AGH doesn't work anymore

[Muska-Ami]

I installed AGH on Home Assistant and forwarded all dns to AGH by set upstream DNS on Dnsmasq, but AGH doesn't block any AD hosts and reply the true IP for the AD hosts:

Sat Sep 19 17:48:13 2026 daemon.info dnsmasq[17]: 1525 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca/60840 query[AAAA] pagead2.googleadservices.com from 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca
Sat Sep 19 17:48:13 2026 daemon.info dnsmasq[18]: 1625 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca/52343 query[A] pagead2.googleadservices.com from 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca
Sat Sep 19 17:48:13 2026 daemon.info dnsmasq[18]: 1625 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca/52343 forwarded pagead2.googleadservices.com to 10.10.0.20
Sat Sep 19 17:48:13 2026 daemon.info dnsmasq[18]: 1625 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca/52343 reply pagead2.googleadservices.com is 120.233.71.230
Sat Sep 19 17:48:13 2026 daemon.info dnsmasq[17]: 1525 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca/60840 forwarded pagead2.googleadservices.com to 10.10.0.20
Sat Sep 19 17:48:13 2026 daemon.info dnsmasq[17]: 1525 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca/60840 reply pagead2.googleadservices.com is NODATA-IPv6
Sat Sep 19 17:48:13 2026 daemon.info dnsmasq[19]: 1725 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca/54242 query[AAAA] pagead2.googleadservices.com from 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca
Sat Sep 19 17:48:13 2026 daemon.info dnsmasq[20]: 1825 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca/61169 query[A] pagead2.googleadservices.com from 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca
Sat Sep 19 17:48:13 2026 daemon.info dnsmasq[19]: 1725 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca/54242 forwarded pagead2.googleadservices.com to 10.10.0.20
Sat Sep 19 17:48:13 2026 daemon.info dnsmasq[19]: 1725 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca/54242 reply pagead2.googleadservices.com is NODATA-IPv6
Sat Sep 19 17:48:13 2026 daemon.info dnsmasq[20]: 1825 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca/61169 forwarded pagead2.googleadservices.com to 10.10.0.20
Sat Sep 19 17:48:13 2026 daemon.info dnsmasq[20]: 1825 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca/61169 reply pagead2.googleadservices.com is 120.233.71.230
Sat Sep 19 17:48:13 2026 daemon.info dnsmasq[21]: 1925 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca/51718 query[AAAA] pagead2.googleadservices.com from 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca
Sat Sep 19 17:48:13 2026 daemon.info dnsmasq[22]: 2025 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca/57769 query[A] pagead2.googleadservices.com from 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca
Sat Sep 19 17:48:13 2026 daemon.info dnsmasq[23]: 2125 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca/64799 query[HTTPS] pagead2.googleadservices.com from 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca
Sat Sep 19 17:48:13 2026 daemon.info dnsmasq[21]: 1925 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca/51718 forwarded pagead2.googleadservices.com to 10.10.0.20
Sat Sep 19 17:48:13 2026 daemon.info dnsmasq[21]: 1925 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca/51718 reply pagead2.googleadservices.com is NODATA-IPv6
Sat Sep 19 17:48:13 2026 daemon.info dnsmasq[22]: 2025 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca/57769 forwarded pagead2.googleadservices.com to 10.10.0.20
Sat Sep 19 17:48:13 2026 daemon.info dnsmasq[22]: 2025 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca/57769 reply pagead2.googleadservices.com is 120.233.71.230
Sat Sep 19 17:48:13 2026 daemon.info dnsmasq[23]: 2125 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca/64799 forwarded pagead2.googleadservices.com to 10.10.0.20
Sat Sep 19 17:48:13 2026 daemon.info dnsmasq[23]: 2125 2409:8a5c:a636:5160:d93:a3e7:a79b:61ca/64799 reply pagead2.googleadservices.com is <HTTPS>

[XNinety9]

Your "Check filtering" result and the query log disagree because the check tool isn't testing what your real queries go through. When no client is entered, it always evaluates with filtering forced on, so it says "blocked" even when filtering is actually off for real traffic. Two settings cause exactly this:

1. Global filtering is off. Settings → General settings → "Block domains using filters and hosts files". The header can still show protection as enabled.
2. The client 10.10.0.1 has its own settings with filtering disabled. Since dnsmasq forwards everything, all your queries come from the router (10.10.0.1). If that IP is a persistent client (Settings → Client settings) with "Use global settings" unticked and filtering off, nothing is filtered.

To tell which one it is, run the check again with 10.10.0.1 as the client identifier. If it now says the domain isn't filtered, it's the client settings (2). If it still says blocked, it's the global toggle (1).

I reproduced both on a test instance: in both cases the check without a client says "blocked by rule", while real queries get the real IP.

Side note: with dnsmasq in front, AdGuard Home only ever sees the router, so per-device statistics and per-client rules can't work. If you want those, have your DHCP server hand out AdGuard Home as the DNS server directly.

[Muska-Ami]

Thanks for the reply; I've fixed the issue. For some reason, the AGH configuration disabled global filtering after the update, so I just had to re-enable it.