RPi + AdGuard Home + Unbound (optional) Worksheet

Dec 20

THE TUTORIAL IS MEANT TO BE USED WITH THIS VIDEO!

YouTube tutorials can be a pain to actually follow, so here’s the worksheet that accompanies the video - for your convenience.

I recommend both printing this out, to use as a checklist, and keeping the page up, so you can copy-and-paste the entries.

What you need:

A Raspberry Pi 3B/3B+/4/5 (wired Ethernet recommended)
A microSD card (8GB, or larger)
A microSD reader (or SD, with an adapter)
Another computer to flash the SD card (Windows/macOS/Linux)
Admin access to your router (if you want to use the AdGuard Home automatically across your entire network)

STEP 1: Flash Raspberry Pi OS to the microSD card

o Download & install Raspberry Pi Imager (from raspberrypi.com) on your computer

o In Raspberry Pi Imager:

1. Device: Select the type of Raspberry Pi you’re going to use

2. OS: Select Raspberry Pi OS (64-bit)

3. Storage: Select microSD card (assuming it’s in a reader, attached to your system)

4. Hostname: Enter a hostname, AdGuardHome-1, in my case. Record your hostname here: ______________

5. Localization: Select your country’s capital city, time zone, and keyboard layout

6. User: Create a username, netserv, in my case, and a password. Record the username and password here: _____________/_____________

7. WiFi: Skip this, because you’re using wired Ethernet, right? RIGHT?

8. Remote Access: toggle Enable SSH to On, and set it to using password authentication

9. Raspberry Pi Connect: Disable

o Write (6 minutes) and verify (4 minutes). Eject the card

o Insert the card into the Pi, plug in Ethernet (preferred), then power it on (wait a minute or two to let it boot up)

o Find its IP (e.g., via your router’s client list or ping adguardhome-1 or whatever you named it in #4). Record this IP address HERE: __________________

STEP 2: Updating the Raspberry Pi

Connect to your RPi via SSH

open a terminal window on your Windows computer, WIN + R > cmd > Enter

[copy/paste >] ssh USERNAME@IP_ADDRESS_OF_RPi

(for example: ssh netserv@192.168.0.13)

Enter password from step 1, #6

[copy/paste >] sudo apt update && sudo apt full-upgrade -y

[copy/paste >] sudo apt install -y dnsutils

STEP 3: Give the Raspberry Pi a static IP address

Reserve the Pi’s IP in your router’s DHCP, usually by creating a DHCP reservation or converting an existing DHCP lease into a reservation

Set a static IP address with nmcli (outside of the scope of this tutorial, but feel free to comment for help)

STEP 4: Install the latest AdGuard Home

Start AdGuard Home’s official installer, from SSH, with:

[copy/paste >] curl -s -S -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sudo sh

Verify installation has no errors, from SSH, with:

[copy/paste >] sudo systemctl status AdGuardHome --no-pager

Complete setup in web browser:

Navigate to your AdGuard Home’s IP, port 3000 - for example: http://192.168.0.13:3000
Click “Get Started”
Scroll down, click “Next”
Create a username and password. Record them here: _________/___________ these are the credentials you will use to log into AdGuard Home’s web interface
Click “Next”
Click “Next”
Click “Open Dashboard”
Enter credentials from #4, click “Sign In”
NOTE: Subsequent logins to the AdGuard web interface will just be the IP in the browser address, without port 3000

STEP 5: Set your router to use AdGuard Home

On your router (generic steps):

1. Go to LAN or DHCP settings

2. Find DNS server fields for DHCP clients

3. Set Primary DNS = your AdGuard Home IP (e.g., 192.168.0.13)

4. Leave Secondary DNS blank to force clients to use AdGuard Home

5. Save/apply

6. Reboot one client device or renew its DHCP lease

Confirm it’s using AdGuard Home:

Visit http://AdGuard Home IP/ > DNS Queries to see requests

(e.g. http://192.168.0.13/)

On a client (from console window - shows the server it used):

[copy/paste >] nslookup dad-the-engineer.com

STOP HERE - YOU HAVE ADGUARD HOME HANDLING YOUR WHOLE NETWORK NOW!

STEP 6: Adding Unbound & configuring AdGuard Home to use Unbound (OPTIONAL)

Install Unbound, from SSH:

[copy/paste >] sudo apt update

[copy/paste >] sudo apt install -y unbound

Minimal privacy-focused Unbound config

[copy/paste >] sudo nano /etc/unbound/unbound.conf.d/adguardhome.conf

copy from here>

server:
  # Listen only on localhost (AdGuard Home will query it locally)
  interface: 127.0.0.1
  port: 5335

  # Security / hardening
  do-ip4: yes
  do-ip6: yes
  do-udp: yes
  do-tcp: yes

  hide-identity: yes
  hide-version: yes

  harden-glue: yes
  harden-dnssec-stripped: yes
  harden-referral-path: yes

  # DNSSEC validation
  #auto-trust-anchor-file: "/var/lib/unbound/root.key"
  val-clean-additional: yes

  # Performance
  cache-min-ttl: 300
  cache-max-ttl: 86400
  prefetch: yes
  prefetch-key: yes

<to here, and paste it into nano

Exit (Control-X) and Save (yes)

Enable & restart:

[copy/paste >] sudo systemctl enable unbound

[copy/paste >] sudo systemctl restart unbound

[copy/paste >] sudo systemctl status unbound --no-pager

Test Unbound directly on the Pi:

[copy/paste >] dig @127.0.0.1 -p 5335 example.com

Point AdGuard Home to Unbound (as upstream):

Log into AdGuard Home Web UI > DNS Settings > Upstream DNS Servers:

[copy/paste >] 127.0.0.1:5335

The next line should be specify your router’s IP address

[copy/paste >] [/*.localdomain/]192.168.0.1

Click APPLY

Verify in AdGuard Web UI:

Check Dashboard - Top upstreams to confirm queries go to 127.0.0.1:5335

STOP HERE - YOU HAVE UNBOUND HANDLING DNS RESOLUTION FOR AdGuard Home NOW!

STEP 7: Using two AdGuard Home instances in high-availability configuration with automatically synchronized configurations

Maintenance and Backup

Update AdGuard Home from the UI (shows in the banner, when available)

Update Raspberry Pi OS (Monthly)

sudo apt update && sudo apt upgrade -y

sudo reboot

Backup Your AdGuard Home config (after changes)
Backup the AdGuardHome.yaml file in /opt/AdGuardHome
Review Query Logs (Monthly)
Check Blocklists (Every 2–3 Months)
Clean Up the Query Log (Optional, Every Few Months)
Go to Settings > Logs & Statistics
Adjust retention (7–30 days is plenty)
Clear logs if needed
Reboot the Pi Occasionally (Every Few Months)

If you want this video, let me know in the video’s comments!

Dad, the Engineer

RPi + AdGuard Home + Unbound (optional) Worksheet

Maintenance and Backup

Breaking the law?

Success?