diff --git a/sys/machines/hopper/lab/adguard.nix b/sys/machines/hopper/lab/adguard.nix
deleted file mode 100644
index 23cb09c..0000000
--- a/sys/machines/hopper/lab/adguard.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-  vars,
-  lib,
-  ...
-}: {
-  services.adguardhome = {
-    enable = true;
-    mutableSettings = false;
-    port = 23489;
-    settings = {
-      dhcp.enabled = false;
-      dns = {
-        upstream_dns = [
-          "quic://dns.nextdns.io"
-          "https://cloudflare-dns.com/dns-query"
-          "tls://unfiltered.adguard-dns.com"
-          "https://dns10.quad9.net/dns-query"
-        ];
-        bind_hosts = [vars.tailnet.hopper];
-        bootstrap_dns = ["1.1.1.1" "8.8.8.8"];
-      };
-      filtering = {
-        rewrites = lib.concatLists (lib.mapAttrsToList (n: v: [
-            {
-              domain = "${n}.xun.host";
-              answer = v;
-            }
-            {
-              domain = "*.${n}.xun.host";
-              answer = v;
-            }
-          ])
-          vars.tailnet);
-      };
-      filters = [
-        {
-          name = "OISD (Big)";
-          url = "https://big.oisd.nl";
-          enabled = true;
-        }
-      ];
-    };
-  };
-}
diff --git a/sys/machines/hopper/lab/caddy.nix b/sys/machines/hopper/lab/caddy.nix
index 624c968..bc54e14 100644
--- a/sys/machines/hopper/lab/caddy.nix
+++ b/sys/machines/hopper/lab/caddy.nix
@@ -49,7 +49,6 @@ in {
 
       slskd = mkPrivateEntry "slskd" "localhost:${toString config.services.slskd.settings.web.port}";
       prometheus = mkPrivateEntry "prometheus" "${bridge}:${toString config.services.prometheus.port}";
-      adguard = mkPrivateEntry "adguard" "${bridge}:${toString config.services.adguardhome.port}";
       transmission = mkPrivateEntry "transmission" "localhost:${toString config.services.transmission.settings.rpc-port}";
       dash = mkPrivateEntry "dash" "${bridge}:${toString config.services.homepage-dashboard.listenPort}";
       absPriv = mkPrivateEntry "abs" "${bridge}:${toString config.services.audiobookshelf.port}";
diff --git a/sys/machines/hopper/lab/default.nix b/sys/machines/hopper/lab/default.nix
index 26ee7a7..f8084af 100644
--- a/sys/machines/hopper/lab/default.nix
+++ b/sys/machines/hopper/lab/default.nix
@@ -3,9 +3,9 @@
 {
   imports = [
     ./acme.nix
-    ./adguard.nix
     ./audiobookshelf.nix
     ./caddy.nix
+    ./dnsmasq.nix
     ./glances.nix
     ./homepage.nix
     ./minecraft.nix
diff --git a/sys/machines/hopper/lab/dnsmasq.nix b/sys/machines/hopper/lab/dnsmasq.nix
new file mode 100644
index 0000000..2e5e881
--- /dev/null
+++ b/sys/machines/hopper/lab/dnsmasq.nix
@@ -0,0 +1,16 @@
+{
+  vars,
+  lib,
+  ...
+}: {
+  services.dnsmasq = {
+    enable = true;
+    resolveLocalQueries = false;
+    settings = {
+      server = ["1.1.1.1" "8.8.8.8"];
+      interface = ["tailscale0"];
+      bind-interfaces = true;
+      address = lib.mapAttrsToList (n: v: "/.${n}.xun.host/${v}") vars.tailnet;
+    };
+  };
+}
diff --git a/sys/machines/hopper/lab/homepage.nix b/sys/machines/hopper/lab/homepage.nix
index 2cc3bd6..6383b21 100644
--- a/sys/machines/hopper/lab/homepage.nix
+++ b/sys/machines/hopper/lab/homepage.nix
@@ -57,16 +57,6 @@ in {
               icon = "audiobookshelf";
             };
           }
-          {
-            "adguard home" = {
-              href = "http://adguard.hopper.xun.host";
-              icon = "adguard-home";
-              widget = {
-                type = "adguard";
-                url = "http://localhost:${toString config.services.adguardhome.port}";
-              };
-            };
-          }
           {
             "prometheus" = {
               href = "http://prometheus.hopper.xun.host";
diff --git a/sys/machines/hopper/lab/vpn-namespace.nix b/sys/machines/hopper/lab/vpn-namespace.nix
index 73878e4..06ca2eb 100644
--- a/sys/machines/hopper/lab/vpn-namespace.nix
+++ b/sys/machines/hopper/lab/vpn-namespace.nix
@@ -6,7 +6,6 @@
   networking.firewall = let
     allowTcpFromVPNToDefaultPorts = [
       config.services.prometheus.port
-      config.services.adguardhome.port
       config.services.vaultwarden.config.ROCKET_PORT
       config.services.homepage-dashboard.listenPort
       config.services.audiobookshelf.port