Internet safety with AdGuard DNS (for KeeneticOS version 3.7.4 and earlier)

This article is valid for versions of KeeneticOS 3.7.4 and earlier. For configuration on the current software version, see article Сontent filtering and ad blocking options.

AdGuard DNS free domain name service is an alternative way to block ads, protect personal data, enable secure browser search and protect children from adult content. Internet filter provides the necessary minimum protection against advertising, tracking and phishing.

In AdGuard DNS, there are four modes (policies) that determine access to a particular category of sites:

  • 'No Protection' — no traffic filtering is provided.
  • 'Base' — AdGuard DNS servers are used to provide a reliable and secure connection but do not filter out any elements.
  • 'No Ads' — AdGuard DNS servers are used to block ads, tracking and phishing.
  • 'Family-friendly' — AdGuard DNS servers are used to block ads, tracking and phishing + block adult sites + safe search.

You may find more information about the work of AdGuard DNS on the site.

NOTE: Important! The SafeDNS, Cloudflare DNS and AdGuard DNS content filtering services cannot work simultaneously. Only one of the services can be used.

Before setting up the Internet filter, register your devices according to the Connected devices registration article.

Now select 'AdGuard DNS' in the 'Service' field on the 'Internet safety' page.


The 'Assignment of protection policies to devices' section will appear. Configuring in this section comes down to assigning the protection policies described above to regular home network devices (registered on your Keenetic) and devices that appear periodically (Guest network and unregistered devices).

For example, we will assign the 'Family-friendly' protection policy to three registered devices and assign the 'No protection' policy to all other devices.

In the 'Default policy' field, you can specify a policy applied to all unregistered devices, including those connected to the Guest segment.


Now check the operation of the Internet safety service and ad filtering on websites.

From a registered device through a web browser, we will try to access a resource that may contain prohibited content:


Access to this resource will be blocked, and the corresponding message will be displayed.

NOTE: Important! When you enable AdGuard DNS, the DNS over TLS and DNS over HTTPS protocols are automatically used to protect DNS traffic from interception and provide additional privacy. You can check it through your router's command-line interface (CLI) by running the show adguard-dns availability command:

(config)> show adguard-dns availability
available: yes
port: 53
doh-supported: yes
doh-available: yes
dot-supported: yes
dot-available: yes

For more information, see the DNS-over-TLS and DNS-over-HTTPS proxy servers for DNS requests encryption article.

TIP: Note: If AdGuard does not block ads, or breaks a website or application, please send a complaint directly to the developers at

Starting with KeeneticOS 3.9, support for Internet filters with IPv6 has been implemented.

Was this article helpful?

116 out of 133 found this helpful