AdGuardHome [RELEASE] Asuswrt-Merlin-AdGuardHome-Installer (AMAGHI)

[SomeWhereOverTheRainBow]

Asuswrt-Merlin-AdGuardHome-Installer​

The Official Installer of AdGuardHome for Asuswrt-Merlin

Requirements:​

• ARM based ASUS routers (not bridges or access points) that use Asuswrt-Merlin Firmware
• JFFS support and enabled
• REQUIRES ENTWARE(!) for package management, and a separate USB drive for storage -i.e. the same drive Entware is stored.
• Entware must be fully up-to-date as well opkg update && opkg upgrade
• Minimum Recommended to have a 2gb swap file. (up to 10gb can be made with AMTM).
• Minimum Supported Firmware Version is 384.11.
• It is Recommended to use a Router stronger than the RT-AC68U, even though the AdGuardHome can be used at a limited capacity on the RT-AC68U.

Incompatibilities:​

• No known issue, but may not be compatible with "some" doule-nat or dual-wan environments since AdGuardHome takes over DNSMASQ placement on port 53. DNSMASQ uses port 553 instead.

Current features:​

• AdGuardHome Network-wide ads & trackers blocking DNS server, with multiple dns protocol encryption, and other features.
• Support ARM based routers
• Redirect all DNS queries on your network to AdGuardHome if user chooses to use Merlin DNS Filter Option
• Ability to update AdGuardHome without reinstalling/reconfiguring
• Improved Installer/Update/Backup Functions.

AdGuardHome Supports Multiple Features​

• 94.140.14.140: plain DNS (over UDP).
• tls://dns-unfiltered.adguard.com: encrypted DNS-over-TLS.
• https://cloudflare-dns.com/dns-query: encrypted DNS-over-HTTPS.
• quic://dns-unfiltered.adguard.com:784: experimental DNS-over-QUIC support.
• tcp://1.1.1.1: plain DNS (over TCP).
• sdns://...: DNS Stamps for DNSCrypt or DNS-over-HTTPS resolvers.
• [/example.local/]1.1.1.1: DNS upstream for specific domains, see below.

A good list of dns servers and how to use them can be found in this post :

AdGuardHome - [RELEASE] Asuswrt-Merlin-AdGuardHome-Installer (AMAGHI)

Sounds like the guide that may have been needed was the Step-by-Step amtm guide, in the link in my signature below. :)

www.snbforums.com

Setting Up Your Routers Reverse DNS​

• Under Lan DHCP page on Asuswrt-Merlin define a domain such as lan or some-domain like in the image above.

• Define the appropriate rules inside the Private Reverse DNS Servers.
• It should be noted that the Some-Domain line should be placed in the upstream DNS section.

Changelog:​

https://github.com/jumpsmm7/Asuswrt-Merlin-AdGuardHome-Installer/commits/master

Install/Update/Reconfig/Uninstall:​

Run this command from ssh shell and following the prompt for AdGuardHome:

curl -L -s -k -O https://raw.githubusercontent.com/jumpsmm7/Asuswrt-Merlin-AdGuardHome-Installer/master/installer && sh installer

Terminal Commands supported by AdGuardHome​

Traditional Commands:

/opt/etc/init.d/S99AdGuardHome {start|stop|restart|check|kill|reload}

New Supported Commands (recommended commands):

service {start|stop|restart|kill|reload}_AdGuardHome

How to check if it works​

Run this command in the ssh shell:

pidof AdGuardHome

will return a number.
or

/opt/etc/init.d/S99AdGuardHome check

which will return

 Checking AdGuardHome...              alive.

Spoiler: *Disclaimer*

1. While this is an ad-blocker just like Diversion, for all intensive purposes it shall be treated as an alternative and not a replacement. Diversion will continue to function as is.
2. This script is not intended to be run on Access Points or Bridges.
3. While browser adblocking can benefit along side AdGuardHome, AdGuardHome is meant to be your only DNS ad-blocking solution, support will not be provided for missconfigurations involving more than one DNS ad-blocking solution.
4. This script is only intended to install AdGuardHome as a basic local DNS service on an Asuswrt-Merlin router running in router mode, any extra configurations or missconfigurations on your part are beyond the scope of this installer.
5. This script does not install/configure AdGuardHome as a Remote DoH,DoT,DoQ, or Dnscrypt DNS server.
6. Feel free to use this thread to share information with each other.

 

[SomeWhereOverTheRainBow]

AdGuardHome-Unbound-Manager Guide:

Many thanks to @Martineau , & Install Unbound-Manager using easy-mode. No need for installation of any of the extra unbound features such as statistics, unbound-adblock, dot integration, or dns-firewall:

Unbound-Asuswrt-Merlin/Readme.md at master · MartineauUK/Unbound-Asuswrt-Merlin

Install and manage unbound (Recursive DNS) on Asus routers - MartineauUK/Unbound-Asuswrt-Merlin

github.com

Alternatively Users can choose to integrate using @dave14305 beautiful Unbound-Merlin-UI :

GitHub - dave14305/Unbound-Merlin-UI: ASUSWRT-Merlin Unbound User Interface

ASUSWRT-Merlin Unbound User Interface. Contribute to dave14305/Unbound-Merlin-UI development by creating an account on GitHub.

github.com

Just to recap for future user confusion:

Here is everything @xmanyes changed to make unbound-manager compatible (or simply unbound) for AdGuardHome upstream

For those who cry without having an IPV6 upstream:

Additional Notes:

Port 53535 may be different with @dave14305 port number which can be cleanly modified from Unbound-Merlin-UI. Please adapt port according to what your unbound port is actually set to.

Boot Strap Resolvers:

These are for specifically initializing DoH/DoT encryption. These must be set to a real DNS address, leaving them as the default ones is perfectly acceptable!.

Private Reverse DNS Servers:

These are already preconfigured by the installer to allow for easy client name resolution with Asuswrt-Merlin Routers. They point back to DNSMASQ which handles DHCP for the network. It is highly recommended not changing the defaults unless you know what you are doing or do not care about client name resolution.

 

[SomeWhereOverTheRainBow]

To configure Guest Networks without YazFi:

AdGuardHome - [RELEASE] Asuswrt-Merlin-AdGuardHome-Installer (AMAGHI)

Here is how you tell if your traffic is going by way of encrytion, Hover your mose over the ? mark next to the processed query. (not the question mark by the IP address). Thumbs up for this great tip!

www.snbforums.com

an example of some of the addresses for guestnetworks done by the router

dhcp-range=br1,192.168.101.2,192.168.101.254,255.255.255.0
dhcp-option=br1,3,192.168.101.1
interface=br2
dhcp-range=br2,192.168.102.2,192.168.102.254,255.255.255.0
dhcp-option=br2,3,192.168.102.1

What you need to add to dnsmasq.conf.add:

dhcp-option=br1,6,192.168.101.1,192.168.101.1

dhcp-option=br2,6,192.168.102.1,192.168.102.1

DNS enforcement would look like this (add these to firewall-start script):

iptables -t nat -A PREROUTING -p tcp -m tcp --dport 53 -i br1 -j DNAT --to-destination 192.168.101.1
iptables -t nat -A PREROUTING -p udp -m udp --dport 53 -i br1 -j DNAT --to-destination 192.168.101.1
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 53 -i br2 -j DNAT --to-destination 192.168.102.1
iptables -t nat -A PREROUTING -p udp -m udp --dport 53 -i br2 -j DNAT --to-destination 192.168.102.1

To configure with YazFi:

AdGuardHome - [RELEASE] Asuswrt-Merlin-AdGuardHome-Installer (AMAGHI)

Now, I'm using v1.0.3. Do I need to update to latest version or just use that version?

www.snbforums.com

You change the DNS address to reflect the first address of the network. For example, if 192.168.2.0/24 is the network, the address would be 192.168.2.1.

Additionally, if directing the guest network to a VPN server using Yaz-Fi, you must set the "VPN Accept DNS" method to disabled. The below illustrates how:

Otherwise the vpn server will force its DNS to clients instead of allowing AdGuardHome as the only DNS.

If you are still interested in using the DNS servers of the VPN provider, just put the vpn dns server addresses in the upstream section of AdGuardHome, otherwise it will travel to the designated DNS servers placed in the upstream section of adguardhome, but it will travel via way of vpn server.

Scribe Integration:

@Markfree has shared a quick and easy way to integrate AdGuardHome with scribe.

AdGuardHome - AdGuard Home fails to start after reboot

Thanks for the quick replys. I've updated AdGuard with your latest patch. Now, lets wait and see if it fails to start again. Maybe there's some misconfiguration on my part, but I'm not seeing it. I've shared AdGuardHome.yaml so you can have a look. @Markfree I know it has been a minute since...

www.snbforums.com

However sed command will have to be rerun every time the installer update option is ran because the S99 file for AdGuardHome is dynamically replaced on updates... At least until I have time to add this as a feature to the installer.

 

[thelonelycoder]

amtm support is coming soon to a router near you…

 

[Jack Yaz]

amtm support is coming soon to a router near you…

I think we're going to need a Diversion vs Adguard comparison

 

[SomeWhereOverTheRainBow]

I think we're going to need a Diversion vs Adguard comparison

Pages load slower with Adguardhome, but less memory footprint. That is my for what its worth analysis.

 

[johndoe85]

Pages load slower with Adguardhome, but less memory footprint. That is my for what its worth analysis.

How is the efficiency in comparison other than slower web page load and lower memory footprint?

Is it better at blocking ads? Or same same?

 

[thelonelycoder]

I think we're going to need a Diversion vs Adguard comparison

I have not had the time to really look at the WebUI but it looks nice. And Diversion is sitting on that test router, waiting in vain for something to do.

 

[BreakingDad]

I currently run adguard on a pi4, you think the performance would be better on a standalone pi or adding to the router?

Great work btw, hope this is added to amtm.

 

[BreakingDad]

Pages load slower with Adguardhome, but less memory footprint. That is my for what its worth analysis.

When you say slower, can you be more specific ? On my pi based adguard I get an average processing time of 31ms with literally all the filters and parental controls on.

 

[thelonelycoder]

Great work btw, hope this is added to amtm.

I‘m the one that gently asked the devs last Friday for this threads installer script to be coded - in the hope that I can add support in amtm.

Things got very busy very quickly behind the scene. The AdGuardHome install script is released, now I have to code my part of the deal.
I‘m about 85% done.

 

[SomeWhereOverTheRainBow]

When you say slower, can you be more specific ? On my pi based adguard I get an average processing time of 31ms with literally all the filters and parental controls on.

refresh times and query times. it takes longer to load webpages because of the filtering methods. it doesn't imply the ad-blocking isn't good. For example, in comparison with pihole and diversion, I have gotten marginally faster query times with pihole and diversion.

 

[SomeWhereOverTheRainBow]

I currently run adguard on a pi4, you think the performance would be better on a standalone pi or adding to the router?

Great work btw, hope this is added to amtm.

I imagine it would be. Much faster response times on the router. The only difference is, you may get away with a larger filter size on the rpi than the router. I haven't tested this aspect out yet.

 

[johndoe85]

I imagine it would be. Much faster response times on the router. The only difference is, you may get away with a larger filter size on the rpi than the router. I haven't tested this aspect out yet.

Why or how could it be much faster response time on the router? If the raspberry pi (4) is at your lan it should only add 1-2ms, right?

 

[SomeWhereOverTheRainBow]

Why or how could it be much faster response time on the router? If the raspberry pi (4) is at your lan it should only add 1-2ms, right?

Like I said, still needs testing. I am looking for the many entrepreneurs of the forum to help fill in those gaps. If you feel up to the challenge, let us know. I imagine the response times will be faster, but that is still yet to be tested.

 

[ComputerSteve]

is there a way to setup a way to bypass Adguard for certain clients like with Diversion.

 

[thelonelycoder]

Support for Asuswrt-Merlin-AdGuardHome-Installer has been added to amtm

Use u in amtm to update to its latest version 3.2.3

 

[SomeWhereOverTheRainBow]

is there a way to setup a way to bypass Adguard for certain clients like with Diversion.

Dnsfilter on asuswrt-merlin or using iptables. You can also leverage aguardhome to control what (if any) filters get used by the in question client. As far as I know you could send the client through adguardhome and define a ruleset for it that makes it use no filters. Or simply use dnsfilter on asuswrt-merlin to make it completely bypass adguardhome altogether.

Visit the adguardhome wiki to see all that adguardhome is capable of

Home

Network-wide ads & trackers blocking DNS server. Contribute to AdguardTeam/AdGuardHome development by creating an account on GitHub.

github.com

 

[BreakingDad]

Support for Asuswrt-Merlin-AdGuardHome-Installer has been added to amtm

Use u in amtm to update to its latest version 3.2.3

wow two amtm updates in 1 day impressive.

 

[zekesdad]

This exits with an error for me: pastebin.com/igTC64Jn

Seems like it thinks I'm not using a compatible router maybe? I don;t know though, Im on an RT-AX86U with 386.4 fw.