OpenWrt AdGuard Home 101 ( DNSMASQ )

Back here one more again - but as you well know, before we can get to the " get-go " - we must indulge ourselves with the time honored tradition of " The Intro " - check out a Soul Classic - and as always lyrics - - and to keep the Groove flowing at the outset - Bounce - - for the lyrical - / OK - now that the foundation has been laid - let us proceed.

AdGuardHome works flawlessly with both OpenVPN and WireGuard protocols.
No need for firewall rules or port forwarding with this set up. It works " as is "
right " OUT THE BOX ".

Attention : From OG Poster ( brokenpipe )
!!!! It is possible to install AdguardHome under /opt/,
but this directory can grow. Old binaries are moved as
backup after an update. blocklists can become relatively large. It is better
to move AdGuardHome to a USB stick. So it will survive
future OpenWRT updates !!!!
That Means Setup Exroot for your AdGuardHome Install If At All Possible

Here is a great deal on 4gb USB 3.0 Drives -
Made and Shipped In The Good Ole' USA :


Yo ! : I strongly suggest that you watch this video before you begin. Although lengthy - it is very informative and worthwhile. Van Tech Corner OpenWRT AdGuard Home You also will be able to follow this guide much better - as a ( moving ) picture is worth a thousand words. Follow directions carefully - you will have AdGuard Home up and running on OpenWRT by the end of this guide / tutorial. The setup uses DNSMASQ. I will write up a guide / tutorial incorporating Unbound with AdGuard Home in a soon to be released tutorial.

1 - First you will need to get the appropriate AdGuard Home package for your router's architecture. For example, I have WRT3200ACM, WRT32x, Wrt1900ACS V2, WRT1200AC, and NightHawk R7800. All of these have ARMv7 processors. You should find out your architecture before proceeding. Now there is a script on AdGuard Home - found here - However, I have never been able to get the automatic download and install script to work properly. So, I manually download and install AdGuard Home on OpenWRT, because this method is GUARANTEED ! to work.

In order to find your router's Architecture - go to Luci > Status > 
Overview then under System - on the third line down underneath 
Model ( indicating your router )

You will find your router's Architecture - for the router 
I am currently running for example these are the entries below :

Model     Netgear Nighthawk X4S R7800
Architecture   ARMv7 Processor rev 0 (v7l)
Target Platform   ipq806x/generic

You can also enter command below :

# cat /proc/cpuinfo    

or you can install hwinfo / opkg update && opkg install hwinfo
and issue command below :

# hwinfo         

### this will render all the specs for your router - 
look at the beginning of readout for CPU

2 - There are two channels to download AdGuard Home - Beta and Edge. The consensus on the thread - found here: [HowTo] Running Adguard Home on OpenWrt is to run Edge. As I mentioned earlier, make sure that you download the correct AdGuard Home package for your router's processor. In my case that is the following link - - notice that edge is named in the link.
A - Just copy and paste your correct link in your browser from this section of AdGuard Home - after downloading - you will have AdGuardHome_linux_armv7.tar.gz on your desktop. Create a folder - and use WinRAR, 7Zip, PeaZip or some such file archiver to unzip AdGuardHome_linux_armv7.tar.gz ( remember to choose the proper package for your router ). You will now have a decompressed folder named " AdGuardHome " .

AdguardTeam / AdGuardHome GitHub Home Page Downloads

First, Install These Packages To Get Started - The Main One Needed is sudo - otherwise you will not be able to install AdGuardHome successfully - as always # opkg update

opkg update ; opkg install ca-certificates ca-bundle sudo libustream-mbedtls libustream-openssl libwolfssl libustream-wolfssl luci-ssl px5g-wolfssl wpad-basic-wolfssl luasocket curl libevent2-7 haveged unzip ip-full curl wget libmbedtls12 tar tcpdump-mini bind-tools

3 - Now we are going to use WINSCP, but first we need to create the default proper directory for AdGuard Home installation. Go into SSH shell - enter command :

A - # mkdir -p /opt/
B - After creating directory, fire up WINSCP - open /opt/ directory 
on the right side of the application - then Drag & Drop the AdGuardHome 
decompressed folder from the directory you had it in on your desktop. 
If you know how to use SCP on OpenWRT ( Linux ) you may use 
that method here as well. After closing WINSCP  - then issue this command 
C - #  chmod 755 /opt/AdGuardHome/AdGuardHome   ## and then 
enter next command for installation of AdGuardHome
D - # /opt/AdGuardHome/AdGuardHome -s install

You should be seeing something like below. Naturally you may see a different IP Address depending on your network interfaces - but you must use the LAN for initial AdGuardHome Configuration - here it is :


Major Revision To This Guide / Tutorial
Rationale For Major Revision To This Guide / Tutorial
Read Post # 24 in this thread from mercygroundabyss below :

By using AGH on Port 5353 this routing behavior is put into effect :

Because you are double looking up (  DNS queries - with  AGH on Port 5353 ). 
By making AGH the primary DNS ( meaning AGH on Port 53 ) AGH looks upstream 
for whatever provider you set AGH up with (and uses encrypted DNS and DNSSEC), 
and ( AGH ) looks downstream to DNSMASQ for internal DHCP addresses.

By having DNSMASQ on port 53 and AGH on port 5353 you introduce another 
hop to DNS and repeat effort. Also it doubles the load on your router 
and increases memory use as DNSMASQ forks for every request.

Once again forgive the error and let's move on.

E - After installing AdGuardHome, and Prior to Configuring AdGuardHome via WEBGUI we must
FIRST set up our router properly for AdGuardHome with DNSMASQ on port 5353 .

In order to do so, enter these commands below via SSH :

Modified From Mercygroundabyss AGH Installation 
Script found here :

## First Move DNSMASQ To Port 5353 - As always you must substitute your actual 
## LAN IP Address where you see the one used in this example - i.e.

1 - uci set dhcp.@dnsmasq[0].cachesize='1000'
2 - uci set dhcp.@dnsmasq[0].noresolv='1'
3 - uci add_list dhcp.@dnsmasq[-1].server=''  ## Substitute Your Actual LAN IP Address
4 - uci set dhcp.@dnsmasq[0].port='5353'
5 - uci set dhcp.@dnsmasq[0].rebind_protection='0'

6 - uci -q delete dhcp.lan.dhcp_option
7 - uci -q delete dhcp.lan.dns
8 - uci add_list dhcp.lan.dhcp_option='6,'   ## DHCP option 6: which DNS (Domain Name Server) 
##to include in the IP configuration for name resolution
9 - uci add_list dhcp.lan.dhcp_option='3,'   ##DHCP option 3: default router or last resort gateway for this interface
10 - uci add_list dhcp.lan.dns='::1'   #IPv6 Announced DNS
11 - uci set dhcp.lan.leasetime='24h' #24hr DHCP Leases
12 - uci set dhcp.@dnsmasq[0].dnsforwardmax=1024  ## Stop your network from crashing due to exceeding DNS Queries Limit

# Configure DNS provider
13 - uci -q delete network.wan.dns
14 - uci set network.wan.dns=''   ## Set WAN IPV4 DNS to Cloudflare

# Configure IPv6 DNS provider
15 - uci -q delete network.wan6.dns
16 - uci set network.wan6.dns='2606:4700:4700::1111 2606:4700:4700::1001'   ## Set WAN IPV6 DNS to Cloudflare 

# Disable peer ISP DNS
17 - uci set network.wan.peerdns="0"
18 - uci set network.wan6.peerdns="0"

##  Save Changes
19 - uci commit dhcp
20 - uci commit network

# Restart Network + DNSMASQ Service to Reflect Changes
21 - /etc/init.d/network restart
22 - /etc/init.d/dnsmasq restart

F - Now - we can configure AdGuardHome via WEBGUI. Enter LAN IP Address in your browser
in this example it is as depicted on my initial installation of AGH
as shown above. You must choose your LAN Address For Web Interface - Port 8080 - and then
Choose LAN Address For DNS - and Leave LAN on Default DNS Port 53

H - Configure AdGuardHome via AdGuardHome.yaml for DNSMASQ

We will edit the sections listed below
( a ) upstream_dns: ( b ) bootstrap_dns: ( c ) all_servers: and ( d ) filters:
( e ) dns: ( bind_hosts:
From mercygroundabyss : Only other gotcha is to manually edit the interfaces (because they will bind to the WAN side for DNS as well - I really should PR that) so manually editing the yaml file once it is up is needed.
Enter the command below and edit file as detailed here :

# nano /opt/AdGuardHome/AdGuardHome.yaml

1 - Enter the following below ( these entries cover dns: ( bind_hosts: ), upstream_dns, 
bootstrap_dns and sets AdGuardHome DNS in parallel mode )

web_session_ttl: 720
  -  # enter your LAN IP ADDRESS HERE
  - ::1
  port: 53

  - quic://
  - quic://
  - quic://
  - quic://
  - quic://
  - quic://
  - quic://
  - quic://
  - quic://
  - quic://
  - tls://
  - tls://
  - tls://
  - tls://
  - tls://
  - tls://
  - tls://
  - tls://
  - tls://
  - tls://
  - tls://
  upstream_dns_file: ""
  - 2606:4700:4700::1112
  - 2606:4700:4700::1002
  all_servers: true

If you use Encryption - where you enter your own valid SSL certificates chain for your domain
then for bootstrap_dns: entry you may enter something like this below for DOT Bootstrap DNS :

  - 2606:4700:4700::1112:853
  - 2606:4700:4700::1002:853
  all_servers: true

Cloudflare Alternative DNS SERVERS
Two Flavors: (No Malware) & (No Malware or Adult Content

See Here Below : for Families

Above I used Cloudflare with Malware Blocking DNS - if you prefer
Cloudflare Plain DNS then it is :

  - 2606:4700:4700::1111
  - 2606:4700:4700::1001
  all_servers: true

and for Cloudflare Plain DOT Servers using Encryption -
where you enter your own valid SSL certificates chain for your domain :

  - 2606:4700:4700::1111:853
  - 2606:4700:4700::1001:853
  all_servers: true

2  - Enter the following below for filters 

- enabled: true
  name: AdGuard DNS filter
  id: 1
- enabled: true
  name: 1Hosts (Lite)
  id: 1635566025
- enabled: true
  name: Scam Blocklist by DurableNapkin
  id: 1625359388
- enabled: true
  name: Energized Basic Protection
  id: 1625359389
- enabled: true
  id: 1625359390
- enabled: true
  name:  -
  id: 1625359391
- enabled: true
  name:  - EasyPrivacy
  id: 1625359393
- enabled: true
  id: 1625359392
user_rules: []

3 - From Original Post [HowTo] Running Adguard Home on OpenWrt

Adguard Home Regex:
Those are really good regex rules which already block 50% of all ads/trackers/bots etc.

You have to add the to  
( as per this example - use your actual LAN IP )

Configure Via /opt/AdGuardHome/AdGuardHome.yaml :

nano /opt/AdGuardHome/AdGuardHome.yaml


Special thanks to Mercygroundabyss once again for this information below :

The following settings allows AGH to pull 
client info from OpenWRT's DNSMASQ .

Configure Reverse DNS on AGH

/opt/AdGuardHome/AdGuardHome.yaml settings for this feature :

resolve_clients: true
  use_private_ptr_resolvers: true

After configuring AdGuardHome via AdGuardHome.yaml
one or both of the commands below :

a - # /etc/init.d/AdGuardHome restart
b - # /etc/init.d/dnsmasq restart

I - If encryption is enabled, AdGuard Home admin interface will work over HTTPS,
and the DNS server will listen for requests over DNS-over-HTTPS and DNS-over-TLS.

For Encryption = Go To Top of AdGuardHome WEB GUI -
Settings > Encryption settings the follow instructions
( 1 ) - enable Encryption - check the Box
( 2 ) - Fill in full server name such as this example - from my tutorial below :


( 3 ) Certificates
In order to use encryption, you need to provide a valid SSL certificates chain for your domain.
You can get a free certificate on or you can buy it from one of the trusted Certificate Authorities.If you follow my tutorial above you can issue yourself a LetsEncrypt Certificate cost free.Cross referencing my tutorial above your certificate and key would be the following below :

a - /root/
b - /root/


You have the option to " set the path " ( use a & b above ) or copy and paste them into the appropriate boxes found at the bottom of Encryption settings page.

You must move Luci to different port than 443 see commands below :

# nano /etc/config/uhttpd

        list listen_https ''
        list listen_https '[::]:1443

You may now log into Encrypted AdGuardHome WEB GUI -
this option is available by entering the following ( from example above ) :  - with Encryption Enabled

you will see " green padlock " when logging in / your certificate pulls double duty.

Since you moved OpenWRT Admin Port to Port 1443 you may still log into your Luci Encrypted WEBGUI at :  

In order to get DNSSEC working with AdGuardHome do the following below :
Go into AdGuardHome WEBGUI - then Settings > scroll down to DNS server configuration
Enable EDNS client subnet and Enable DNSSEC. This is all that is required.

Make sure that Upstream DNS Servers in your 
/opt/AdGuardHome/AdGuardHome.yaml file -
( and /or AdGuardHome WEBGUI )
support DNSSSEC. This is because AdGuardHome 
piggybacks on configured DNS Servers 
for DNSSEC Validation.

You can test DNSSEC on AdGuardHome by issuing command:

## you need bind-tools installed to run this command 

dig +dnssec +multi @

So long as you see in the ;; flags: section the ad; entry = ( meaning Authenticated Data )
you are all set and good to go. See example of AdGuardHome DNSSEC in action below :

How To Upgrade Your AdGuardHome Install :

Some claim that you can upgrade from AdGuardHome WEBGUI - it has never worked
for me while running OpenWRT. No need to fear - here is how to upgrade when new EDGE
Version pops up. Hopefully, if you initially Setup Exroot for your AdGuardHome Install
( that means on a USB Stick ) then all you have to do is grab the new
installation by doing exactly what you did when
you first installed AdGuardHome. With Exroot - you do not have to worry about
any space issues - this is why we recommend Exroot to begin with.

1 - Download the correct AdGuard Home package for your router's processor.
2 - Create a folder to extract the archive into - and use WinRAR, 7Zip, PeaZip or 
some such file archiver to unzip AdGuardHome_linux_your_router.tar.gz
3 - You will now have a decompressed folder named " AdGuardHome " .
4 - Then issue this command below :

# /etc/init.d/AdGuardHome stop

5 - Fire up WINSCP - open /opt/ directory on the right side of 
the application - then Drag & Drop the AdGuardHome 
decompressed folder from the directory you had it in on your desktop. 
If you know how to use SCP on OpenWRT ( Linux ) you may use 
that method here as well.

6 - After you drag and drop new AdGuardHome into the /opt/ directory
( overwriting the old installation ) - then enter these commands :

a - # /etc/init.d/AdGuardHome restart
b - # /etc/init.d/dnsmasq restart

You have now upgraded your AdGuardHome Install on OpenWRT.

I was going to tackle Unbound on AdGuardHome here but
I think that is best covered in a separate guide.

Peace Stay Safe and God Bless All Always

PS - I started this journey in order to learn how to use DNS-over-QUIC, or DoQ.
In full disclosure I exclusively use DNS-over-QUIC upstream servers with AdGuardHome.
Also, I used Encryption for DNS OVER TLS bootstrap servers.
So - the whole damn thing ( my DNS ) is encrypted. Special thanks to mercygroundabyss
for his devotion to this project, his time and patience for all with inquiries, and most of all his
kindness and thoroughness in demeanor and practice.
BTW, I certainly will not at all miss having to update the SPKI PIN Keys
for DOT SERVERS in the Stubby yaml configuration file.

Bonus Feature:
For Those Who Care To PIMP Their AdGuardHome WEBGUI

You must install Stylish Addon To Use AdGuardHome Dark Theme
Firefox addon :
Chrome extension :

Go here - For Stylish Dark Themes :


You must enter your LAN IP ADDRESS IN " Customize Settings " Box prior to installation
If you enabled Encryption with a valid SSL certificates chain for your domain - then enter
your Full Domain Name in " Customize Settings " Box prior to installation instead of LAN IP.

As per this example, Full Domain Name in 
" Customize Settings " Box  see below :

You may then access AdGuardHome WEBGUI on port 443 - here is example from above :  - with Encryption Enabled

you will see " green padlock " when logging in / your certificate pulls double duty

Here Is What You Get After Install :


Nice summary of the [HowTo] Running Adguard Home on OpenWrt thread.

Couple of things.

  1. You don't actually need unbound. You can do DOH directly from within AGH. Full set of encryption protocols they use is here

  2. Using AGH install script is easier and simpler for most users. Just use their Edge builds as they are most up to date. It will also warn if there is missing dependancies.

curl -s -S -L | sh -s -- -c edge
  1. You included the routers own DNSMasq in your upstream list. While this is ok, there is no real reason to add another hop in your DNS list. Just go direct to your upstreams and AGH becomes your primary DNS cache instead of being a secondary (and repeated cache) on the router. This is much better as you are not doubling up memory usage. Especially as you have moved DNSMasq to port 5353 and thus only the router will use it. Your clients will use AGH as it is the DHCP servers DNS.

  2. While the filter list is a good selection, users should be aware that on limited memory routers you should only have a few filter sets as you will quickly run out of memory. That filter set provided is roughtly 140k entries in total and was optimised for a router with 128mb of ram.

  3. the crash around statistics database reloading has been fixed with AGH. However, currently AGH uses 35mb of space for its binary. It then will use space for its query logs and database. Query logging is currently using 45mb of space on my router. Current log rotation setup means you will need double that space so 35mb x 2 (for AGH binary and its backup when it upgrades) and log space x2.
    AGH also will crash with error messages once it it out of diskspace. Keeping an eye on your free diskspace is crucial. Once you have AGH up and running after an upgrade you can delete the /opt/AdGuardHome/agh-backup folder contents.

If you run out of space entirely?
The /opt/AdGuardHome/data folder contains the following.

root@OpenWrt:/opt/AdGuardHome/data# ll -h
drwxr-xr-x    3 root     root         512 Oct 29 09:42 ./
drwxrwxrwx    4 root     root         736 Oct 30 09:06 ../
drwxr-xr-x    2 root     root         800 Nov  2 09:52 filters/
-rw-r--r--    1 root     root       45.4M Nov  2 20:42 querylog.json
-rw-r--r--    1 root     root        8.9M Oct 29 09:00 querylog.json.1
-rw-r--r--    1 root     root       32.0K Oct 30 05:28 sessions.db
-rw-r--r--    1 root     root        4.0M Nov  2 21:00 stats.db

Delete the querylog files. These are your DNS queries.
sessions.db are connections to AGH currently. This can be deleted as well
stats.db you can purge but you will lose your statistics data.

filters folder contains all your filter downloads. Purge if it is full but it will re-download your filters. If your filters are too large for your diskspace you will have to disable large filters and restrict their usage.

Another option would be to use usb storage and remount that as the /opt/AdGuardHome folder and thus avoid space issues. (Not all routers can do this)

I had been meaning to summerize the rather long thread that is the AGH one but it seems i was beaten to it :slight_smile:

Also you should warn users that your changes will make AGH the primary webserver on their router and move luci's interface to port 8080 (and also its https interface if you use AGH secure interface)


Routers with limited space should get better warnings once that issue is resolved.

1 Like

Dear mercygroundabyss,
Hello and I hope that you are both safe and well. I am a BIG FAN of your work, dedication, and knowledge concerning AGH on OpenWRT. Thank you for your feedback / input / advice and direction as to how to clean up this guide. Re : your comment below :

Another option would be to use usb storage and
 remount that as the /opt/AdGuardHome folder and
thus avoid space issues. (Not all routers can do this)

Yes - I use exroot and there are plenty of those guides - I should have mentioned it and will do so in the cleanup. By the way I did once run AGH on :


However, as I remember there were a few performance issues. So do you mean just run AGH using exroot or instead use /mnt/sda1/AdGuardHome/AdGuardHome ?
I have a few more questions for you but I will message you with those. Again thanks from me and the Greater OpenWRT Community for your contributions with this great project.


1 Like

Just mounting it as a folder so the rest of the router works off the onboard flash. I only did it for a short time as i switched from using openwrts adblock to using PiHole on a pi4 and then switched back to using AGH on the router.

1 Like

RE :

Also you should warn users that your changes
 will make AGH the primary webserver on their 
router and move luci's interface to port 8080 
(and also its https interface if you use AGH secure interface)

Luci is still available on Port 1443 in the example that I gave in the tutorial. I then can log into AGH on Port 8080 without Encryption and if Encryption enabled AGH Login = Port 443
There is an option to enable automatic HTTPS REDIRECT in the AGH WEB GUI under Settings > Encryption. Just trying to set the record straight.


1 Like

thats fine. Just explaining what you are doing and why is important when you integrate products like this which change how users have been using their device. Its why when i did my posts i tried to always explain why and what was changed so they understood what was happening.

1 Like

Good Idea - I will go back and clean up the finer points in the very near future. Thanks for your advice and guidance.

1 Like

Any idea how/when blocked sites are classified as threats? So far none of the blocks logged show up as "phishing sites" or whatever, even when the site was blocked because of being in a phishing list.

After a few days the status page still shows "0 malware/phishing sites blocked", even after adding, which I tested by deliberately visiting a few sites in the list. They were blocked as they should be, but not logged as phishing sites and that number remains 0.

Is this classification scheme only for Adguard's own lists?

Its for using their DNS which gives those definitions.

You will only see Blocked lists showing for your results from your filter lists.

If you enable the browsing security and parental control options from under the settings then you will get those counters updating as it uses AGH DNS to do it.

(edit) its explained here in their blog :


Limited space routers.

AGH binary takes up 35mb and during its update it will download the new binary compressed, backup your old binary and then extract and replace the old binary with the new one. This means you require 35mb x2 and the compressed file space and extraction space.

To manually do this, do an upgrade from the control panel and look for what version it wants to upgrade to in your syslog.

AdGuardHome[5830]: 2021/11/10 16:03:30.149784 [info] Updating from v0.107.0-a.199+2fc10848 to v0.107.0-a.203+6fd9e72f. URL:

SSH into your router and stop AGH.

/etc/init.d/AdGuardHome stop

download the new version to your routers /tmp area or to your laptop/pc. Then either unpack AGH binary from the compressed download over the existing binary or unpack the binary on your laptop/pc and copy it over the existing binary using something like WinSCP or equivalent.

Now restart AGH.

/etc/init.d/AdGuardHome start

(Edit) commands to do this below.

#Stop AGH
/etc/init.d/AdGuardHome stop 

#Grab updated AGH from server and save to /tmp
wget -P /tmp

#unzip updated file over top of AGH in /opt
tar x -vzf /tmp/AdGuardHome_linux_mips_softfloat.tar.gz -C /opt

#cleanup /tmp
rm /tmp/AdGuardHome_linux_mips_softfloat.tar.gz

#Restart AGH
/etc/init.d/AdGuardHome start

With the new "Optimisitc Caching" feature, can we make it work with OpenWRT's DNSMasq?

I have tried disabling the cache feature on DNSMasq (set to 0) and enabling Optimisitic Caching. However, I am getting issues and losing connectivity to the internet.

With Optimisitic Caching disabled. And DNSMasq set to 8192 cache (as recommended in the guide), everything is working smoothly albeit 80ms average processing time.

I am looking to make it 30ms or below by enabling the feature of Optimisitc Caching.


Does it really work like this?

that looks like you are feeding all dns requests via your routers dnsmasq instead of directly to AGH.

I just followed the guide using a freshly formatted OpenWRT. Do I need to disable dnsmasq?


Is your AGH your primary DNS? or the Router primary DNS?

if you have AGH installed on router just move dnsmasq to port 5353 and make AGH primary DNS on port 53.

If AGH is on a separate machine just make it a DHCP option.

uci add_list dhcp.lan.dhcp_option='6,' 
uci add_list dhcp.lan.dhcp_option='3,' 

uci commit dhcp

/etc/init.d/dnsmasq restart

I don't understand what you are doing with your list servers. pretty sure that 8080 one is wrong for starters.

1 Like

Then in AGH do this. That will tell AGH to look at DNSMasq 5353 to look up internal lan names.
(Edit change from localhost to whatever ip you have your AGH on if it is NOT on the local router)

1 Like
  1. Is your AGH your primary DNS? or the Router primary DNS?

I want AGH to be my primary DNS while using NextDNS as my upstream server (paid for a subscription and I'm using this when I'm on cellular data)

  1. if you have AGH installed on router just move dnsmasq to port 5353 and make AGH primary DNS on port 53.

  2. I have AGH on my router, I just moved DNSMasq to port 5353 using

root@OpenWrt:~# uci set dhcp.@dnsmasq[0].cachesize='1000'
root@OpenWrt:~# uci set dhcp.@dnsmasq[0].noresolv='1'
root@OpenWrt:~# uci set dhcp.@dnsmasq[0].server=''
root@OpenWrt:~# uci set dhcp.@dnsmasq[0].port='5353'
root@OpenWrt:~# uci commit dhcp
  1. I don't understand what you are doing with your list servers. pretty sure that 8080 one is wrong for starters.

I followed the guide here:

Thank you!

Just double check your AGH yaml file to ensure its looking at the correct ports. (This is usually done on install and is as of yet not able to be redone via webinterface once it is installed. It is marked as a ToDo on AGH issues page however)

Also do the fix i mentioned above so AGH can lookup your internal clients DNS.

  - ::1
  port: 53

(Edit : I do have one question however. Why are you using AGH when NextDNS does similar to AGH?)