PROJECT 02 / HOMELAB / DNS & NETWORK SECURITY
Two DNS nodes.
A quieter network.
Network-wide DNS filtering on two Raspberry Pis running synced AdGuard Home instances, with DHCP handled by the Dream Machine Pro.
DNS settings via DHCP
Two synced Pis
Apply filtering policy
Allowed queries upstream
A simplified filtering flow. The Dream Machine Pro supplies DNS server settings through DHCP; the two AdGuard instances share synced configuration.
01 / THE PROBLEM
A network needs a consistent resolver.
Default DNS settings gave me little control over filtering or visibility into queries. I wanted filtering to be managed across the network rather than configured separately on each device.
I wanted a dedicated DNS layer shared by the home network: a place to manage filtering and see what domains devices are querying.
02 / WHAT I BUILT
Dedicated hardware. Shared configuration.
Two Raspberry Pis run AdGuard Home, connected to the 16-port UniFi switch. The AdGuard configuration is synced between them to keep the filtering setup consistent.
The Dream Machine Pro runs DHCP and provides clients with DNS server addresses as part of their network configuration. AdGuard Home handles DNS filtering on the Raspberry Pis.
Local service access
I access Unraid and Home Assistant by IP address. I am not currently using DNS rewrites in AdGuard Home.
Filtering across devices
AdGuard blocklists and additional community-maintained lists filter advertising, trackers, and selected unwanted domains. Centralized filtering also reaches devices that do not support browser extensions.
03 / ENGINEERING DECISIONS
DNS gets its own place to run.
Dedicated Raspberry Pi hardware separates DNS from the Unraid server and its application workloads. Rebuilding or rebooting an unrelated application host does not require taking down the Pi-hosted resolver with it.
The current setup adds a second AdGuard instance with synchronized configuration. That gives the two nodes a consistent policy; configuration sync is shown separately from physical network links in the lab diagram.
The original deployment used Cloudflare and Quad9 for upstream resolution, with Quad9 and Google configured as fallbacks. Upstream resolution sits behind the AdGuard filtering layer.
Two dedicated DNS nodes, with configuration synced between them and a shared filtering policy for the home network.
04 / THE OUTCOME
Filtering managed across the network.
Filtering is managed through the synced AdGuard instances instead of being repeated across individual devices. The DNS setup provides a shared place to manage filtering policy and review queries, while local services are accessed by IP address.
An earlier dashboard snapshot recorded approximately 45,000 queries, with about 8,600 blocked—roughly 19%. That is a historical snapshot from the original write-up, not a live counter for the current two-Pi setup.
05 / WHAT STAYED WITH ME
A small service with a wide reach.
Operating DNS at home made it much more concrete: name resolution is also a place to apply filtering policy and observe device behavior across the network.
The same ideas—consistent configuration, clear service boundaries, and an intentional resolution path—carry into larger infrastructure designs.
KEEP EXPLORING
More connections.
More possibilities.
Have a question about the project?
Let’s talk ↗