Install Adguardhome as DNS-Over-HTTPS (DOH) on NAT VPS-Natvps.id

Natvps.id – Adguardhome is software ad blocking & tracker at the network level. Adguardhome functions as a DNS server that will block advertising connections from user devices. Adguardhome is Open-source and can beSelf -Host on our server.

This article discusses the steps to install adguardhome on NAT VPS along with the Nginx configuration for Reverse-Proxy DNS-Over-HTTPS (DOH). This article uses Ubuntu 22.04 as a reference, but you can use other distributions such as Debian and Centos. Make sure the OS used is supported by Adguardhome.

Port forwarding configuration

Considering we use grout, we need to add 2 Port Forwarding Configuration on the virtualizor panel (or other VPS panels according to the provider), namely Port Forwarding HTTP and HTTPS for adguardhome access.

For example, in this article will use a domain adguard.tutorial.mdinata.my.id. You are free to change the domain according to your choice. Record this port and domain, because we will use it again in the installation process.

Don’t forget to add DNS Records to go to your NAT VPS public IP, like this:

Deactivate systemD-resolved (port 53)

Distribution such as Ubuntu and its derivatives in default using Systemd-resolved which runs on Port 53. This port will be used by Adguardhome to run the DNS Server, so that the SystemD-Resolved needs to be deactivated.

To check whether Port 53 is being used, use the command:

sudo lsof -i :53

First, make a configuration for systemD-resolved

sudo mkdir -p /etc/systemd/resolved.conf.d
nano /etc/systemd/resolved.conf.d/adguardhome.conf

Fill in the following configuration:

[Resolve]
DNS=127.0.0.1
DNSStubListener=no

Save the file with Ctrl-x, YThen Enter.

Then, change Resolv.conf use:

sudo mv /etc/resolv.conf /etc/resolv.conf.backup
sudo ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf

Finally, restart Systemd-resolved:

sudo systemctl reload-or-restart systemd-resolved

Check Port 53, there should be no programs that run now.

Install Adguardhome

Download the latest release of Adguardhome:

curl -LO 

Adguardhome extract to /choose:

tar -xzvf AdGuardHome_linux_amd64.tar.gz -C /opt

Finally, start the Adguardhome installation:

cd /opt/AdGuardHome
./AdGuardHome -s install

Nginx Configuration (Reverse Proxy)

So that we can access adguardhome through domains like adguard.tutorial.mdinata.my.idwe can use Reverse Proxy Like Nginx.

First, install Nginx through the command:

# Hapus Apache2 dan pendukungnya (biasanya terpasang secara bawaan di VPS OpenVZ)
apt purge apache2* -y

# Install NGINX
apt install nginx -y

Create a new host configuration specifically for Adguardhome:

nano /etc/nginx/sites-available/adguard

Then stick the following configuration:

# 

    server {
        listen 80;
        listen [::]:80;

        server_name adguard.tutorial.mdinata.my.id;

        location / {
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header                   Host $host;
            proxy_set_header                   X-Real-IP $remote_addr;
            proxy_pass  
            proxy_redirect                     / /;
            proxy_cookie_path                  / /;
        }

        location /dns-query {
            proxy_set_header Host            $http_host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_bind 12.0.0.17;

            proxy_pass 
        }
    }

Change adguard.tutorial.mdinata.my.id with your domain. Change too 12.0.0.17 with your private NAT VPS IP address (not public!).

Activate the configuration with:

ln -sf /etc/nginx/sites-available/adguard /etc/nginx/sites-enabled/adguard

# Restart NGINX
systemctl restart nginx

Produce SSL certificate (let’s encryption)

So that our domain can be accessed through HTTPS, we need to make a SSL certificate. We can use a free SSL certificate from Let’s Encrypt through Certbot.

Install Certbot and Nginx plugin use the command:

apt install python3-certbot python3-certbot-nginx

So, produce Certificate through Certbot with the command

certbot --nginx -d adguard.tutorial.mdinata.my.id

Change adguard.tutorial.mdinata.my.id with your domain.

Happy! Your current domain can be accessed via a safe connection https.

Configure Adguardhome

Adguardhome can be accessed through your previous domain. Example: https://adguard.tutorial.mdinata.my.id.

On Admin page interfacechoose interface from NAT VPS, then replace the port to 4000. On DNS ServerAlso use the same interface as before.

In authentication, enter the username/password you want to use.

If so, then Adguardhome will not be accessed for a while, because we use the port 4000. Using port 3000 will directly cause an error on the Adguardhome UI web.

Change again to port 3000 by opening the file /opt/adguardhome/adguardhome.yaml:

nano /opt/AdGuardHome/AdGuardHome.yaml

Change the port on address to 3000:

Finally, restart Adguardhome:

systemctl restart AdGuardHome

Cover

Thus this article is about the steps to install Adguardhome on NAT VPS. If you are confused or doubtful, don’t hesitate to ask questions in the telegram group @ipv6indonesia. Thank You!