[GUIDE-UPDATED] AdGuard Home on DD-WRT

Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking
Goto page 1, 2, 3 ... 11, 12, 13  Next
Author Message
MomenMamdouh
DD-WRT User


Joined: 19 Sep 2017
Posts: 150
Location: Egypt

PostPosted: Mon Nov 27, 2023 19:12    Post subject: [GUIDE-UPDATED] AdGuard Home on DD-WRT Reply with quote
AdGuard Home

AdGuard Home (AGH) is a free and open source network-wide advertising and trackers blocking DNS server. It operates as a DNS server that re-routes tracking domains to a “black hole”, thus preventing your devices from connecting to those servers.



AGH Features:
-Blocking ads and trackers
-Customizing blocklists
-Blocking phishing and malware domains
-Parental control (blocking adult domains)
-Force Safe search on search engines
-Support for DNSCrypt, DNS-over-HTTPS, DNS-over-TLS, DNS-over-QUIC Protocols
-You can block one service or more with just one click (ex. TikTok, YouTube, Facebook, etc.)
-Per-client (device) configuration
-Web Admin Interface
-Graphical Statistics and Summarization

How is this different from public AdGuard DNS servers?
Running your own AdGuard Home server allows you to do much more than using a public DNS server. It's a completely different level. See for yourself:

-Choose what exactly the server blocks and permits.
-Monitor your network activity.
-Add your own custom filtering rules.

Most importantly, it's your own server, and you are the only one who's in control.

Prerequisites
-Router with minimum 128 MB RAM, and at least 50 MB free RAM
-Entware (Please check dd-wrt wiki) and make sure to add the following commands to the start-up script (Administration tab - then Commands).

Code:
sleep 10
/opt/etc/init.d/rc.unslung start


Installation
We have 2 options to install AGH on DD-WRT:

1) Entware version:

It is the easiest method, just paste these two line in your terminal
Code:
opkg update (click enter)
opkg install adguardhome-go (click enter)


Pros:
- It's always a stable release

Cons:
- Not always up to date

Uninstalling

If you need to uninstall AGH, just apply the following command:
Code:
opkg remove adguardhome-go

To remove residual files (optional), use the following command:
Code:
rm /opt/etc/hosts

If you run into an issue reinstalling, use the following command:
Code:
opkg remove adguardhome-go --force-remove

Then reinstall

Upgrading to the most updated entware version

To upgrade the installed version of AGH, simply do:
Code:
opkg update && opkg upgrade


2) GitHub version

This is the recommended method, as, you can always have the most current stable release. Also, you can test the unstable versions of AGH and their new unreleased features (Beta & Edge versions)

before proceeding with the installation, make sure your DD-WRT build for your router has a working curl or install it via entware:

Code:
opkg update && opkg install curl (click enter)


Installation of the most current stable version:

Code:
curl -s -S -L https://raw.githubusercontent.com/MomenMamdouh/AGH-for-DDWRT/main/AGH-Installer/installAGH.sh | sh -s -- -v


Installation of the beta version:

Code:
curl -s -S -L https://raw.githubusercontent.com/MomenMamdouh/AGH-for-DDWRT/main/AGH-Installer/installAGH.sh | sh -s -- -c beta


Installation of the Edge version:

Code:
curl -s -S -L https://raw.githubusercontent.com/MomenMamdouh/AGH-for-DDWRT/main/AGH-Installer/installAGH.sh | sh -s -- -c edge


Uninstalling

Code:
curl -s -S -L https://raw.githubusercontent.com/MomenMamdouh/AGH-for-DDWRT/main/AGH-Installer/installAGH.sh | sh -s -- -v -u


Reinstalling

Code:
curl -s -S -L https://raw.githubusercontent.com/MomenMamdouh/AGH-for-DDWRT/main/AGH-Installer/installAGH.sh | sh -s -- -v -r


Updating

From inside AGH's GUI you will receive a notification banner to update to the most current version. Click the update button and voila!

Basic AGH setup


1- Let's Make AGH the primary DNS resolver instead of dnsmasq and/or unbound, this will improve DNS performance, and it enable AGH to use port 53 exclusively. To do that go to "Setup page > Dynamic Host Configuration Protocol (DHCP)" and untick "Use dnsmasq for DNS" and "Recursive DNS Resolving (Unbound)". Make sure that you have disabled any other DNS resolver you have enabled before, such as SmartDNS, etc.

2- dnsmasq still there working as a DHCP server. we will configure dnsmasq to advertise AGH as your only DNS server for your entire network. This can be done by adding these options to dnsmasq:
Go to "Service page > Dnsmasq Infrastructure > Additional Options" and add the following inside the box
Code:
no-resolv
dhcp-option=6,Router-IP #(ex. dhcp-option=6,192.168.1.1)


3- Go to "Service page > Dnsmasq Infrastructure" and disable "No DNS Rebind"
Don't forget to save and apply settings

4-Reboot your Router

5-Open AGH GUI in your browser at http://Router-IP:3000 to continue the installation through the web


6-In the next screen you will set the ports for AGH admin web and for the DNS server. I used Port 3000 to continue accessing the AGH dashboard at http://Router-IP:3000. You can change the port to whatever you want (Ex. http://192.168.2.1:8080).
And for DNS make sure that you can use port 53.

If an error message appears; make sure that you disabled the usage of dnsmaq for DNS as mentioned in step 1.

7-Now type the credentials you want (Username/Password), you will use them later for accessing AGH dashboard.


8-After completing the web installation AGH will ask you to use your credentials to login to your dashboard

9-At this point AGH is UP and RUNNING, you can test your internet connectivity to ensure everything is fine.

Prevent DNS Leaks
Please refer to this post

AdGuard Home Settings Overview
General settings

Block domains using filters and hosts files
Enables applying of the blocking rules. You can configure them in the Filters tab.

Browsing security web service
Checks requests against the lists of known hazardous domains. Blocks malicious and phishing ones.

Parental control
Checks whether requests contain domains of adult websites and blocks them.

Safe search
Removes obscene materials from search results in search engines.



Logs configuration
Basically the setting for Query log. You can change the logs retention, anonymize IP addresses which connect via AdGuard Home, clear the log or simply disable it (but this will kill all the fun).

Statistics Configuration
Manages all that statistics on the Dashboard: you can choose a new value of reporting period or clear all the stats.



DNS settings
Let's start with the first thing you can set here, and namely upstream DNS servers.
AdGuard Home is basically a DNS proxy that sends your DNS queries to the upstream servers. You can specify multiple upstream servers in AdGuard Home settings, or you can even specify a DNS server that will be used to resolve specific domains.

If you keep this field empty, AdGuard Home will use Quad9 by default. But you may switch to any other server you like.



And a few words on the options that you have here:

Load balancing — keep it as is if you have fast and stable Internet connection.

Parallel requests — it is your choice if you have an unstable Internet or use several unstable DNS servers at a time.

Fastest IP address — makes sense to switch to, if your country practices IP blockings (e.g: The Great Firewall of China, Russian Roskomnadzor blockings, etc.). In this case it will help find not just the fastest but actually available address. But please note that a DNS is not a VPN, it may turn out that no IP would be available.

Client settings
This is one of the essential features of AdGuard Home when it comes to network-level filtering.
Basically Client means a device in your network, and with AdGuard Home you can set different settings for each Client separately.

For example, configure your kids’ phones by enabling Parental control or setting some other upstream DNS server (like AdGuard DNS Family or Cloudflare). You can even block some specific services for their devices (like TikTok, Twitch and so on).

Create Clients and set their names to see right away which device is sending requests. Specify tags (type of device, OS or any other) and identifiers (IP or MAC address) to help configure different filtering rules for different devices at home.



Filters / ADBLOCKING
If you are familiar with other AdGuard products, you already know the concept of Filters. Those are sets of rules to do the filtering by. And this is how it is implemented in AdGuard Home:

Blocklists

You can choose from a list of some popular filters: regional, security, general, etc., the ones we recommend.



Or you can add a custom list (both local files and URLs are supported) and it will also be updated automatically. Please note, by default we only use our own AdGuard DNS filter.

Allowlist
Similar to Blocklist in terms of functionality, but does the opposite: unblocks domains.
If the same domain appears in both Blocklist and Allowlist, the rules of Allowlist will be given priority. One of the main use cases: you can block a range of subdomains *.example.com with a blocklist or a custom filtering rule and then add a specific subdomain like good.example.com to the allowlist to unblock it.

Rewrite
This is a bit more advanced tool to manage DNS requests. It allows you to redirect specific DNS requests (say, requests to example.org and its subdomains) to a specific domain or IP address. Click on the ‘Add DNS rewrite’ button to view some examples and syntax hints.

Blocked services
We have already mentioned it when speaking about the Clients settings. This feature allows you to quickly and easily block particular popular sites and services. And while it can be configured for a specific device with Clients setting, here in the Filters tab you can apply this setting for all devices in the network at once.



Custom filtering rules
In addition to blocklists/allowlists, you can further customize DNS filtering by adding more complex custom rules. They should follow special DNS syntax, and by employing it you can block or unblock all domains that match certain regular expressions, for example. Basic ‘hosts’ syntax is also supported.


Query Log
Perhaps the most entertaining feature of AdGuard Home, Query Log, is your very own mission control desk which shows DNS requests that are being sent in your home network.
What your kid is trying to watch right now, where your smart fridge is trying to transmit some data, what tracking requests your own laptop is processing — all domains that all your devices (Clients) connect to in one place.



You can manually block/unblock requests, thus automatically creating a new filtering rule (in the Filters — Custom filtering rules tab).

Tested on DD-WRT v3.0-r54109 std (11/24/23)

_________________
Routers:
TP-Link Archer C7 v2-(EU)
TP-Link WR840n v3
TP-Link WR740n v5


Last edited by MomenMamdouh on Sun Feb 11, 2024 20:04; edited 23 times in total
Sponsor
Alozaros
DD-WRT Guru


Joined: 16 Nov 2015
Posts: 6333
Location: UK, London, just across the river..

PostPosted: Mon Nov 27, 2023 20:13    Post subject: Reply with quote
lol big thanks for the effort ... nice guide !
Few things to underline: Cool

-DNSmasq is "the backbone" of DDWRT so, disabling it will impact the router operation in some ways...I use DNSmasq along with Stubby or DNScrypt and both co-exist together very nice...

-Using ADG via port 53 unencrypted...is equal to no privacy at all..with the same success and less hassle, you can set DNSmasq to forward the DNS requests to the ADG servers using any port you would like...(via advanced DNSmasq rules) --- (server=IP#port)

-Moreover you can even use SmartDNS, to manage encryption (DoT or DoH) towards ADG servers...and live happy life...with no hassle at all https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=323896&postdays=0&postorder=asc&start=240 just to underline "lower class routers that dont have OpenSSL will not work with SmartDNS encryption"...

-You can also get more privacy and install Stubby via Entware(for routers that do not have OpenSSL but have USB) or DNScrypt-proxy v2(for high class routers with fast CPU) also via Entware and use ADG servers with encryption...green and red links in my signature... Razz

-If you want to go to extreme, you can add a subscription to NextDNS and just use it via SmartDNS, as SMDNS offers great range of options, as well NextDNS offers wide range of settings regarding privacy and types of encryption...moreover, it offers free subscription and 200K monthly DNS requests for free...

_________________
Atheros
TP-Link WR740Nv1 ---DD-WRT 55009 WAP
TP-Link WR1043NDv2 -DD-WRT 55109 Gateway/DoT,Forced DNS,AP Isolation,Ad-Block,Firewall,VPN,x1VLAN
TP-Link WR1043NDv2 -DD-WRT 55052 Gateway/DoT,Forced DNS,Ad-Block,Firewall,x4VLAN,VPN
TP-Link WR1043NDv2 -Gargoyle OS 1.15.x AP,DNS,QoS,Quotas
Qualcomm-Atheros
Netgear R7800 --DD-WRT 55109 Gateway/DoT,AD-Block,Forced DNS,AP&Net Isolation,x3VLAN,Firewall,Vanilla
Netgear R9000 --DD-WRT 55052 Gateway/DoT,AD-Block,AP Isolation,Firewall,Forced DNS,x2VLAN,Vanilla
Broadcom
Netgear R7000 --DD-WRT 55109 Gateway/SmartDNS/DoH,AD-Block,Firewall,Forced DNS,x3VLAN,VPN
NOT USING 5Ghz ANYWHERE
------------------------------------------------------
Stubby DNS over TLS I DNSCrypt v2 by mac913


Last edited by Alozaros on Tue Nov 28, 2023 19:54; edited 1 time in total
MomenMamdouh
DD-WRT User


Joined: 19 Sep 2017
Posts: 150
Location: Egypt

PostPosted: Mon Nov 27, 2023 21:54    Post subject: Reply with quote
Thank you for your comment, but there are many fallacies mentioned

1. dnsmasq, smartdns, stubby, and even Adguard home all use port 53 to listen for DNS requests within the network when they are configured as primary resolver.
2. As for upstream servers, AGH uses encrypted ports 433 and 853 for connecting to the encrypted DoH and DoT servers
3. adguard dns and adguard home are not the same, the latter is a client/resolver. It can work with adg or others, such as opendns,nextdns, and google.
4. Removing the DNS function from dnsmasq does not mean disabling it completely,it is present and works as a dhcp server.
5. Agh is several steps ahead of Stubby and other resolvers, and you need to try it first to give an objective evaluation of it.
6. Finally, do some googling about AGH compared to other resolver, you will find interesting info and reviews.

Thanks.

_________________
Routers:
TP-Link Archer C7 v2-(EU)
TP-Link WR840n v3
TP-Link WR740n v5
Alozaros
DD-WRT Guru


Joined: 16 Nov 2015
Posts: 6333
Location: UK, London, just across the river..

PostPosted: Mon Nov 27, 2023 22:22    Post subject: Reply with quote
MomenMamdouh wrote:
Thank you for your comment, but there are many fallacies mentioned

1. dnsmasq, smartdns, stubby, and even Adguard home all use port 53 to listen for DNS requests within the network when they are configured as primary resolver.
2. As for upstream servers, they use encrypted ports 433 and 853 for encrypted DoH and DoT servers
3. adguard dns and adguard home are not the same, the latter is a client/resolver. It can work with adg or others, such as opendns,nextdns, and google.
3. Removing the DNS function from dnsmasq does not mean disabling it completely,it is present and works as a dhcp server.
4. Agh is several steps ahead of Stubby and other resolvers, and you need to try it first to give an objective evaluation of it.
5. Finally, do some googling about AGH compared to other resolver, you will find interesting info and reviews.

Thanks.


Yep i know ADG very well used to use its servers via SmartDNS (DoH) and dont needed all the hassle of Entware...
I never used its platform and that is why i admire your effort, to create such a guide...but somewhere you have to mention and explain how the encryption goes on...and where to select its options...and how to check if its working so no DNS leaks and so...
Usually, most of the opkg stuff that offers encrypted DNS require presence/install of CA-certifiactes or CA-Bundle, along with OpenSSL or any other SSL (WlofSSL and ect.)...so you have to explain in your guide how encryption is going on...and people to make their choices..
Ofcourse most of the resolvers listen locally on port 53, and forward via port 53 too(plain text), but you didn't mention the upstream encrypted forwarding and how it happens and where to choose those encrypted options, like DoT or DoH and ect. and there where my confusion came along..it will be the same with anyone else reading the guide... Embarassed
When it comes to tight DNS security, Im more fan of DNScrypt-proxy v2...for my other routers that dont have OpenSSL, but have USB, Stubby is my choice and its light and stable...never had any issues with it...(Stubby requires and installs GetDNS, libopenssl, ca-certificates and ect.)
To be precise on one system, i do run SmartDNS as well, as it comes along with everything i need, all in one, privacy, versatility and options...and as i said you can run any DNS server, ADG, NextDNS, Quad9, Cloudflare and ect...there are many other DNS solutions for encrypted DNS around...too..
So, its nice to have a guide for one more...more choices, much better Wink
Big Thanks for your time and contribution...!!!

_________________
Atheros
TP-Link WR740Nv1 ---DD-WRT 55009 WAP
TP-Link WR1043NDv2 -DD-WRT 55109 Gateway/DoT,Forced DNS,AP Isolation,Ad-Block,Firewall,VPN,x1VLAN
TP-Link WR1043NDv2 -DD-WRT 55052 Gateway/DoT,Forced DNS,Ad-Block,Firewall,x4VLAN,VPN
TP-Link WR1043NDv2 -Gargoyle OS 1.15.x AP,DNS,QoS,Quotas
Qualcomm-Atheros
Netgear R7800 --DD-WRT 55109 Gateway/DoT,AD-Block,Forced DNS,AP&Net Isolation,x3VLAN,Firewall,Vanilla
Netgear R9000 --DD-WRT 55052 Gateway/DoT,AD-Block,AP Isolation,Firewall,Forced DNS,x2VLAN,Vanilla
Broadcom
Netgear R7000 --DD-WRT 55109 Gateway/SmartDNS/DoH,AD-Block,Firewall,Forced DNS,x3VLAN,VPN
NOT USING 5Ghz ANYWHERE
------------------------------------------------------
Stubby DNS over TLS I DNSCrypt v2 by mac913
Wizo
DD-WRT User


Joined: 08 Jun 2023
Posts: 59
Location: Essex. England.

PostPosted: Tue Nov 28, 2023 12:19    Post subject: Reply with quote
Thank you for this guide @MomenMamdouh Very Happy
mwchang
DD-WRT Guru


Joined: 26 Mar 2013
Posts: 1808
Location: Hung Hom, Hong Kong

PostPosted: Tue Nov 28, 2023 15:02    Post subject: Reply with quote
Interesting! Thank you for the guide. Might augment my use of recursive DNS Unbound. Smile

I believe DNSmasq can forward DNS queries to this Adguard Home DNS. You only need to use Additonal Options to do it. The two can co-exist.

Using Adguard Home as DHCP server might be an overkill compared to DNSmasq, though interesting.

I am wondering whether I could manage Adguard Home *WITHOUT* GUI. A DNS server should not need frequent adjustments. Smile

Is it possible to disable web interface? · AdguardTeam/AdGuardHome · Discussion #4172 · GitHub
https://github.com/AdguardTeam/AdGuardHome/discussions/4172

_________________
Router: Asus RT-N18U (rev. A1)

Drink, Blink, Stretch! Live long and prosper! May the Force and farces be with you!

Facebook: https://www.facebook.com/changmanwai
Website: https://sites.google.com/site/changmw
SETI@Home profile: http://setiathome.berkeley.edu/view_profile.php?userid=211832
GitHub: https://github.com/changmw/changmw
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12770
Location: Netherlands

PostPosted: Tue Nov 28, 2023 15:16    Post subject: Reply with quote
Thanks for the nice write up. much appreciated.

I actually do as @Alozaros:
Quote:
I do run SmartDNS, as it comes along with everything I need, all in one, privacy, versatility and options...and as I said you can run any DNS server, ADG, NextDNS, Quad9, Cloudflare and ect...there are many other DNS solutions for encrypted DNS around...too..


Saves you the hassle of installing anything as it is all already in place Smile

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
MomenMamdouh
DD-WRT User


Joined: 19 Sep 2017
Posts: 150
Location: Egypt

PostPosted: Wed Nov 29, 2023 14:24    Post subject: Reply with quote
Greetings again;
Alozaros wrote:

I never used its platform and that is why i admire your effort, to create such a guide...but somewhere you have to mention and explain how the encryption goes on...and where to select its options...and how to check if its working so no DNS leaks and so...


My objective is to install AGH, not to explain the theory of work. However, I don't mind adding answers to questions if it is necessary. Also, I have added the official link to the configuration page that explains in detail and in an easy way how to customize your DNS server

Adguard Home and Pi-hole are the top of DNS Resolvers and they are proven in use, no worries about dns leaks and you can check that by yourself by visiting dnsleaktest.com

Alozaros wrote:

Usually, most of the opkg stuff that offers encrypted DNS require presence/install of CA-certifiactes or CA-Bundle, along with OpenSSL or any other SSL (WlofSSL and ect.)...so you have to explain in your guide how encryption is going on...and people to make their choices..


If it is not mentioned, it means it is not needed !!

AGH dependencies are installed automatically

Alozaros wrote:

To be precise on one system, i do run SmartDNS as well, as it comes along with everything i need, all in one, privacy, versatility and options...


Very well, I don't encourage you to change your setup as long as you are satisfied.

AGH covers different needs that SmardDNS doesn't such as the use of your own filters and blocklists, per-user/device DNS servers, Filters, and Blocklists, DoQ, and graphical summary of your network DNS utilization.

_________________
Routers:
TP-Link Archer C7 v2-(EU)
TP-Link WR840n v3
TP-Link WR740n v5
MomenMamdouh
DD-WRT User


Joined: 19 Sep 2017
Posts: 150
Location: Egypt

PostPosted: Wed Nov 29, 2023 14:39    Post subject: Reply with quote
mwchang wrote:
Interesting! Thank you for the guide. Might augment my use of recursive DNS Unbound. Smile

I believe DNSmasq can forward DNS queries to this Adguard Home DNS. You only need to use Additonal Options to do it. The two can co-exist.



Yes, you can use dnsmasq beside AGH, which is not recommended from a performance/Latency point of view

Just skip step 2 and bind AGH to a different port other than port 53 (ex. 5353) in step 5, then add the following lines to dnsmasq additional options

Code:
no-resolv
server=127.0.0.1#5353


mwchang wrote:


I am wondering whether I could manage Adguard Home *WITHOUT* GUI. A DNS server should not need frequent adjustments. Smile

Is it possible to disable web interface? · AdguardTeam/AdGuardHome · Discussion #4172 · GitHub
https://github.com/AdguardTeam/AdGuardHome/discussions/4172


Let me check ..

_________________
Routers:
TP-Link Archer C7 v2-(EU)
TP-Link WR840n v3
TP-Link WR740n v5


Last edited by MomenMamdouh on Wed Nov 29, 2023 16:18; edited 4 times in total
ho1Aetoo
DD-WRT Guru


Joined: 19 Feb 2019
Posts: 2844
Location: Germany

PostPosted: Wed Nov 29, 2023 14:51    Post subject: Reply with quote
Quote:
10-For some reason dnsmasq doesn't announce AGH as a DNS Resolver for your LAN, if this is the case for you, you should add a DHCP option to dnsmasq additional options:
dhcp-option=6,Router-IP (ex. dhcp-option=6,192.168.2.1).


Simply enter the IP address of the DNS server under "Static DNS" and the problem is solved.

If you do not enter a DNS, dnsmasq cannot send a DNS server via DHCP.

Quote:
Yes, you can use dnsmasq beside AGH, which is not recommended from a performance/Latency point of view


lol bullshit

you can also use dnsmasq 5x in a row you will never notice a difference in your life
the latency is in the range of a thousandth of a second

simply deactivate caching, is sufficient if one dns server caches

_________________
Quickstart guides:
use Pi-Hole as simple DNS-Server with DD-WRT
VLAN configuration via GUI - 1 CPU port
VLAN configuration via GUI - 2 CPU ports (R7800, EA8500 etc)
MomenMamdouh
DD-WRT User


Joined: 19 Sep 2017
Posts: 150
Location: Egypt

PostPosted: Wed Nov 29, 2023 19:57    Post subject: Reply with quote
ho1Aetoo wrote:

Simply enter the IP address of the DNS server under "Static DNS" and the problem is solved.

If you do not enter a DNS, dnsmasq cannot send a DNS server via DHCP.



Tested and works Laughing

I updated the guide and credited you Smile

ho1Aetoo wrote:

you can also use dnsmasq 5x in a row you will never notice a difference in your life
the latency is in the range of a thousandth of a second

simply deactivate caching, is sufficient if one dns server caches



Sorry, I don't agree Embarassed

The performance will be affected for sure. And it is better not to pass on the problems of one tool to another.

_________________
Routers:
TP-Link Archer C7 v2-(EU)
TP-Link WR840n v3
TP-Link WR740n v5
Alozaros
DD-WRT Guru


Joined: 16 Nov 2015
Posts: 6333
Location: UK, London, just across the river..

PostPosted: Wed Nov 29, 2023 20:00    Post subject: Reply with quote
The very interesting stuff is the local interface is via http, but not via https...
does that mean that my 8 years old nephew, will use its wireshak skills and capture
my ADG log in credentials, while is on my local LAN pretending he is playing "mindcraft" and than things will go awry ... ?? Embarassed Rolling Eyes

Now imagine one of my routers is in student accommodation, where students are very crafty this days...and i've seen lots of routers drama... Laughing Laughing Razz

Otherwise ADG and your guide offer excellent control over...DNS...!

SmartDNS and DNScrypt, along with NextDNS have lots to learn..by the way SmartDNS has lots of blocking capabilities and tons of settings that ADG only can dream of, but it requires some basic skills...
Same for DNScrypt v2, but non of those has the friendly interface...as ADG (well may be NextDNS)..

Once again, thanks for the guide..im looking forward to give it a go once im back home...(hope my nephew will not come around)... Razz Razz

p.s. not bad to mention what dependencies ADG will install in order to provide the encryption/decryption...are you with me...?

_________________
Atheros
TP-Link WR740Nv1 ---DD-WRT 55009 WAP
TP-Link WR1043NDv2 -DD-WRT 55109 Gateway/DoT,Forced DNS,AP Isolation,Ad-Block,Firewall,VPN,x1VLAN
TP-Link WR1043NDv2 -DD-WRT 55052 Gateway/DoT,Forced DNS,Ad-Block,Firewall,x4VLAN,VPN
TP-Link WR1043NDv2 -Gargoyle OS 1.15.x AP,DNS,QoS,Quotas
Qualcomm-Atheros
Netgear R7800 --DD-WRT 55109 Gateway/DoT,AD-Block,Forced DNS,AP&Net Isolation,x3VLAN,Firewall,Vanilla
Netgear R9000 --DD-WRT 55052 Gateway/DoT,AD-Block,AP Isolation,Firewall,Forced DNS,x2VLAN,Vanilla
Broadcom
Netgear R7000 --DD-WRT 55109 Gateway/SmartDNS/DoH,AD-Block,Firewall,Forced DNS,x3VLAN,VPN
NOT USING 5Ghz ANYWHERE
------------------------------------------------------
Stubby DNS over TLS I DNSCrypt v2 by mac913
MomenMamdouh
DD-WRT User


Joined: 19 Sep 2017
Posts: 150
Location: Egypt

PostPosted: Wed Nov 29, 2023 23:04    Post subject: Reply with quote
Alozaros wrote:
The very interesting stuff is the local interface is via http, but not via https...
does that mean that my 8 years old nephew, will use its wireshak skills and capture
my ADG log in credentials, while is on my local LAN pretending he is playing "mindcraft" and than things will go awry ... ?? Embarassed Rolling Eyes

Now imagine one of my routers is in student accommodation, where students are very crafty this days...and i've seen lots of routers drama... Laughing Laughing Razz

Otherwise ADG and your guide offer excellent control over...DNS...!

SmartDNS and DNScrypt, along with NextDNS have lots to learn..by the way SmartDNS has lots of blocking capabilities and tons of settings that ADG only can dream of, but it requires some basic skills...
Same for DNScrypt v2, but non of those has the friendly interface...as ADG (well may be NextDNS)..

Once again, thanks for the guide..im looking forward to give it a go once im back home...(hope my nephew will not come around)... Razz Razz

p.s. not bad to mention what dependencies ADG will install in order to provide the encryption/decryption...are you with me...?


It's not practical to use https inside your network to access AGH dashboard. However, it is possible. AGH has encryption settings to use your own SSL certificate to encrypt your connection to AGH inside or outside your network.

AGH enables you to setup your home dns server with all the features of NextDNS for free, under your control, and without privacy issues.

I'm a fan of SmartDNS too, but AGH is more satisfying to me

You might got me wrong,AGH automatically install ca-bundle for the encryption/decryption. That's why I told you not to worry about the dependencies.

_________________
Routers:
TP-Link Archer C7 v2-(EU)
TP-Link WR840n v3
TP-Link WR740n v5
Alozaros
DD-WRT Guru


Joined: 16 Nov 2015
Posts: 6333
Location: UK, London, just across the river..

PostPosted: Thu Nov 30, 2023 7:41    Post subject: Reply with quote
MomenMamdouh wrote:
Alozaros wrote:
The very interesting stuff is the local interface is via http, but not via https...
does that mean that my 8 years old nephew, will use its wireshak skills and capture
my ADG log in credentials, while is on my local LAN pretending he is playing "mindcraft" and than things will go awry ... ?? Embarassed Rolling Eyes

Now imagine one of my routers is in student accommodation, where students are very crafty this days...and i've seen lots of routers drama... Laughing Laughing Razz

Otherwise ADG and your guide offer excellent control over...DNS...!

SmartDNS and DNScrypt, along with NextDNS have lots to learn..by the way SmartDNS has lots of blocking capabilities and tons of settings that ADG only can dream of, but it requires some basic skills...
Same for DNScrypt v2, but non of those has the friendly interface...as ADG (well may be NextDNS)..

Once again, thanks for the guide..im looking forward to give it a go once im back home...(hope my nephew will not come around)... Razz Razz

p.s. not bad to mention what dependencies ADG will install in order to provide the encryption/decryption...are you with me...?


It's not practical to use https inside your network to access AGH dashboard. However, it is possible. AGH has encryption settings to use your own SSL certificate to encrypt your connection to AGH inside or outside your network.

AGH enables you to setup your home dns server with all the features of NextDNS for free, under your control, and without privacy issues.

I'm a fan of SmartDNS too, but AGH is more satisfying to me

You might got me wrong, AGH automatically install ca-bundle for the encryption/decryption. That's why I told you not to worry about the dependencies.


Using https for local communication with its web interface is a must, otherwise you have to segment your network in order to be sure compromised device or client with malicious intentions will not take over...

Also ca-bundle provides certificates only, its not encryption/decryption engine...those are more likely: libopenssl, wolfssl and ect. and its good to know those as those get flaws and get patched from time to time... Razz

_________________
Atheros
TP-Link WR740Nv1 ---DD-WRT 55009 WAP
TP-Link WR1043NDv2 -DD-WRT 55109 Gateway/DoT,Forced DNS,AP Isolation,Ad-Block,Firewall,VPN,x1VLAN
TP-Link WR1043NDv2 -DD-WRT 55052 Gateway/DoT,Forced DNS,Ad-Block,Firewall,x4VLAN,VPN
TP-Link WR1043NDv2 -Gargoyle OS 1.15.x AP,DNS,QoS,Quotas
Qualcomm-Atheros
Netgear R7800 --DD-WRT 55109 Gateway/DoT,AD-Block,Forced DNS,AP&Net Isolation,x3VLAN,Firewall,Vanilla
Netgear R9000 --DD-WRT 55052 Gateway/DoT,AD-Block,AP Isolation,Firewall,Forced DNS,x2VLAN,Vanilla
Broadcom
Netgear R7000 --DD-WRT 55109 Gateway/SmartDNS/DoH,AD-Block,Firewall,Forced DNS,x3VLAN,VPN
NOT USING 5Ghz ANYWHERE
------------------------------------------------------
Stubby DNS over TLS I DNSCrypt v2 by mac913


Last edited by Alozaros on Thu Nov 30, 2023 14:03; edited 1 time in total
MomenMamdouh
DD-WRT User


Joined: 19 Sep 2017
Posts: 150
Location: Egypt

PostPosted: Thu Nov 30, 2023 12:16    Post subject: Reply with quote
Alozaros wrote:

using https for local communication with its web interface is a must otherwise you have to segment your network in order to be sure to compromised device or client with malicious intentions will take over ...


It's a very rare scenario, AGH doesn't need to be repeatedly configured. Therefore, you will not need to enter your credentials frequently.

Alozaros wrote:

also ca-bundle provides certificates only its not encryption/decryption engine...those are more likely: libopenssl, wolfssl and ect. and its good to know those as those get flaws and get patched from time to time... Razz


ca-bundle is the only external enabler needed for encrypted connections to the upstream servers. As for the encryption/decryption engine, it's a built-in feature in AGH, it does not depend on any additional software.

I think you're interested in delving into how AGH works, please visit their GitHub repository for more advanced information.

_________________
Routers:
TP-Link Archer C7 v2-(EU)
TP-Link WR840n v3
TP-Link WR740n v5
Goto page 1, 2, 3 ... 11, 12, 13  Next Display posts from previous:    Page 1 of 13
Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum