onionvps

指南

使用AdGuard Home和Unbound的私有DNS

中级阅读时间 20 分钟更新时间 2026年5月12日
简短回答

AdGuard Home过滤并提供DNS-over-HTTPS；其后端Unbound进行完整递归，因此任何上游解析器都无法看到你的查询。在4美元的实例上，这对组合使用不到200 MB内存，并取代了关于你的最丰富的行为数据源——你的ISP的解析器。

01 将Unbound安装为递归解析器

Bind it to localhost on a non-standard port so AdGuard Home can take 53.

apt install -y unbound
cat >/etc/unbound/unbound.conf.d/local.conf <<'EOF'
server:
  interface: 127.0.0.1@5335
  do-ip6: yes
  prefetch: yes
  hide-identity: yes
  hide-version: yes
  qname-minimisation: yes
EOF
systemctl restart unbound

02 安装AdGuard Home

The installer sets up a systemd unit and a web interface on port 3000 for initial configuration.

curl -sSL https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -v

03 将AdGuard指向Unbound

In Settings → DNS, set the upstream to 127.0.0.1:5335 and disable all other upstreams. Full recursion means no third party sees your queries at all.

04 启用DNS-over-HTTPS

Get a certificate with Certbot, then enable DoH on 443 and DoT on 853 in the encryption settings. Clients then reach the resolver privately in transit as well as at rest.

certbot certonly --standalone -d dns.example.com

05 锁定安全

Restrict access by client IP, or require DoH with a secret path. An open resolver is recruited into DNS amplification attacks within days and will be null-routed.

常见问题

这比公共解析器更好吗？

就隐私而言，是的——借助完整递归，任何第三方都完全看不到你的查询。公共解析器因缓存规模而更快；这是用速度换可见性的取舍。

运行的成本是多少？

每月4美元。这是可用的最划算的有意义的隐私改进。