AdGuard Home Requirements: RAM, Ports and OS for a VPS

AdGuard Home is a DNS server that blocks ads and trackers for every device that uses it. Running it on a VPS instead of a box under the TV means it keeps filtering when your phone is on cellular or hotel Wi-Fi. The requirements are light, but a few of them trip people up on a fresh server.

What does AdGuard Home need to run?

AdGuard Home is written in Go and distributed as a single binary. The project publishes builds for Linux, macOS, Windows and FreeBSD across x86 and ARM, and there’s an official Docker image, adguard/adguardhome. No database server, no PHP, no separate web server. The admin interface is built into the binary.

On a Linux server, the checklist is short:

• Root, or permission to bind low ports. DNS lives on port 53, and only privileged processes can listen there by default. The official install script runs it as a root-owned systemd service.
• Nothing else on port 53. On Ubuntu, that’s usually systemd-resolved. More on that below.
• A public IP that doesn’t change. Clients point at an address, so it has to stay put.
• A firewall you control. This one matters more than RAM, for reasons covered in the ports section.

AdGuard Home also includes a DHCP server. Leave it off on a VPS. It’s built for handing out addresses on a home LAN, and a server in a datacenter has no LAN of yours to serve.

How much RAM and disk does AdGuard Home use?

The binary itself is small. Memory and disk grow with three things you control, not with the software:

• Blocklists. Every filter rule gets loaded into memory. A couple of well-maintained lists stay light. Stacking dozens of large overlapping lists is what pushes memory up, and it rarely blocks much more.
• The query log. Every lookup is written to the data directory. Retention is set under Settings > General settings.
• Statistics. The dashboard counters keep their own file with a separate retention period.

So the honest answer to “how much RAM” is that it depends on your lists more than on how many devices you have. The practical approach: install it, add the lists you want, use it normally for a day or two, then measure.

systemctl status AdGuardHome | grep -i memory
du -sh /opt/AdGuardHome/data

If the query log grows faster than you’d like, shorten its retention or turn on client IP anonymization in the same settings panel. Shorter retention has a side benefit: less of your household’s browsing history sitting on a server.

CPU is rarely the bottleneck. DNS queries are tiny, and once the cache warms up, most answers come straight from memory without a trip upstream.

Which ports does AdGuard Home need open?

These are AdGuard Home’s default listening ports; open only the ones you plan to use.

Here’s the rule that matters most: don’t leave plain port 53 open to the whole internet. An open resolver gets found by scanners within days and abused for DNS amplification, where spoofed queries make your server flood someone else with large replies. That traffic counts against you and can get your IP flagged.

There are three safer setups, and you can combine them:

1. Firewall plus allow list. Restrict port 53 to your own IP addresses, and add the same addresses under Settings > DNS settings > Access settings > Allowed clients. Works well when your home IP is stable.
2. DNS inside a VPN. Run WireGuard on the same server and point clients at the resolver’s tunnel address. WireGuard runs over UDP and authenticates every peer, so port 53 never faces the internet at all.
3. Encrypted DNS only. Serve DNS-over-TLS, DNS-over-HTTPS or DNS-over-QUIC with a hostname like dns.example.com and a TLS certificate. Android’s Private DNS setting speaks DNS-over-TLS, so a phone needs only the hostname. Use client IDs or the allow list so the encrypted endpoint isn’t a public service either.

How do you install AdGuard Home on an Ubuntu VPS?

Install first, then free port 53. The official script downloads the binary to /opt/AdGuardHome and registers a systemd service:

curl -s -S -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sudo sh -s -- -v

Next, deal with systemd-resolved. On Ubuntu it runs a stub listener on 127.0.0.53 port 53, and the setup wizard will refuse the port while it’s there. This is the fix from AdGuard’s own documentation:

sudo mkdir -p /etc/systemd/resolved.conf.d
sudo tee /etc/systemd/resolved.conf.d/adguardhome.conf > /dev/null <<'EOF'
[Resolve]
DNS=127.0.0.1
DNSStubListener=no
EOF
sudo mv /etc/resolv.conf /etc/resolv.conf.backup
sudo ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf
sudo systemctl reload-or-restart systemd-resolved

The server itself now asks 127.0.0.1 for DNS, so its own lookups will fail until you finish the wizard. Do the next two steps without wandering off.

Lock down the firewall before you open the wizard. Replace 203.0.113.10 with your home IP:

sudo ufw allow 22/tcp
sudo ufw allow from 203.0.113.10 to any port 53
sudo ufw allow from 203.0.113.10 to any port 3000 proto tcp
sudo ufw allow from 203.0.113.10 to any port 80 proto tcp
sudo ufw enable

Then browse to http://198.51.100.20:3000 (your server’s IP), set the admin and DNS listen addresses, and create the admin account. After setup, close port 3000 again with sudo ufw delete allow from 203.0.113.10 to any port 3000 proto tcp.

Last, pick upstream resolvers under Settings > DNS settings. Encrypted upstreams over DNS-over-HTTPS or DNS-over-TLS keep the hop between your VPS and the upstream private too, not just the hop from your phone.

Does a remote AdGuard Home slow down browsing?

A cached answer costs one round trip to your resolver. An uncached one adds the trip from the resolver to its upstream. Operating systems and browsers keep their own DNS caches as well, so a typical page load triggers fewer fresh lookups than you’d expect.

Distance to the server still matters, and it’s the one place where location earns a mention. From our Boise network we measure under 5 ms to Treasure Valley businesses, 14 ms to Salt Lake City, 22 ms to Portland and 23 ms to Seattle. If you live in the Northwest or Mountain West, a resolver in Boise sits close to you.

AdGuard Home fits on our two smallest NVMe VPS presets, shown here with monthly and yearly prices.

Starter leaves headroom to run WireGuard on the same server, which pairs well with setup 2 above. Annual billing is 12 months for the price of 10, and an extra IPv4 is $5/mo if you want the resolver on its own address. You can compare presets and dial it in on the NVMe VPS plans page.

DNS traffic is small, but transfer is still an allowance: if you ever go over it, the port is throttled, never billed, and extra transfer is $1.50/TB. For a personal or small-team resolver, the bigger risk is the open-resolver traffic from the ports section, which is one more reason to keep port 53 locked down.