On this page
If enabling OpenClash and AdGuard Home together breaks the network, map the DNS path first
OpenClash and AdGuard Home both want to process DNS, but have different roles. AdGuard Home handles filtering, rewrites, and query logs; the OpenClash core's DNS aligns name resolution with proxy rules. They can coexist as long as each query moves in only one direction.
When “domestic sites work but some domains time out,” “the AdGuard query log is empty,” or “enabling OpenClash causes household-wide SERVFAIL,” do not rush to replace upstream servers.
Write down the DNS received by clients through DHCP, which service accepts router port 53, AdGuard's upstream, and the port where the OpenClash core listens. If a query eventually returns to an earlier service, it forms a loop.
Identify these entry points first
| Entry point | Common role | Do not confuse it with |
|---|---|---|
| Router TCP/UDP 53 | Default DNS endpoint used by LAN devices | dnsmasq and AdGuard cannot both exclusively bind the same address and port |
| AdGuard Home DNS listener | Receives queries, filters them, and forwards them upstream | Web administration ports such as 3000 are not DNS ports |
| OpenClash core DNS | Resolves according to the mode and coordinates with rules | A common internal listener is 127.0.0.1:7874, but verify it on the runtime page and in logs |
| Browser DoH / Android Private DNS | The client resolves directly through an external service | It may bypass both services on the router |
Confirm actual listeners and forwarding; do not rely only on LuCI toggles
Connect to OpenWrt over SSH and identify which processes listen on 53, the internal OpenClash DNS port, and the port configured for AdGuard. If 53 is already occupied, the other service may never have started. Even if both pages say they are running, a firewall redirect may bypass the order you expected.
ss -lntup | grep -E '(:53|:7874|:5335)'
uci show dhcp | grep -E 'server|port|noresolv'
logread | grep -Ei 'dnsmasq|AdGuardHome|OpenClash.*DNS' | tail -n 80Record these results first
- Processes listening on TCP 53 and UDP 53
- Actual AdGuard Home DNS listening address and port
- DNS listening port shown on the OpenClash status page
- Current dnsmasq server target
- Whether the firewall contains a DNS redirect / hijack
- Recoverable backups of OpenWrt and AdGuard configuration before editing
Either topology can work, but choose only one direction
The principle in official OpenClash DNS instructions is straightforward: it should be the only upstream for dnsmasq. If another plugin also intercepts 53 or forwards DNS, disable one interception method and define the order between the two services.
In practice, AdGuard can sit before OpenClash, or OpenClash can receive queries first and then call AdGuard.
Choose a path based on the capabilities you want to keep
| Path | Query direction | Advantages | Tradeoff |
|---|---|---|---|
| AdGuard first | LAN DNS entry → AdGuard → OpenClash DNS → external upstream | AdGuard can more easily log each client and filter first | You must disable OpenClash's early interception of LAN 53 |
| OpenClash first | LAN / dnsmasq → OpenClash → AdGuard → external upstream | Domains enter OpenClash first, centralizing Fake-IP and rule handling | AdGuard usually sees only queries from the router/core, reducing the detail in client statistics |
If AdGuard client statistics matter, let it receive queries first
This path can be written as “client 53 entry → AdGuard Home → 127.0.0.1:7874 → OpenClash external upstream.” Disable local DNS interception in OpenClash DNS settings so the firewall does not capture LAN 53 queries too early.
Under “Settings → DNS Settings → Upstream DNS Servers” in AdGuard Home, remove other upstreams that create branches and keep only the current OpenClash core DNS listening address.
127.0.0.1:7874 is a common example in OpenClash documentation, not a fixed value to copy blindly. Confirm the actual port from OpenClash status, configuration, and ss output.
Whether AdGuard uses 53 and dnsmasq moves to another port, or dnsmasq forwards to AdGuard, depends on the existing OpenWrt integration. Whichever method you choose, LAN 53 must enter AdGuard only once.
After editing, verify each step in query order
AdGuard starts
Logs contain no bind: address already in use, and both TCP and UDP listeners match expectations.
OpenClash DNS listens on an internal port
The local system shows 7874 or the actual port owned by Mihomo/OpenClash.
Disable OpenClash LAN DNS interception
After restarting, inspect the firewall and startup log to confirm that no rule runs ahead of AdGuard.
AdGuard forwards only to OpenClash
The query log shows client addresses, and a new allowed domain receives a response.
If Fake-IP and rule consistency matter more, let OpenClash receive queries first
This path keeps OpenClash local DNS interception and disables AdGuard Home's own redirect or interception of LAN 53. Let AdGuard listen on one nonconflicting local port, such as 127.0.0.1:5335, then enter that actual address under custom upstreams in OpenClash “Override Settings → DNS Settings.”
AdGuard's upstream must continue to point to a real external DNS service—not 127.0.0.1:7874, router LAN:53, or any address that reenters OpenClash.
Here, OpenClash receives client queries and asks AdGuard for the real upstream result. The AdGuard log often shows only the router itself as the client; that is the expected cost of this topology.
LAN client
-> dnsmasq / OpenClash DNS hijack
-> OpenClash DNS
-> AdGuard Home 127.0.0.1:5335
-> external upstream DNSThree common problems all look like “slow DNS” but require different fixes
The log repeatedly shows the same domain, followed by SERVFAIL
Common cause:OpenClash and AdGuard are each configured as the other's upstream, creating a query loop
Resolution:Draw arrows through the upstream addresses and remove the entry that points back to the preceding layer.
The AdGuard query log is empty, but websites open
Common cause:OpenClash or the firewall intercepts 53 before AdGuard
Resolution:If you choose AdGuard first, disable the conflicting interception and inspect NAT/nftables rule order.
AdGuard fails to start with address already in use
Common cause:dnsmasq or another instance already owns the same address and port
Resolution:Choose a single listener for 53, then use a different local port for internal forwarding.
Computers work, but phones occasionally bypass filtering
Common cause:IPv6 DNS, Android Private DNS, or browser DoH resolves externally
Resolution:For testing, disable independent encrypted DNS everywhere and inspect DHCPv6/RDNSS advertisements.
Household DNS fails when OpenClash stops
Common cause:The only upstream points to a core port that is no longer listening
Resolution:Prepare a one-action rollback to a reachable external DNS service, or have the shutdown script restore the dnsmasq upstream at the same time.
Cache hides problems. After changing service order, restart the relevant services, clear DNS cache on the test client or reconnect its Wi-Fi, then query a domain never visited before. Repeatedly opening a cached website proves only that an old answer remains.
Finally, verify filtering, routing, and shutdown fallback together
Complete acceptance from one test computer
Confirm the client's DNS
The Server in nslookup output should be the intended router or AdGuard address, not an unexpected public DNS server.
Query an allowed domain
Use an uncached domain; response time should be normal, and AdGuard/OpenClash logs should appear in the selected order.
Query a filtering rule
Temporarily add one test rule in AdGuard, confirm that the response follows the filter setting, then remove the rule.
Observe proxy rules
Visit a domain that requires proxying; OpenClash connection records should retain the domain and match the expected policy.
Restart services separately
Restart AdGuard, dnsmasq, and OpenClash in the actual startup order; listeners and upstream direction should remain unchanged.
Execute rollback
When disabling OpenClash, restore DNS to a reachable upstream according to the plan so LAN devices can still resolve ordinary domains.
nslookup example.com 192.168.1.1
nslookup www.iana.org 192.168.1.1Passing acceptance should produce specific results: 53 has only one intended entry point, AdGuard sees queries according to the selected topology, OpenClash receives domains and applies rules, new domains do not loop or time out, and disabling either component has a defined rollback. These results matter more than making both pages say “Running.”