Feature request: Extend AdGuard VPN protection to private networks and self-hosted services

Issue Details

Title: Feature request: Extend AdGuard VPN protection to private networks and self-hosted services

Summary

I would like AdGuard VPN to extend its privacy and security model beyond public Internet traffic and also provide secure access to private networks and self-hosted services.

This idea was originally discussed on Reddit, and AdGuard Support recommended submitting it here as a feature request so it can be properly tracked.

Background

Today, I understand AdGuard VPN primarily as a service that protects traffic between a device and the public Internet.

However, many privacy-conscious users are increasingly reducing their reliance on public cloud and Internet-hosted services and moving more services onto infrastructure they control themselves.

For example:

• NAS servers
• Home servers
• Virtualization platforms
• Private web applications
• Photo and file storage
• Internal dashboards
• Other self-hosted services

In this kind of environment, protecting only Internet-bound traffic is no longer enough.

I also want to securely access my own private network without exposing those services directly to the public Internet.

At the moment, this usually requires running another VPN or overlay networking solution alongside AdGuard VPN, such as WireGuard, Tailscale, or another similar solution.

This increases complexity. It can also create conflicts on Android, where only one VPN service can normally be active at a time.

Proposed feature

I would like AdGuard VPN itself to support secure connectivity to trusted private networks.

Possible capabilities could include:

• Access to private subnets
• Device-to-site connectivity
• Device-to-device connectivity
• Private subnet routing
• Split tunneling between public Internet traffic and private network traffic
• Access control for trusted devices
• Private DNS resolution
• Applying AdGuard DNS or filtering policies to private network traffic where appropriate

For example:

Phone / Tablet
|
| AdGuard VPN
|
+--------------------> Public Internet
|
+--------------------> Home / Private Network
|
+-- NAS
+-- Home server
+-- Self-hosted applications
+-- Internal services

Ideally, users could access their own private infrastructure through the same trusted networking environment they already use for Internet privacy.

Why this would be useful

For privacy-focused users, the security boundary increasingly extends beyond the public Internet.

A typical setup today may look like:

Internet privacy:
AdGuard VPN

Private network access:
WireGuard / Tailscale / another VPN

Ideally, this could become:

Internet privacy + private network access:
AdGuard VPN

This could reduce:

• VPN conflicts on Android
• Configuration complexity
• Multiple VPN clients
• Separate trust models
• Additional infrastructure that users need to maintain themselves

It could also make self-hosting safer and more accessible for users who do not want to expose private services directly to the public Internet.

Clarification

This is not specifically a request to embed Tailscale into AdGuard or simply add generic WireGuard client functionality.

The main request is:

Extend AdGuard VPN's existing privacy model so that it can also protect and provide access to the user's own private network.

I understand that similar requests related to WireGuard, Tailscale, or simultaneous VPN usage may have been discussed previously.

The difference here is that private network connectivity would be a native capability of AdGuard VPN itself rather than something that depends on another VPN application.

Example use case

Suppose a user has a home server containing services that should never be exposed directly to the public Internet.

The user could:

1. Register the home network or gateway with AdGuard VPN.
2. Authorize specific devices.
3. Connect to AdGuard VPN normally.
4. Securely access both the public Internet and authorized private services.

For example:

192.168.10.0/24
10.0.0.0/24

could be registered as trusted private networks and routed only to authorized devices.

Final thought

I do not think modern privacy protection should stop at traffic going to public Internet services.

For users who increasingly rely on self-hosted infrastructure, their own private network is also part of their privacy boundary.

What I would ultimately like to have is something that goes beyond a traditional "VPN for accessing the Internet" and behaves more like a lightweight, privacy-oriented UTM (Unified Threat Management) platform for individuals and home networks.

I am not suggesting that AdGuard should become a full enterprise UTM appliance. However, I would like to see capabilities such as these integrated under a single trust model:

• VPN connectivity to the public Internet
• Blocking of ads, trackers, and malicious domains
• DNS protection
• Secure remote access to private networks
• Access to self-hosted services
• Device- and network-based access control
• Split tunneling and routing policies
• Traffic policies where appropriate

In other words:

Privacy VPN + DNS / Filtering + Private Network Access + Access Policy

as one integrated product.

Today, users often need to combine AdGuard VPN, AdGuard DNS, WireGuard or Tailscale, router firewall rules, and other networking components separately.

If these functions could be more tightly integrated within the AdGuard ecosystem, it could reduce configuration and operational complexity while protecting both the public Internet side and the user's own private network.

If AdGuard VPN evolved in this direction, I think it could become more than just a VPN service. It could become a kind of personal or home "Privacy / Security Gateway", approaching the role of a lightweight UTM designed for privacy-conscious users.

Note: English is not my first language, so I used AI to help translate and polish this post. However, the ideas, arguments, and examples are my own. This is not AI-generated slop; AI was only used as a translation and proofreading tool.

Proposed solution

none

Alternative solution

none