---
title: "AdGuard Home — DNS Rewrites for Internal Homelab Services"
aliases: [adguard-dns-rewrites, adguard-internal-dns, adguard-wildcard, homelab-internal-domains]
tags: [adguard, dns, homelab, npm, ssl, wildcard, proxmox, selfhosted]
sources:
  - "daily/2026-04-21.md"
created: 2026-04-21
updated: 2026-04-21
---

# AdGuard Home — DNS Rewrites for Internal Homelab Services

AdGuard Home's DNS Rewrite feature maps custom domains to internal IP addresses, enabling clean URLs for homelab services (e.g., `grafana.ai-impress.com` → `192.168.1.x`). Combined with a wildcard SSL certificate and an Nginx Proxy Manager (NPM) reverse proxy, this creates a fully functional internal HTTPS stack without exposing services publicly.

## Key Points

- **AdGuard DNS Rewrites** are the homelab equivalent of split-horizon DNS — internal domain → internal IP, invisible to public DNS
- Use a **wildcard rewrite** (`*.ai-impress.com → NPM IP`) rather than per-service rewrites — one entry covers all future services automatically
- **NPM is the single ingress point** — AdGuard points all `*.ai-impress.com` to NPM's IP, NPM routes to individual services by hostname
- The wildcard SSL cert (`*.ai-impress.com`) is installed once in NPM and reused for all proxy hosts — no per-service cert management
- **Security model:** internal-only resolution means only devices on LAN or Tailscale VPN can reach these domains; public DNS returns NXDOMAIN for the internal subdomain

## Details

### Architecture

```
Client (LAN or Tailscale VPN)
  │
  ├─ DNS query: grafana.ai-impress.com
  │   └─ AdGuard Home: *.ai-impress.com → 192.168.1.225 (NPM)
  │
  └─ HTTPS request: grafana.ai-impress.com → 192.168.1.225:443
      └─ NPM: SNI routing → Grafana container (192.168.1.209:3000)
               Wildcard cert *.ai-impress.com ✓
```

### Setting Up DNS Rewrites in AdGuard Home

1. Open AdGuard Home UI → **Filters → DNS Rewrites**
2. Click **Add DNS Rewrite**
3. Domain: `*.ai-impress.com`
4. Answer: `<NPM IP>` (e.g., `192.168.1.225`)
5. Save

This single wildcard entry handles all subdomains. For the bare domain (`ai-impress.com`) pointing to a different IP, add a separate non-wildcard entry.

### Adding a Proxy Host in NPM

For each internal service:

1. NPM UI → **Proxy Hosts → Add Proxy Host**
2. Domain Names: `grafana.ai-impress.com`
3. Forward Hostname/IP: `192.168.1.209` (the container IP)
4. Forward Port: `3000`
5. SSL Certificate: select the existing `*.ai-impress.com` wildcard cert
6. Enable **Force SSL**
7. Save

The wildcard cert covers all `*.ai-impress.com` without needing individual cert requests.

### Wildcard SSL Certificate Setup in NPM

The wildcard cert must be obtained via DNS challenge (not HTTP challenge), since the domain isn't publicly routable. Steps in NPM:

1. **SSL Certificates → Add SSL Certificate → Let's Encrypt**
2. Domain Names: `*.ai-impress.com` (and optionally `ai-impress.com`)
3. Enable **Use a DNS Challenge**
4. Select DNS provider (Cloudflare, Route53, etc.) and enter API credentials
5. Let's Encrypt issues the wildcard cert via DNS-01 challenge
6. All proxy hosts using this cert auto-renew with NPM's built-in renewal

### AdGuard Home vs Pi-hole for DNS Rewrites

| Feature | AdGuard Home | Pi-hole |
|---------|-------------|---------|
| DNS Rewrites UI | Built-in, native | Requires custom HOSTS file or pihole-FTL config |
| Wildcard rewrites | ✓ native | Limited — per-domain only |
| Encrypted DNS (DoH/DoT) | ✓ built-in | Requires unbound sidecar |
| Per-client overrides | ✓ | Limited |
| Service blocking (TikTok, etc.) | ✓ one-click | Manual list |

AdGuard Home is the correct choice when DNS rewrite management and encrypted DNS are needed alongside ad-blocking.

### Internal Services with DNS Rewrites (Example Stack)

| Subdomain | Target | Port |
|-----------|--------|------|
| `homarr.ai-impress.com` | CT107 | 7575 |
| `grafana.ai-impress.com` | CT109 | 3000 |
| `kuma.ai-impress.com` | CT110 | 3001 |
| `vault.ai-impress.com` | CT104 (Vaultwarden) | 80 |
| `proxmox.ai-impress.com` | Proxmox host | 8006 |

All routed through NPM with the wildcard cert. Only accessible to devices that query AdGuard (LAN or Tailscale with Override local DNS enabled).

## Related Concepts

- [[wiki/concepts/tailscale-dns-homelab]] — how Tailscale is configured to use AdGuard as its DNS server, making internal domains accessible on mobile
- [[wiki/concepts/homarr-proxmox-integration]] — Homarr served via this NPM + AdGuard DNS stack
- [[wiki/concepts/nodejs-ssl-system-trust-store]] — SSL trust issues that can arise when services call each other internally
- [[wiki/homelab/_index]] — full homelab infrastructure context

## Sources

- [[daily/2026-04-21.md]] — AdGuard DNS rewrites were not configured; setup initiated using wildcard `*.ai-impress.com → NPM IP`; AdGuard Home selected over Pi-hole for built-in DNS rewrite UI, DoH/DoT, and per-client settings
