Is it useful to have Adguard in GrapheneOS or overkill?

PaladinDaddy

Given the built-in privacy and security features in GrapheneOS, is it useful to have Adguard in GrapheneOS or is it overkill?

devkernel

PaladinDaddy

I wouldn’t say it’s overkill — it really depends on your setup and what level of control you want over DNS filtering.

In my case, I run AdGuard Home on my home network inside a Docker container, and I route all DNS queries through it. When I’m away from home, I connect through my WireGuard VPN, which uses the same AdGuard Home instance as the DNS resolver.

This way, I get consistent ad blocking both inside and outside my home network, along with DoH / DoT and DNSSEC validation.

GrapheneOS already provides excellent privacy and security features at the OS level (sandboxing, hardened network stack, etc.), but it doesn’t handle network-level ad or tracker blocking by itself. That’s where AdGuard Home complements it perfectly — without adding unnecessary overhead on the device.

So in short:

AdGuard Home + GrapheneOS = a solid combination, not overkill — especially if you’re already running your own DNS and VPN infrastructure.

chinook

PaladinDaddy quite a few people around here use Rethink DNS with filtering.

I used AdGuard on the old phone, now use RethinkDNS on the new one. Except for Rethink sometimes seizing and requiring stop/start, it's a great filter.

You can also try to use it with the additional wireguard tunnel (to protect the traffic from snooping by isps), but from the looks of it it's sometimes not working (for example used to work for me, but it suddenly broke a few weeks ago).

Skorp

Hello,

AdGuard would serve mostly as a DNS filter and ad-blocker which GrapheneOS does not come with outside of the content filter Vanadium has built-in.

Vanadium uses the Subresource Content Filtering Engine built in to Chromium with EasyList and EasyPrivacy as the filter lists.
https://grapheneos.org/features#vanadium

MineralWater

If you just want to block ads and trackers you could instead of installing an app configure a private DNS under "Network and Internet - Private DNS"

When you use DNS over tls the sites you visit aren't visible to the DNS provider.

The advantage of this is that you don't need extra battery for a constantly running app. And it's systemwide, means it also blocks ads in apps you use. (Not in YouTube, because of the technology YouTube uses to present ads)

Downsides are that sometimes they don't block everything, or too much. Luckily you can switch the private DNS on and off whenever needed. I personally never had problems so far.

Some DNS over TLS providers with adblocking:
dns.adguard-dns.com
adblock.dns.mullvad.net
dnsforge.de

So it you want to stay with Adguard, you just copy that into the private DNS settings and that's it.

avaluedcustomer

MineralWater

I have been using dnsforge.de for a while now and it works well for me. I like the fact that I don't need an extra app to block adds and trackers. They document which block lists they use, so it's easy to check.

freezet

MineralWater private DNS is good and all but there is no built in fallback , so i dont use it anymore, just in the browser settings

GrouchyGrape

MineralWater When you use DNS over tls the sites you visit aren't visible to the DNS provider.

This is not accurate. Using DoT/DoH makes your DNS queries unreadable to your ISP. Nothing more.

The DNS provider still knows what your queries are and your ISP still knows nearly all the sites you're going to.

MineralWater

GrouchyGrape

Thanks, I read elsewhere that it makes it unreadable, but they didn't say that this is only for the query that the ISP can see.

devkernel

chinook With how simple it is to set up AdGuard Home in docker, there’s no need to install anything on your phone… and for outside your home, just use WireGuard. Unless you’re behind CG-NAT, it’s the most functional setup — stable, unblockable, and fully compatible with WireGuard.

chinook

devkernel so in order to avoid installing one app (RethinkDNS), I'm supposed to install, configure and run docker server at home, (good thing I have spare hardware, PSU and switch port for this) install and configure adguard on there, configure wireguard server, partially expose my docker server to the internet on my router or consider granting permanent IPv6 address to it, generate config on the server, THEN install wireguard client on my phone and import the config, then notice it's not working, then change firewall settings at home, then get the result?

Unless I'm behind the CGNAT, because the additional two steps would be to purchase additional Internet connection and get another WAN router (my current one can only do the failover, not split tunneling).

Makes perfect sense :D

Semiconductor

IF you want to block/filter requests locally, and you only want to block Ads without using any VPN service on top, you could consider PersonalDNSfilter as well (https://github.com/IngoZenz/personaldnsfilter).
The GUI is very basic, but when running in background permanently, the additional Battery consumption is barely noticeable. Regarding Blocklists I noticed that the "HaGeZi" Lists are quite well maintained, you can find them in GitHub as well. But according to the majority in the Forum here, RethinkDNS is the way to go. The App offers way more options than PersonalDNSfilter but to me it looks as is the battery consumtion of that app is a bit higher as well.

devkernel

chinook That depends on your network. With Traefik, you can publish it without exposing it.
And ad blocking isn't just for mobile devices, but for all devices on your network.

chinook

devkernel this is just moving goalposts :)

Remember the original post:

is it useful to have Adguard in GrapheneOS

On the phone, on the go. Installing and getting basic adblocking config with Rethink takes about 2-3 mins? (I had to to do it on my other phone the other day).

Meanwhile "just wireguard to your home network and use your own AdGuard" is a chore and maybe a day's work unless you happen to have all the hardware necessary, good and safe home network configuration, right ISP, docker already installed, etc, etc.

Seriously, it's not even in the same ballpark. I have enough experience to configure every variant of that quickly, but this is really not an alternative and not a solution OP was looking for. I already have all the moving parts installed, but it's still worse solution (without even considering the DNS latency).

Also FWIW, tailscale/zerotier sidestep the CGNAT issue.

mmobder

chinook to support your claim re rethinkdns further - any private "server" will just add latency, whereis rdns on-device blocklist allow requests to not even leave your smartphone that is both most time- and energy-efficient approach.
And that's not talking about introducing single point of failure that (if failed) you have diminishing chances to maintain remotely.

Nowadays, you can even install rdns on e-ink android readers.
The only items left uncovered are smart devices.

The only my recent discovery with rdns is that's a must to have backup wireguard client in place.