Running DNS filtering directly on a router makes sense for many networks. But in VPN deployments, especially those with multiple remote clients and limited edge hardware, there is another option: move DNS filtering to the VPN server.
TunGuard integrates AdGuard Home as a managed service on the cloud VPS, alongside the VPN server. This allows DNS filtering to be controlled centrally without requiring a separate AdGuard installation on every router or client.
The goal isn't to replace local DNS filtering everywhere. It's to make filtering an optional capability of the VPN infrastructure.
How it works
TunGuard runs AdGuard Home as a separate process and configures its DNS listener on the VPN server's tunnel address, normally port 53.
When a peer belongs to a policy group that permits AdGuard DNS filtering, TunGuard installs dedicated "iptables" rules to redirect that peer's standard DNS queries to AdGuard Home.
For example, a peer can have a WireGuard profile configured to use "1.1.1.1". Once that peer is assigned to an AdGuard-enabled policy group, its ordinary UDP and TCP DNS queries on port 53 are redirected on the server.
The client doesn't need a new WireGuard profile or a manual DNS change.
TunGuard also rebuilds the filtering rules when relevant peers or policy groups change, and removes the rules when filtering is disabled or AdGuard stops.
What this actually solves
1. Centralised filtering for VPN peers
Instead of maintaining separate blocklists on multiple devices, administrators can manage DNS filtering from one AdGuard Home instance. The same filtering policies can apply to selected peers across a VPN deployment.
2. Filtering can be enabled per policy group
Not every client needs the same DNS policy. With TunGuard, an administrator can enable AdGuard filtering for a particular group without applying it to every VPN peer.
Moving a peer between groups changes its filtering policy without requiring the WireGuard configuration to be regenerated.
3. Less work on the edge device
The router or client still handles its normal networking and tunnel traffic, but it doesn't need to run AdGuard Home or maintain its blocklists locally. DNS filtering happens on the server.
This can be useful when the edge device has limited resources, or when managing filtering across multiple remote sites would otherwise require additional configuration.
4. One place to manage DNS policies
Filter lists, custom rules, upstream resolvers and query logs are managed through AdGuard Home. TunGuard handles the integration with its VPN peers and policy groups.
An important limitation
The interception rules apply to ordinary DNS over UDP and TCP port 53. They do not automatically intercept DNS-over-HTTPS or DNS-over-TLS, because those protocols use encrypted connections rather than standard port-53 DNS.
For example, Android's Private DNS feature can bypass this interception when it uses DNS-over-TLS. Devices must use a DNS method that passes through the interception rules for this filtering mechanism to work.
This is DNS filtering, not a guarantee that every advertising or tracking connection will be blocked.
Why integrate it into the VPN server?
The useful part isn't simply running AdGuard Home on a VPS. It's connecting DNS filtering to the VPN's existing peer and policy management.
For TunGuard, that means administrators can decide which peers receive filtering, manage it centrally, and change policies without manually updating every client.
Local filtering remains a valid choice. Centralised filtering is another option when the VPN server is already the natural place to manage remote clients.
Documentation: AdGuard DNS Filtering - TunGuard
