DNS Filtering¶
Last Updated: 2026-07-19 Status: ✅ Active
Purpose¶
Network-wide ad blocking, tracker blocking, and malware/phishing protection using AdGuard Home. Two instances run in primary/replica configuration — if the primary goes down, devices automatically fall back to the replica.
Instances¶
| Role | Host | IP | Admin UI |
|---|---|---|---|
| Primary | Pacific LXC 101 | 192.168.1.11 | http://192.168.1.11 |
| Replica | Lotus Docker | 192.168.1.111 | http://192.168.1.111 |
Sync¶
Config is synced from Primary → Replica by adguardhome-sync (linuxserver container on Lotus, port 8088), running hourly. Syncs filters, blocklists, allowlists, client settings, and DNS config. Query logs and statistics are local to each instance.
Upstream DNS¶
Primary and replica both use:
- https://dns.cloudflare.com/dns-query (Cloudflare DoH)
- https://dns.google/dns-query (Google DoH)
Parallel requests mode — both are queried simultaneously, fastest response wins.
Fallback (plain UDP): 1.1.1.1 / 8.8.8.8
Blocklists¶
| List | Purpose |
|---|---|
| AdGuard DNS filter | General ad/tracker blocking |
| OISD Blocklist Small | Balanced blocking, low false positives |
| Peter Lowe's Blocklist | Well-maintained general list |
| HaGeZi's Allowlist Referral | Protects cashback and affiliate links (TopCashback etc.) |
| Dandelion Sprout's Anti Push Notifications | Blocks push notification prompts |
| HaGeZi's Windows/Office Tracker Blocklist | Windows/Office telemetry |
| Phishing URL Blocklist (PhishTank + OpenPhish) | Phishing protection |
| HaGeZi's Threat Intelligence Feeds | Threat blocking |
| Dandelion Sprout's Anti-Malware List | Malware domains |
| Malicious URL Blocklist (URLHaus) | Known malware distribution URLs |
| HaGeZi's DNS Rebind Protection | Protects against DNS rebind attacks |
Client Profiles¶
| Client | Profile | Notes |
|---|---|---|
| Brabham (192.168.1.40) | Global | Dan's workstation |
| Gabriela's devices | Custom | Ad blocking off, security/phishing lists kept on |
| SHIELD TV (192.168.1.30) | Global | |
| Living Room Switch (192.168.1.3) | Global | Network switch management traffic |
Local DNS Entries¶
None configured — local device resolution handled by UCG Ultra DHCP/DNS.
Recovery¶
If DNS filtering goes down: - Devices on the main LAN will fall back to the replica automatically (UCG DHCP provides both IPs) - If both instances are down, devices fall back to UCG Ultra's upstream DNS
To restart Primary: SSH to Pacific (ssh root@192.168.1.10, key-based) → pct start 101
To restart Replica: Unraid Docker UI → start AdGuard-Home container
To restart sync: Unraid Docker UI → restart adguardhome-sync container
Known Issue: Primary's LXC disk is small (3.9GB)¶
2026-07-19: Primary went fully unreachable (ping worked, but ports 80/53 were both dead) because LXC 101's root disk filled to 100% from AdGuard's default 30-day query log retention (querylog.interval: 720h) — querylog.json + its rotated backup alone were 2.3GB. AdGuardHome crash-loops on start when it can't write its own files, with no useful detail in journalctl (only start/stop events) — check df -h / on the container first if it's unreachable again.
Fixed for now by deleting the old query logs and reducing querylog.interval to 7d in AdGuardHome.yaml. The disk itself is still only 3.9GB — growing it (pct resize 101 rootfs +4G, plenty of room on local-lvm) was considered but not done; worth revisiting if this recurs. Full writeup: Lessons Learned.