What's new

Tutorial AdGuard Home - adblocker - Clean install on Asus Merlin (No 3rd party scripts !!!)

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

This beautiful tutorial was very useful for me, thanks. I am using OpenVPN in my router with VPN Director (policy rules). Due to the processor of my router, my Internet bandwidth decreases. Therefore I have to separate my PC from the OpenVPN client. I guess DNS configuration settings in the OpenVPN client is broken because of the following script, and all DNS queries are made via WAN IP address.
Code:
iptables -t nat -I PREROUTING -i br0 -p udp -m udp --dport 53 -j REDIRECT --to-port 53535
iptables -t nat -I PREROUTING -i br0 -p tcp -m tcp --dport 53 -j REDIRECT --to-port 53535
The question of an ignorant person: Can Adguard or Diversion's DNS queries be directed to the OpenVPN client that works with policy rules, to instead of WAN IP address?
 
This beautiful tutorial was very useful for me, thanks. I am using OpenVPN in my router with VPN Director (policy rules). Due to the processor of my router, my Internet bandwidth decreases. Therefore I have to separate my PC from the OpenVPN client. I guess DNS configuration settings in the OpenVPN client is broken because of the following script, and all DNS queries are made via WAN IP address.
Code:
iptables -t nat -I PREROUTING -i br0 -p udp -m udp --dport 53 -j REDIRECT --to-port 53535
iptables -t nat -I PREROUTING -i br0 -p tcp -m tcp --dport 53 -j REDIRECT --to-port 53535
The question of an ignorant person: Can Adguard or Diversion's DNS queries be directed to the OpenVPN client that works with policy rules, to instead of WAN IP address?

I don't think I have understood your question... or the problem.

1) I presume you are using OpenVPN Client to connect to a 3rd party VPN provider.
2) Are all clients going through OpenVPN or only selected clients going through OpenVPN (as defined in the OpenVPN director)
3) What are your VPN client 'Accept DNS settings' ? Disabled, Exclusive, etc...
4) What are you trying to achieve? Do you want that your PC (I presume operating outside the VPN tunnel) should also use AdGuard as DNS resolver or do you wish that your PC should use the DNS resolver as provided by your VPN provider?
 
--Here is my method--
1. Download Instructions:

In my version, I use the edge version. You are welcome to change it to match your setup. I run this on an RT-AX88U, so I chose linux_arm64 branch.
Using ssh terminal
Code:
cd /opt/etc
wget -c https://static.adguard.com/adguardhome/edge/AdGuardHome_linux_arm64.tar.gz
tar xfvz AdGuardHome_linux_arm64.tar.gz
rm -rf AdGuardHome_linux_arm64.tar.gz
cd AdGuardHome

2. First time run:
Here is where I run it for the first time to do the initial setup. This will allow us to generate our .yaml file. It will ask what listen addresses you want and what port. I chose 53 for DNS. I also set adguardhome gui port to 8081 -you can choose whatever port you want for the GUI, but DNS needs to run on 53 for this method to work.
Code:
killall -9 dnsmasq
nohup /opt/etc/AdGuardHome/AdGuardHome
The use of nohup allows it to run in the background.
minimize ssh terminal.
Initial setup is done from the browser at your routersaddress:3000

3.Place Adguard home in a path directory on entware installation:
Do this in the SSH terminal after initial setup.
Code:
killall -9 AdGuardHome
mv /opt/etc/AdGuardHome/AdGuardHome /opt/sbin/AdGuardHome

4. Make init.d file:
Code:
nano /opt/etc/init.d/S61AdGuardHome
Then paste this below script into the terminal.
Code:
#!/bin/sh
ENABLED=yes
WORK_DIR=/opt/etc/AdGuardHome
PROCS=AdGuardHome
ARGS="-c $WORK_DIR/AdGuardHome.yaml -w "$WORK_DIR" --no-check-update -l syslog"
PREARGS="nohup"
PRECMD="killall -9 dnsmasq"
POSTCMD="service restart_dnsmasq"
DESC=$PROCS
PATH=/opt/sbin:/opt/bin:/opt/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
export TZ=$(cat /etc/TZ)
. /opt/etc/init.d/rc.func
Save it and make it executable
Code:
chmod 755 /opt/etc/init.d/S61AdGuardHome

5. Make dnsmasq.postconf:
Code:
nano /jffs/scripts/dnsmasq.postconf
Then paste this below script into the terminal.
Code:
#!/bin/sh
CONFIG=$1
source /usr/sbin/helper.sh
[ "$(pidof AdGuardHome)" ] && pc_append "port=553" $CONFIG && pc_append "local=/1.168.192.in-addr.arpa/" $CONFIG
Save it and make it executable
Code:
chmod 755 /jffs/scripts/dnsmasq.postconf
The addresses in the above script need to match your router address and network.

6. Start AdGuardHome:
Code:
/opt/etc/init.d/S61AdGuardHome start

7. Setup Private reverse dns servers for private addresses:
The addresses need to match your router address. And the domain needs to match the Domain you have defined on the lan dhcp page of your router.
Code:
[/1.168.192.in-addr.arpa/]192.168.1.1:553
[/Some-Domain/]192.168.1.1:553

View attachment 37465

You will need to check box enable-
User Private Reverse DNS Servers
Enable Reverse Resolving of clients IP addresses

8. Set upstream DNS servers:
Code:
1.1.1.1
1.0.0.1
You can set these to whatever you like. Adguard home supports plain text, DoT, DoH, QUIC, and Dnscrypt.
View attachment 37466
Here is the wiki on configuration


Edits
  • Add support for dnsmasq at port 553 to run only when adguardhome is enabled, other wise use regular DNS.
  • Added pictures
  • Added Killall -9 dnsmasq to install instructions and to preargs of init.d script.
I love AdGuard would love it on my router and having trouble following all these scrips a little above my head, would i be correct in saying your installation does not need a USB plugged in, I'm using a Asus RT-AX86U with Merlin 386.3_2 installed.
Any suggestions how i start i have installed WinSCPPortable and have got into the router and that's about it, what is Entware is that required for your installation, sorry of all the dumb questions
 
This beautiful tutorial was very useful for me, thanks. I am using OpenVPN in my router with VPN Director (policy rules). Due to the processor of my router, my Internet bandwidth decreases. Therefore I have to separate my PC from the OpenVPN client. I guess DNS configuration settings in the OpenVPN client is broken because of the following script, and all DNS queries are made via WAN IP address.
Code:
iptables -t nat -I PREROUTING -i br0 -p udp -m udp --dport 53 -j REDIRECT --to-port 53535
iptables -t nat -I PREROUTING -i br0 -p tcp -m tcp --dport 53 -j REDIRECT --to-port 53535
The question of an ignorant person: Can Adguard or Diversion's DNS queries be directed to the OpenVPN client that works with policy rules, to instead of WAN IP address?
The simplest way is to use the second method, because DNS will be Adguard home set at port 53. VPN servers should already be able to have routes for Lan DNS. Other wise you would have to setup an IPtable rule that is associated with the TUN interface the VPN tunnel uses. That way you can force the Port 53 Traffic to use the 53535. This can be quite tricky because it may require you to setup routes as well.
 
Last edited:
I love AdGuard would love it on my router and having trouble following all these scrips a little above my head, would i be correct in saying your installation does not need a USB plugged in, I'm using a Asus RT-AX86U with Merlin 386.3_2 installed.
Any suggestions how i start i have installed WinSCPPortable and have got into the router and that's about it, what is Entware is that required for your installation, sorry of all the dumb questions
I recommend using a USB for this because Adguardhome grows big in size. The data folder that adguardhome stores its statistics will quickly fill JFFS. The only alternative would be to use TMP for storing it, but your statistics would be erased every reboot (that is the default method openwrt uses). My installation method uses entware which is installed to a usb drive. Entware is the package manager. The init.d script is a start stop script handled by the entware package manager. it gets started whenever entware gets started and processes it. The Adguardhome is stored on the USB as well. I recommend you install Entware using AMTM.
 
Last edited:
I recommend using a USB for this because Adguardhome grows big in size. The data folder that adguardhome stores its statistics will quickly fill JFFS. The only alternative would be to use TMP for storing it, but your statistics would be erased every reboot (that is the default method openwrt uses). My installation method uses entware which is installed to a usb drive. Entware is the package manager. The init.d script is a start stop script handled by the entware package manager. it gets started whenever entware gets started and processes it. The Adguardhome is stored on the USB as well. I recommend you install Entware using AMTM.
Thank you for the reply i already have the AdGuardHome_linux_arm64.tar.gz file unzipped and on a USB drive and i can see the the files at /mnt/USB-ASUS/AdGuardHome but the rest is quite hard to understand its a shame someone hasn't done this on YouTube.
My second router is a GL.iNet router and i have AdGuard running on that which i may have to go back to because of my lack of knowledge, its hard to follow when i don't know what I'm doing.
Thank you for you're patience and understanding
 
Are all the commands done while longed into the router if so which is the easiest to use i tried winSCP but it only allows one line commands, unless thats me :)
 
I don't think I have understood your question... or the problem.

1) I presume you are using OpenVPN Client to connect to a 3rd party VPN provider.
2) Are all clients going through OpenVPN or only selected clients going through OpenVPN (as defined in the OpenVPN director)
3) What are your VPN client 'Accept DNS settings' ? Disabled, Exclusive, etc...
4) What are you trying to achieve? Do you want that your PC (I presume operating outside the VPN tunnel) should also use AdGuard as DNS resolver or do you wish that your PC should use the DNS resolver as provided by your VPN provider?
Sorry for not explaining myself clearly.

When I set up AdGuard Home with the first method, all DNS configuration options (disabled, relaxed, strict, exclusive) in the OpenVPN client running with the "VPN Director (policy rules)" setting on my router (ax56u) are broken and they all work as "disabled". So I can't use my VPN provider's DNS server. The reason I'm telling you this is to find out if the case I just described is a problem, and if it is, to find out a solution to it. Because other users may want to use the VPN provider's DNS server.
------------------------------------------------
Edit: I fell into a strange situation. After this post, I changed the DNS configuration setting between 4-5 times "exclusive" to "disabeled". And as a result, when the DNS configuration is set to "exclusive", the Devices in the Policy rules were connected to the VPN's DNS server. I think after the Adguard Home installation, my router was confused. :rolleyes:
------------------------------------------------
I, on the other hand, want all my devices connected to my router (guest, those included in the OpenVPN policy rules, and those using the WAN) to use AdGuard Home. But in this case, the geographic location of the DNS server (Cloudflare anycast) becomes the country where my ISP is located. As far as I understand, AdGuard Home connects to the DNS server written in its settings with WAN IP. Instead, is it possible for all devices (guest, those included in OpenVPN policy rules, and those using the WAN) connected to my router that use AdGuard Home's DNS settings to query for example with the IP address in OpenVPN Client 1? Or can this be done for devices in OpenVPN Client 1 only?

The simplest way is to use the second method, because DNS will be Adguard home set at port 53. VPN servers should already be able to have routes for Lan DNS. Other wise you would have to setup an IPtable rule that is associated with the TUN interface the VPN tunnel uses. That way you can force the Port 53 Traffic to use the 53535. This can be quite tricky because it may require you to setup routes as well.

Thanks for your response and explanation. The setup you're talking about looks like something a regular user like me can't do.
 
Last edited:
Sorry for not explaining myself clearly.

When I set up AdGuard Home with the first method, all DNS configuration options (disabled, relaxed, strict, exclusive) in the OpenVPN client running with the "VPN Director (policy rules)" setting on my router (ax56u) are broken and they all work as "disabled". So I can't use my VPN provider's DNS server. The reason I'm telling you this is to find out if the case I just described is a problem, and if it is, to find out a solution to it. Because other users may want to use the VPN provider's DNS server.
------------------------------------------------
Edit: I fell into a strange situation. After this post, I changed the DNS configuration setting between 4-5 times "exclusive" to "disabeled". And as a result, when the DNS configuration is set to "exclusive", the Devices in the Policy rules were connected to the VPN's DNS server. I think after the Adguard Home installation, my router was confused. :rolleyes:
------------------------------------------------
I, on the other hand, want all my devices connected to my router (guest, those included in the OpenVPN policy rules, and those using the WAN) to use AdGuard Home. But in this case, the geographic location of the DNS server (Cloudflare anycast) becomes the country where my ISP is located. As far as I understand, AdGuard Home connects to the DNS server written in its settings with WAN IP. Instead, is it possible for all devices (guest, those included in OpenVPN policy rules, and those using the WAN) connected to my router that use AdGuard Home's DNS settings to query for example with the IP address in OpenVPN Client 1? Or can this be done for devices in OpenVPN Client 1 only?



Thanks for your response and explanation. The setup you're talking about looks like something a regular user like me can't do.

The easiest way is to do what @SomeWhereOverTheRainBow has suggested and follow up on instructions in his post 3.
I have updated my original post to reflect that post 3 is a better overall solution.
 
I recommend using a USB for this because Adguardhome grows big in size. The data folder that adguardhome stores its statistics will quickly fill JFFS. The only alternative would be to use TMP for storing it, but your statistics would be erased every reboot (that is the default method openwrt uses). My installation method uses entware which is installed to a usb drive. Entware is the package manager. The init.d script is a start stop script handled by the entware package manager. it gets started whenever entware gets started and processes it. The Adguardhome is stored on the USB as well. I recommend you install Entware using AMTM.
i wonder if you could posible get me started as i feel most ifs obvious to the technical minded and i'm starting from scratch i understand the need for the usb because of the room AdGuard requires the space still a little baffled as the beginning script looks as if it ifs fetching the AdGuard but putting it where.
I am using a PC not a mobile device so which is the best terminal program to use.
I really would like to install AdGuard if possible its a shame its not installed by Asus-Merlin by default.
I am using a VPN client so i know that normally causes 2 DNS address when using a Leak test well on a GL.iNet router so how does it perfom on the Asus.
 
Update i have got into the router with PuTTY and formatted the drive as recommended EXT4 is that correct, so slowly getting there

 
i wonder if you could posible get me started as i feel most ifs obvious to the technical minded and i'm starting from scratch i understand the need for the usb because of the room AdGuard requires the space still a little baffled as the beginning script looks as if it ifs fetching the AdGuard but putting it where.
I am using a PC not a mobile device so which is the best terminal program to use.
I really would like to install AdGuard if possible its a shame its not installed by Asus-Merlin by default.
I am using a VPN client so i know that normally causes 2 DNS address when using a Leak test well on a GL.iNet router so how does it perfom on the Asus.
Yes these guides are provided as is, for those of technical mind and have entware already setup on a usb device.( use the forums to determine how to setup entware).

"cd /opt/etc" places the ssh command line at the location of /opt/etc which is a directory of entware package manager. The wget command downloads the compressed folder to this location. The tar command uncompressed the folder to this location. An additional cd AdguardHome then moves your command line to the newly uncompressed folder while the rm -rf removes the compressed folder from the /opt/etc location.I don't know how much more simpler this can be explained, but that is how I understand it.
 
Last edited:
Yes these guides are provided as is, for those of technical mind and have entware already setup on a usb device.( use the forums to determine how to setup entware).

"cd /opt/etc" places the ssh command line at the location of /opt/etc which is a directory of entware package manager. The wget command downloads the compressed folder to this location. The tar command uncompressed the folder to this location. An additional cd AdguardHome then moves your command line to the newly uncompressed folder while the rm -rf removes the compressed folder from the /opt/etc location.I don't know how much more simpler this can be explained, but that is how I understand it.
Ok i do appreciate you’re help give me a few days as I’ve ordered a low profile 32mb USB 3.1 drive so it don’t stick out a mile, in the meantime I will find how to install entware and go from there, I will gladly send you some money for a drink and for your trouble, once all that is done I will pop back.
 
OK received my usb and formatted it in ex4 and 64bit Entware is that correct

Entware.PNG
 
@SomeWhereOverTheRainBow I think the method shown in the following link can do what I want from you in this title. Am I thinking wrong?
 
I'm trying to install this on a RT-AC87u. But none of the guides work. When doing the first method, it fails after running the S99 thing.
The second method (post 3) after running the nohup command, nothing happens when I go to my routers ip on port 3000, nothing loads.

Any suggestion?
 
Last edited:
I'm trying to install this on a RT-AC87u. But none of the guides work. When doing the first method, it fails after running the S99 thing.
The second method (post 3) after running the nohup command, nothing happens when I go to my routers ip on port 3000, nothing loads.

Any suggestion?
Make sure you are using the correct adguardhome that corresponds to your router architecture. (The RTAX-88u works with arrch64 i.e. armv8).
Screenshot_20211221-123338_Samsung Internet.jpg


Make sure you are following/(and understanding) each step of the guide before attempting any of the steps. If you have confusion, ask for any missing clarification.
 
Last edited:

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top