Adguard Home DNS Encryption Question

[useronegit]

Is it possible to block access/connection to the website to my Adguard Home if I want to use my Adguard Home from outside? For example, if I give a colleague my DoH address, he can access the website when he enters the domain in the browser, although he needs the password, but I want to prevent it in general, so that only the DNS works.

[fernvenue]

Hi, I think maybe you can use NGINX on your device to only allow the DNS over HTTPS service to the outside.

• NGINX: Install

Most Linux distributions and BSD variants have NGINX in the usual package repositories and they can be installed via whatever method is normally used to install software (apt on Debian, emerge on Gentoo, ports on FreeBSD, etc).

For example, I can just install NGINX on any Debian based Linux system like this: sudo apt install nginx.

• NGINX Blog: Using NGINX as a DoT or DoH Gateway

Since we already have AdGuardHome to provide DoH service for us, the actual config file might be simpler than the example in the above link, so we can just use NGINX to proxy the AdGuardHome DoH service like this:

server {
	listen 443 ssl;
	ssl_certificate /etc/nginx/ssl/certs/doh.local.pem;
	ssl_certificate_key /etc/nginx/ssl/private/doh.local.pem;

	# Return 444 for reset non-DoH connection
	location / {
		return 444;
	}

	# Reverse proxy AdGuardHome DoH service
	# Use your actual IP address and port here
	location /dns-query {
		proxy_pass http://127.0.0.1:8443/dns-query;
		proxy_http_version 1.1;
		proxy_set_header Connection "";
	}
}

PS: Here, we use HTTP1.1 for enabling keepalive connections to AdGuardHome.

For more information about that: NGINX documentation.