Skip to content

AdGuard Home

Network-wide DNS resolver with ad/tracker blocking, query log, and stats · https://ag.fmm.house

What it's for

AdGuard Home is the network's DNS resolver. Every device that uses it gets ads and trackers filtered out before they ever load, and you get a full query log and stats showing what's being asked for and what's being blocked. You manage blocklists and allow/deny rules centrally, so one change covers the whole house. This is an admin-oriented tool.

Getting in

  • Open: https://ag.fmm.house — the admin dashboard (stats, query log, filters, settings), login-gated. On the home Wi-Fi/LAN or over Tailscale.
  • Sign in: your AdGuard Home admin username + password. Admin-only.

Same name, two roles

ag.fmm.house serves the admin UI over HTTPS and answers encrypted DNS (DNS-over-TLS) on port 853 — the value you'd set as a device's Private DNS. Same hostname, different ports. (Traefik fronts the container's admin port 192.168.86.49:2003, which also reaches the UI directly.)

How to use it

View the query log and blocked stats

  • The Dashboard shows totals: queries handled, how many were blocked, top clients, and most-requested domains.
  • Query Log is the live feed of every lookup — filter by client, domain, or "blocked" to see exactly what a device is doing and why something didn't load.

Manage blocklists

  • Go to Filters → DNS blocklists to see the subscribed lists.
  • Add blocklist to subscribe to a new one (by URL), or toggle existing lists on/off. Use Check for updates to refresh them.

Allow and deny specific domains

  • Under Filters → Custom filtering rules, add rules to force-allow a domain that a list broke, or to block one that isn't caught.
  • From the Query Log, you can also click a domain to quickly Block or Unblock it — the fastest way to fix a false positive.

Point a device's Private DNS at it

  • On Android: Settings → Network → Private DNS → Private DNS provider hostname, and enter ag.fmm.house.
  • The device now resolves through AdGuard (with filtering) whenever it's on the LAN or Tailscale.

Tips

Tip

If a site or app breaks, open the Query Log, find the blocked domain, and add an allow rule — don't disable filtering wholesale.

  • ag.fmm.house is both the admin site (HTTPS) and the Private-DNS (DoT) endpoint; 192.168.86.49:2003 is the same UI directly if you prefer.
  • Encrypted DNS (DoT) via ag.fmm.house only works where the name resolves and is reachable — i.e. on the LAN or with Tailscale connected.