onionvps

ガイド

使用AdGuard Home和Unbound的私有DNS

中級20分で読めます更新日 2026年5月12日
短い回答

AdGuard Home负责过滤并提供DNS-over-HTTPS服务；其后运行的Unbound执行完整递归解析，确保没有任何上游解析器能看到你的查询。在$4的实例上，这两者占用内存不到200MB，却能取代关于你行为数据最丰富的单一来源——你的ISP的解析器。

01 安装Unbound作为递归解析器

Bind it to localhost on a non-standard port so AdGuard Home can take 53.

apt install -y unbound
cat >/etc/unbound/unbound.conf.d/local.conf <<'EOF'
server:
  interface: 127.0.0.1@5335
  do-ip6: yes
  prefetch: yes
  hide-identity: yes
  hide-version: yes
  qname-minimisation: yes
EOF
systemctl restart unbound

02 AdGuard Homeをインストール

The installer sets up a systemd unit and a web interface on port 3000 for initial configuration.

curl -sSL https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -v

03 将AdGuard指向Unbound

In Settings → DNS, set the upstream to 127.0.0.1:5335 and disable all other upstreams. Full recursion means no third party sees your queries at all.

04 启用DNS-over-HTTPS

Get a certificate with Certbot, then enable DoH on 443 and DoT on 853 in the encryption settings. Clients then reach the resolver privately in transit as well as at rest.

certbot certonly --standalone -d dns.example.com

05 ロックダウン

Restrict access by client IP, or require DoH with a secret path. An open resolver is recruited into DNS amplification attacks within days and will be null-routed.

よくある質問

这比公共解析器更好吗？

私下里说，是的——完整递归解析使你完全不需要第三方查看你的查询。公共解析器因缓存更大而速度更快；这是速度与隐私之间的取舍。

运行费用是多少？

每月$4。可用的最划算的隐私提升方案没有之一。