Skip to content

AdGuard Home in Container Manager on a Synology NAS

Last updated on 29 January 2024

Important or Recent Updates
Historic UpdatesDate
Updated guide for Container Manager and using MacVLAN13/05/2023
Added a new section to ensure DSM continues having network access.02/06/2023
Guide updated so you can choose between Macvlan or Bridge mode12/08/2023
Added additional security option to the compose to restrict the container from gaining new privileges25/10/2023
Removed the requirement for the synobridge as this container can just use its own bridge, and added the Host network mode, so all three are a choice.21/01/2024
Historic Updates


What is AdGuard Home?

AdGuard Home is network-wide software for blocking ads and tracking. After you set it up, it’ll cover all your home devices it even includes a parental control solution, just like a PiHole it acts as your home network DNS server and will block advertising on any site you visit.

This guide will get you set up with AdGuard and cover some basic initial settings, I recommend checking out the documentation for all the various features available.

Host vs Macvlan vs Bridge Network Modes

Host:

Host mode uses your NAS underlying network to run the containers network services, so it will be reliant on the NAS not using any of the required ports for the container. However, this makes it easy to set up, but you need to make sure no other service is using the required ports. All your clients will appear correctly as independent devices and stats.

Macvlan:

This gives you the benefit of AdGuard having its own IP address on your network, all clients appear with their real IP addresses allowing you to assign specific rules and give you some nicer stats just like Host mode. However, one downside is that your NAS will not be able to use AdGuard for DNS, due to the additional security features of Macvlan and its communication with its host. This is generally not an issue unless you wanted to use you AD blocking with Tailscale.

Bridge Mode:

The main benefit of Bridge Mode will be the ease of setup however you will find that all clients on your network will appear under the same IP as the Bridge 172.20.0.1. This won’t impact ad blocking, but it will mean you can’t apply device specific device rules etc.

Let’s Begin

In order for you to successfully use this guide you will need to check that your Router allows you to change your network DNS servers, this is usually found in the DHCP settings.

Please follow the initial guide below to get a restricted Docker user in place and then come back here

Folder Setup

Let’s start by getting some folders set up for the container to use. Open up File Station create the following.

Folders
/docker/projects/adguard-compose
/docker/adguard
/docker/adguard/work
/docker/adguard/conf

Container Manager

Next we are going to set up a ‘Project’ in Container Manager. Open up Container Manager and click on Project then on the right-hand side click ‘Create’.

In the next screen we will set up our General Settings, enter the following:

SectionSetting
Project Name:adguard
Path:/docker/projects/adguard-compose
Source:Create docker-compose.yml

Next we are going to drop in our docker compose configuration, copy all the code in from the appropriate version of the container you want to run below and paste it into line ‘1’ just like the screenshot.

What on earth is a Docker Compose?
Docker Compose allows us to define how Docker should set up one or more containers within a single configuration file. This file is yaml formatted and Container Manager uses the Projects feature to manage them.

Please note you will not be able to use Macvlan with a Bonded network connection e.g. ‘Bond0’. You will need to remove the bond in order to use this method.

Host Mode

YAML
services:    
  adguardhome:
    image: adguard/adguardhome
    container_name: adguardhome
    volumes:
      - /volume1/docker/adguard/conf:/opt/adguardhome/conf
      - /volume1/docker/adguard/work:/opt/adguardhome/work
    network_mode: host
    security_opt:
      - no-new-privileges:true
    restart: always

Macvlan

YAML
services:    
  adguardhome:
    image: adguard/adguardhome
    container_name: adguardhome
    volumes:
      - /volume1/docker/adguard/conf:/opt/adguardhome/conf
      - /volume1/docker/adguard/work:/opt/adguardhome/work
    networks:
      macvlan:
        ipv4_address: 192.168.0.129
    security_opt:
      - no-new-privileges:true
    restart: always

networks:
  macvlan:
    name: macvlan
    driver: macvlan
    driver_opts:
      parent: eth0
    ipam:
      config:
        - subnet: "192.168.0.0/24"
          ip_range: "192.168.0.254/24"
          gateway: "192.168.0.1"

Bridge Mode

YAML
services:    
  adguardhome:
    image: adguard/adguardhome
    container_name: adguardhome
    volumes:
      - /volume1/docker/adguard/conf:/opt/adguardhome/conf
      - /volume1/docker/adguard/work:/opt/adguardhome/work
    ports:
      - 53:53/udp
      - 3000:3000/tcp
    security_opt:
      - no-new-privileges:true
    restart: always

If you are setting up the Bridge or Host Mode versions you can now press next and jump ahead in the guide to Web portal settings for Macvlan continue on below.

Settings Amendments for the MacVLAN

OK we now need to make some edits to the compose in order for it to work on your Network.

I have broken down the edits needed in this table it includes the line numbers and an explanation of what to edit.

SectionExplanation
Line 11
ipv4_address: 192.168.0.122
Change to the IP address you want to use for the container. Make sure this is available and not in use by another device on your network.
Line 21
parent: eth0
This defines the network interface the container should use, I have used eth0 which will be the first Ethernet port on your NAS. If you want to use a different port change it accordingly.

Note! If you have Virtual Machine Manager installed change this to ovs_eth0
Line 24
subnet: “192.168.0.0/24”
We need to change this in line with your networks’ subnet – in the example I have used 192.168.0.0/24. The super quick way to work out what to use is just take the IP of your NAS and change the final digit before the /24 to 0
Line 25
ip_range: “192.168.0.254/24”
This has to be changed to the highest available IP address within the range of your subnet. Again if your network is in the 192 range the final number used from the subnet above can be changed to 254 and added to this section.
Line 26
gateway: “192.168.0.1”
This will be the IP address of your Router/Gateway/DHCP Server

Once you have made the edits you can click ‘Next’

Web portal settings

You do not need to enable anything on the ‘Web portal settings’ screen click ‘Next’ again.

On the final screen click ‘Done’ which will begin the download of the container images and once downloaded they will be launched!

The image will now be downloaded and extracted. You should see ‘Code 0’ when it has finished.

You will now see your AdGuard running and should have a green status on the left-hand side.

You should now be able to access the web interface via

Macvlan = the IP you specified in the compose followed by the port 3000
OR
Bridge or Host = Your NAS IP followed by the port 3000

Initial Setup

You will now do some initial setup steps

Step 1 – click ‘Get Started’

Step 2 – You will be asked to choose the network interfaces AdGuard will listen to for DNS requests and the Web Interface. Leave these set to ‘All Interfaces’ but change the Port for the Web Interface from 80 to 3000.

You will notice the IPs highlighted in Red in the screenshot will be either 127.0.0.1 or 172.20.0.1 do not use these as suggested by the UI as they will not work.

Click ‘Next’

Step 3 – You will be required to set up a Username and Password to access the Web UI. Fill these in (You could follow the Vaultwarden guide to get a password manager setup if you don’t have one already)

Step 4 – Configure your devices

The DNS address to use on your device or router/dhcp server will be

Bridge Mode or Host Mode = IP address of your NAS
MACVLAN Mode = IP address you assigned in the compose file

The addresses shown on the final screen in Red may show different IPs use the one I suggest above.

Click on Open Dashboard and you will be taken to the login screen.

Now log in to your account.

Once your devices start to update with the new DNS server IP you will begin seeing traffic in your Dashboard. (This can take up to 24 hours)

From here you can set up some initial settings such as additional ‘Filters’ (blocklists) or define additional upstream DNS providers who handle the requests that make it past the filters in Settings > DNS Settings.

More settings can be found here

You are ready to roll 🙂

FAQ:

What ports does AdGuard use?
The ports below are used by AdGuard, if you use Bridge Mode above and want to use any of the additional services you will need to add them.

PortProtocolUsed For
53TCP/UDPDNS
853TCPDNS over TLS
443TCPHTTPS/DNS over HTTPS
784UDPDNS over QUIC
8853UDPDNS over QUIC
67IPv4 UDPDHCP – Only used when the ipv4 DHCP server is enabled.
68TCPDHCP – Only used when the ipv4 DHCP server is enabled.
68UDPDHCP – Only used when the ipv4 DHCP server is enabled.
547IPv6 UDPDHCP – Only used when the ipv6 DHCP server is enabled.
3000TCPFor the WebUI

Buy Me a Coffee or a Beer

If you have found my site useful please consider pinging me a tip as it helps cover the cost of running things or just lets me get the odd beverage. Plus 10% goes to the devs of the apps I do guides for every year.

Published inAd-Blocking / DNS 7.2DockerSynology

60 Comments

  1. João João

    Hi there,

    I stuck at failed to create the maclevan port: device or resource busy…

    Any help? I read all the older comments, tried everything…

    • Dr_Frankenstein Dr_Frankenstein

      Hey, double check you are using the correct name of the LAN connection. Feel free to reach out via my Help Me! page so I can see your config.

  2. Josh Josh

    I have tried the MacVLAN method and pointed my routers dns to both my NAS IP and also tried AGH IP, but neither for internet or showing on the AGH dashboard.

    Is this a no go and I have to use bridge for this?

    • Dr_Frankenstein Dr_Frankenstein

      Hey, for MACVLAN its the MACVLAN IP to be added to the Router. Once added your devices won’t immediately move as noted on the guide they will be given the new DNS address when their DHCP lease expires, or they ask the Router for the new DNS address (when you reboot them). You will then start seeing the devices appear. This could be up to 24 hours based on a normal DHCP lease time.

  3. Hi DF –
    Im a little confused by your “Macvlan or Bridge Mode?” explanation. you say “…This won’t impact ad blocking, but it will mean you can apply device specific rules etc.” Do you mean to say “CANT apply device specific rules”?

    • Dr_Frankenstein Dr_Frankenstein

      Soz typo

      “but it will mean you can’t apply device specific device rules etc.”

      • Fred Fred

        Hi DF – So I set up adguard in Macvlan following your instructions. It seems to be running ok in My DS920+ but the adguard dashboard shows all zeros and it doesn’t seem to be doing anything. Are there some additional settings in the app I need to adjust?
        PS these guides have been a lifesaver for me! You (along with my doodads) has gotten me up and running in the alphabet soup of networking and computing. I really appreciate it!!

      • Ohh, I got it working. Had to update my router DNS setting to the adguard server address.
        Thanks for all the great help!!

  4. Thanks for the great guide! The Container Manager for AdGuard on Synology (7.2.) has begun telling me “Warning” for Adguard but refuses to tell me why. Adguard seems to run fine and the abbreviated logs in Container Manager are completely fine. Is there any way to pull verbose Adguard logs? I am speaking of the software itself – not the logs of the DNS queries!

    • Dr_Frankenstein Dr_Frankenstein

      Hey

      So you should be able to see the log from the Container view.. Click on AdGuard then there is a Log tab which gives you the contain status etc. It should give you an idea as to why it is showing unhealthy.

  5. gauthier gauthier

    Hello there !
    I’m trying to set up adguard in macvlan using portainer, however when I try to build my stack with your docker compose I get the following error:
    “failed to deploy a stack: service adguardhome declares mutually exclusive `network_mode` and `networks`: invalid compose project ”

    I am new to portainer and your guides have been super helpful so far, but I can’t find the answer online, do you know what could be the issue ?

    Thank you !!

    • Dr_Frankenstein Dr_Frankenstein

      Hey try removing the line
      network_mode: synobridge
      I think Portainer seems to dislike this setting. I might just remove it from the guide as it will still work without it on DSM as well.

      • gauthier gauthier

        Thank you !
        I did try to do that yesterday and had no trouble starting deployment of my stack. However during the deployment I’m now facing a new error :
        “Network macvlan Created Container adguardhome Creating Container adguardhome Created Container adguardhome Starting Error response from daemon: failed to create the macvlan port: device or resource busy”
        I used eth0.10 instead of eth0 and it deployed, will report if it works!

        • gauhier gauhier

          Okay so I tried with no luck with eth0.10, can’t reach the IP even if it is unused.. also tried with eth0 in container manager but I still get the device or resource busy error code!
          I’m not really sure what I’m doing wrong

            • Gauthier Gauthier

              Sure ! I find the eth0 as up in the list of network adapter:
              eth0: mtu 1500 qdisc mq master ovs-system state UP mode DEFAULT

              I don’t understand why it says it’s busy tho?

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

drfrankenstein.co.uk – writing Synology Docker Guides since 2016 – Join My Discord!