FAQ
Questions that arrive often enough to be worth answering once, properly.
Questions that arrive often enough to be worth answering once, properly.
Scope#
Does this replace the resolver?#
No, and it cannot. AdGuard HomePi-hole answers DNS; this reads its log. Switch this off and your network resolves exactly as before, minus the history.
Does it work with Pi-hole?#
Yes, on Pi-hole v6 or newer. Set DNS_PROVIDER=pihole and point PIHOLE_URL at it — and flip the switch at the top of this wiki to read every page as it applies there.
Everything this product is for — the history, the devices, the companies, the explorer, alerts — works identically, because all of it reads this dashboard’s own store rather than passing anything through. Two things differ: the control section, because the two resolvers do not agree on what settings exist, and the destinations map, which needs answer addresses that Pi-hole does not report.
Pi-hole v5 is not supported. v6 replaced the old PHP endpoints with a completely different API, and only the new one is implemented.
What exactly is missing on Pi-hole?#
Two things, and both are consequences of what FTL reports rather than decisions made here. The destinations map and every country, city and ASN column are absent, because the map is built from the addresses inside each answer and Pi-hole’s query API reports the kind of reply it sent but never the addresses in it. Hardware vendor labels are missing too, because those come from MAC addresses behind endpoints this does not read yet — that one is a gap rather than an impossibility.
The control section is also much smaller: Pi-hole gets the one switch the two resolvers share, blocking on or off, and the screens it has no concept of are hidden rather than shown broken.
Everything else is identical, because everything else reads this dashboard’s own store rather than passing anything through to the resolver.
Will Pi-hole v5 work?#
No. v6 replaced the old PHP endpoints with a completely different session-authenticated API, and only the new one is implemented. A 404 on /api/info/version is the usual symptom.
Can it read from two resolvers at once?#
One instance per install. Two resolvers means two installs and two dashboards. Merging them would need a source column on every fact row and a device identity that survives being seen by both, which is a real feature rather than a configuration option.
Does it send anything anywhere?#
No telemetry of any kind. The only outbound connections are to AdGuard HomePi-hole, to whatever notification service you configure, and to fetch a filter list when you explicitly ask it to preview one. Enrichment is entirely local files. See Security.
Running it#
Can I run it on the same box as the resolver?#
Yes, and that is the intended deployment. The installer does exactly this.The installer assumes it, and adds one port rather than touching Pi-hole’s. Combined they use well under a gigabyte of RAM.
Can I run it somewhere other than the resolver?#
Yes. Point ADGUARD_URLPIHOLE_URL at the resolver’s LAN address. The only requirement is that the box running this can reach AdGuard Home’s admin portPi-hole’s web interface, which is also its API, and that it has somewhere to keep a few hundred megabytes.
Does it work with AdGuard Home's own DoH/DoT server?#
Yes. Encrypted clients appear with a proto of doh, dot or doq, and if they announce a ClientID they are identified by it rather than by address, which is generally better identity than an IP.
Why is there no login?#
Deliberate, and explained at length in Security. Short version: an unaudited auth system written by one person is a false sense of security, and the honest answer for a LAN tool is a clear warning plus a documented way to put a real proxy in front.
The data#
Why do my numbers not match the resolver's?#
Three reasons, all expected. Its dashboard counts the buffer, which is a few hours, while this counts what it stored.Its dashboard counts what FTL holds for the window you picked; this counts what it ingested, which starts at install rather than at the beginning of FTL’s year. Its “blocked” includes some categories this treats separately. And a range boundary lands differently: this stores UTC milliseconds and buckets by hour.
Why is one domain enormous compared to what I expected?#
Usually a low TTL rather than heavy use: a name cached for thirty seconds is looked up constantly. Look at the device breakdown on the domain page; if it is one device asking every few seconds, that is a beacon, not popularity.
Can I delete a device's history?#
Not through the interface, deliberately: a dashboard that can quietly erase parts of the log is a dashboard whose numbers cannot be trusted. It is a plain SQLite file, so it is aDELETE away if you genuinely need it. Stop the container first.
Can I export it?#
The explorer has a CSV export that respects the current filters. For anything bigger, query the database directly; see Data model for the schema.
This demo#
Is any of this real traffic?#
None of it. Every device, domain, timestamp and coordinate is generated. See the generated household.
Why can I not change the time range here?#
A static export cannot read a query string. What is different here covers this and the three other differences.