What is BrambleGate?
BrambleGate sits in front of your existing ad-block resolver
(Pi-hole / AdGuard Home / Technitium) and handles the things those tools
don't: local hostnames, per-VLAN answers, encrypted DNS listeners, and
discovering .local devices. Everything it doesn't own locally
is forwarded straight to your upstream resolver, so it's an addition to
your setup, not a replacement.
What it does
- Local
home.arparecords, managed live in a web GUI - Per-VLAN split-horizon answers for the same name
- DoT/DoH/DoQ listeners with real, auto-renewing certs
- Bridges
.localmDNS devices into stablehome.arpanames - Forwards everything else upstream to your ad-block resolver
What it doesn't do
- Replace your ad-block resolver — it forwards to one
- Ad blocking / filtering itself
- Distributed or multi-node deployment
- Require inbound port exposure for encrypted DNS certs (uses ACME DNS-01)
Features
- Local records — static
home.arpanames managed in a web GUI, applied live with no restart. - Per-VLAN split-horizon — the same name can resolve differently (or not at all) depending on which VLAN the client is on.
- Encrypted DNS — DoT (and DoH/DoQ) listeners with a real, auto-renewing certificate obtained over ACME DNS-01 — no inbound port exposure required.
- mDNS bridge — discover
.localdevices and make them resolvable as stablehome.arpanames.
Quick start
You need Docker. BrambleGate listens on port 53, so nothing else on the host may already be bound to it.
# Grab the compose file
curl -O https://raw.githubusercontent.com/mallardduck/BrambleGate/main/deploy/docker-compose.yml
docker compose up -d
On first run, with no settings.yaml, BrambleGate writes a working
default that forwards everything to 1.1.1.1 — so DNS resolves
immediately. Then open the GUI at http://localhost:8080, set
Upstream DNS to your existing ad-block resolver, and add local records.