSense

Today I will show how to install AdGuard Home on PFSense. While I haven’t tested this on OPNSense. The binary for FreeBSD (PFSense) may work on HardendBSD (OPNSense).

Why use AdGuard Home?​

Screenshot-2020-10-13-102928.png


  • Pretty UI: While PFBlockerNG can do DNS Blocking, it has a much more complex UI.
  • AdGuard Home UI is easier to use
  • Built in Encrypted DNS: AdGuard Home supports build in encrypted DNS (DNS over TLS, DNS over HTTPS).
  • Different methods of querying: AdGuard Home supports Parallel Querying where multiple servers are queried at once. This is especially good if you have a unreliable network.
  • FreeBSD Support: AdGuard Home supports FreeBSD so you won’t have to virtualize anything.
  • Modify DNS TTL to keep DNS Records in cache for longer.
Screenshot-2020-10-13-103046.png

Step 1: Change the Port of your PFSense DNS Resolver​


1.png

2.png


Login to your PFSense Firewall web UI and go to Service> DNS Resolver and change the "Listen Port" from port 53 to some other port, I chose 6666. Set Network Interfaces to localhost, there is no need for the pfsense resolver to listen on LAN interface.

To enable rDNS lookups and hostname lookups for devices on your LAN, enable " DHCP Registration" and " Static DHCP" in DNS Resolver settings.

Step 2: Go to AdGuard home releases page and get the FreeBSD Version:​

adguardreleases.png


Go to Releases · AdguardTeam/AdGuardHome

Then get the latest version of AdGuard for FreeBSD (as PFSense runs on FreeBSD). Most likely you will have 64Bit version of PFSense so you need AdGuardHome_freebsd_amd64.tar.gz . However if you have 32 Bit PFSense you need AdGuardHome_freebsd_386.tar.gz.

Step 3: SSH into your PFSense box​

Right click and copy the link of the release.

SSH into your PFSense box using Putty or SSH on WSL and enter the following commands:

Code:
cd /
mkdir opt
cd opt
fetch https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.104.0-beta2/AdGuardHome_freebsd_amd64.tar.gz

Make sure to change the url in fetch to the one you got on Step 2 to get latest version.
Code:
tar -xvf AdGuardHome_freebsd_amd64.tar.gz
cd AdGuardHome
./AdGuardHome

This command executes AdGuardHome so that we can do initial configuration in the browser.

Step 4: Initial Configuration​


Screenshot-2020-10-13-113123.png

Go to your router URL with port 3000 on your browser. In my case its http://192.168.5.1:3000 . Replace 192.168.5.1 to your PFSense Address.

It should open the web interface of AdGuard Home.

Click on Get Started.

Now you will see a screen asking to setup interfaces for AdGuard UI and Resolver to run on. You need to set both the Admin Interface and DNS Server Interface to your LAN Interface. In my case it is igb3. It will also show the IP of the Interface next to it to help you identify easily. In my case it is 192.168.5.1 which is the IP Address of my router.
Screenshot-2021-01-07-134022.png

Set the same interface for DNS Server.

Also, make sure to change the Port of web interface from 80 to something that is unlikely to be used on the network. Lets say port 12838. Choose any high port that isn’t likely to conflict with your other applications.

Next enter a username and password for your AdGuard Home. Make sure to use a strong password.

Click on Next and then Open Dashboard.

Now that initial configuration of AdGuard is done. Go back to PFSense SSH and terminate AdGuard using Ctrl+C.

Step 5: Installing some extra packages:​

To make sure that AdGuard gets filters without errors, you will need to install ca_root_nss

Run this command on the PFSense SSH
Code:
pkg install ca_root_nss

Next you will need to install screen so that you can run AdGuard even when ssh is closed.

Code:
pkg install screen

Lets also install nano text editor so we can write and edit simple text files.

Code:
pkg install nano

Install shellcmd PFSense Package from WebUI. Its under System>Package Manager>Installed Packages:
Screenshot-2020-11-14-103402.png


Step 6: Making AdGuard Home start on boot:​

Go to Services>shellcmd and click Add

Command: /usr/local/bin/screen -S AdGuardHome_screen -d -m /opt/AdGuardHome/AdGuardHome
Shellcmd Type: shellcmd
Description: AdGuard

Screenshot-2020-11-14-104100.png

Click Save
Reboot PFSense and AdGuardHome will start up.

Step 7: Set Filters and DNS Resolvers for AdGuard Home:​



Go to the Web UI of AdGuard Home. It is at http://192.168.5.1:12838 . Where 192.168.5.1 is the IP of your PFSense and 12838 is the Port of Web Interface of AdGuard which we set in Step 4.

Login with your username and password which you set in Step 4.

Now go to Settings>DNS Settings

Use the upstream DNS Server of your choice. These are my resolvers

Code:
https://dns10.quad9.net/dns-query
tls://dns.google
tls://1.1.1.1
https://doh.opendns.com/dns-query
Screenshot-2020-10-13-120812.png

Find more Encrypted DNS Resolvers at DNS Privacy Public Resolvers - DNS Privacy Project - Global Site

Set the query mode to “Parralel Requests” for faster queries.

By default AdGuard Home only uses “AdGuard DNS filter” however you can add your own filters such as

https://www.malwaredomainlist.com/hostslist/hosts.txt

https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts

and enable the filters Disabled by default.

However, keep in mind, higher the number of domains higher the likelihood of false positives.

Step 8: Set PFSense to use the AdGuard DNS:​


Go to System> General Setup in PFSense Web Interface and set the DNS Server to 192.168.5.1 and remove any other resolvers.
Screenshot-2020-10-13-121135.png

That’s it AdGuard Home is up and running on PFSense


Step 9: Test AdGuard​



Go to your PFSense SSH and type in:

Code:
dig @192.168.5.1 google.com

Where 192.168.5.1 is the IP of your router

It should output the IP Address of Google.
dig @192.168.5.1 google.com

; <<>> DiG 9.16.1-Ubuntu <<>> @192.168.5.1 google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 946
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;google.com. IN A

;; ANSWER SECTION:
google.com. 10 IN A 74.125.130.147

;; Query time: 0 msec
;; SERVER: 192.168.5.1#53(192.168.5.1)
;; WHEN: Thu Jan 07 16:34:08 IST 2021
;; MSG SIZE rcvd: 44

On Windows you can do

Code:
nslookup google.com 192.168.5.1

to test the resolver
 
Last edited:
Messages
3
Location
Managua
ISP
wire
a little help, I have dnsresolver running on that interface and pfblockerng, would this have anything to do with it?

listen udp 192.168.30.1:53: bind: address already in use
 

JB701

Messages
1,972
Location
Delhi
ISP
TriplePlay/Excitel
which version of adguard home are u using?

you can try running it in a screen manually without shellcmd and see if it sticks? if it doesn't itll output the error on screen.
 
Messages
485
Location
Patna, Bihar
ISP
Airtel Xstream, Railwire, Siti, Airtel 4G, Jio 4G
I have set up Adguard home on an Oracle VM and set up DOT.
Changed my Openwrt router Lan config to have my VM address as DNS.

Have kept Upstream DNS servers mentioned in the first post.

Now the issue is when I check the DNS encryption here It says my DNS encrypted and sometimes not. SNI is always not encrypted.
Also, 60% of the time I am seeing ads on pages. Even the ISP blocked sites are still blocked. This means the DNS is leaking.

@JB701 any suggestion?
 


Messages
485
Location
Patna, Bihar
ISP
Airtel Xstream, Railwire, Siti, Airtel 4G, Jio 4G
@royalroy
No. I have not set DOT on openwrt.

Query round Progress... Servers found
1 ...... 4
2 ...... 4
3 ...... 4
4 ...... 4
5 ...... 3
6 ...... 3

103.107.199.244NoneGSL Networks PtySingapore, Singapore
sg.png
162.158.226.137NoneCloudflareMumbai, India
in.png
162.158.226.184NoneCloudflareMumbai, India
in.png
162.158.226.185NoneCloudflareMumbai, India
in.png
59.144.144.104aes-static-104.144.144.59.airtel.in.AirtelIndia
in.png
59.144.144.34aes-static-034.144.144.59.airtel.in.AirtelIndia
in.png
67.215.80.70m37.sin.opendns.com.Cisco OpenDNS, LLCSingapore, Singapore
sg.png
74.63.20.248res301.qpg.rrdns.pch.net.WoodyNetSingapore, Singapore
 

JB701

Messages
1,972
Location
Delhi
ISP
TriplePlay/Excitel
Now the issue is when I check the DNS encryption here It says my DNS encrypted and sometimes not. SNI is always not encrypted.
Also, 60% of the time I am seeing ads on pages. Even the ISP blocked sites are still blocked. This means the DNS is leaking.

@JB701 any suggestion?

CloudFlare is saying that because you are using many upstream DNS it doesn't recognise other DNS Servers as encrypted. I don't think this is very useful if you are running DNS on a remote server (as Oracle VPS should have good routing & latency to most DNS servers).

you can just have tls://1.1.1.1 as the resolver and Cloudflare will show encrypted every time. I do wonder why Airtel DNS is showing up on leak test. Maybe its setup as secondary DNS in DHCP Server?

You can just setup Adguard home on Openwrt as well & get advantages of using multiple DNS upstreams

 
Messages
485
Location
Patna, Bihar
ISP
Airtel Xstream, Railwire, Siti, Airtel 4G, Jio 4G
@JB701 I tried keeping tls://1.1.1.1 only. But still it shows not encrypted. And dns leak, still leaking sometimes to airtel dns. I have kept only my vm ip in the LAN dns setting of the router.

About setting up Adguard home on openwrt, I have Archer A7 router and the configs are not that great. Also I was confused about what version of Adguard Home I will need for my A7.

My main problem is with this configuration, I am not able to browse websites which are blocked by Airtel. Whereas if I use warp with wireguard it works.
 
Messages
468
Location
Bolpur, WB
ISP
Alliance BB (AS23860)
For the record, I use DoH between chrome and Oracle VPS. The upstream is also on cloudflare DoH. Cloudflare still shows that DNS is unencrypted. Not sure how this works. The same issue is there with my android which is on DoT.
 
Messages
485
Location
Patna, Bihar
ISP
Airtel Xstream, Railwire, Siti, Airtel 4G, Jio 4G
So, I solved the DNS leaking issue. looks like I had to restart my router and system.

Can anyone help me unblocking websites (blocked by ISP Airtel) with help of Adguard Home and Openwrt? I tried openDPI etc. but nothing worked. Maybe I am not setting it up correctly.