Openwrt Router Firmware

windwaver

windwaver

High Supremacy Member
Joined
Apr 28, 2000
Messages
34,635
Reaction score
2,908
xiaofan said:
Main router (eg: 192.168.50.1) -- EA8100 V1 in AP mode with WiFi disabled, static IP address (eg: 192.168.50.240).

EA8100 V1 running OpenWRT and Adblock-fast and maybe also DNS over HTTPS.

Set the main router LAN clients to use 192.168.50.240 as the DNS server.
Click to expand...
@xiaofan , which blocklist you suggest using?
 
windwaver

windwaver

High Supremacy Member
Joined
Apr 28, 2000
Messages
34,635
Reaction score
2,908
xiaofan said:
Just my personal preference.
1) "Hagezi - Pro" or "OISD - Big" as the first one.
2) Then "StevenBlack - Unified hosts" as the second one.

I believe the blocked sites in #2 are already included in #1. So #2 is just a backup in case there is an issue with #1.
Click to expand...
@xiaofan I'm using StevenBlack and seeing the traffic from the log is amazing, the memory and CPU usage is very low even with DoH enabled.

BTW, what kind of ads are we blocking? Seems like some still can get through.
 
X

xiaofan

High Supremacy Member
HWZ Insider
Joined
Sep 16, 2018
Messages
36,956
Reaction score
12,537
windwaver said:
@xiaofan I'm using StevenBlack and seeing the traffic from the log is amazing, the memory and CPU usage is very low even with DoH enabled.

BTW, what kind of ads are we blocking? Seems like some still can get through.
Click to expand...

Some ads like YouTube video ads are difficult to filter out by DNS filtering.

Some websites may detect adblocker and prevent you from viewing the websites.

++++++
From Google AI Summary.
DNS filtering fails on YouTube because YouTube serves ads and video content from the exact same domain (youtube.com), so a DNS-level blocker cannot tell them apart without breaking the video playback itself.

DNS filtering struggles with any ad or content delivery system that hosts its promotional material on the exact same domains used for its primary content, or uses first-party subdomains that mimic regular functionality.

1. In-Stream Sponsored Content & Sponsored Posts
  • Social Media Ads: Sponsored posts on Facebook, Instagram, X (Twitter), and TikTok bypass DNS filters. Because these platforms serve ads directly into your feed from their own core servers (e.g., facebook.com), blocking the ad domain means blocking the entire social network.
  • Sponsored Search Results: The paid ad results at the top of Google Search or Bing cannot be hidden by DNS filtering, though clicking on them might result in a blocked page if the redirect URL belongs to a known tracking domain.
  • Twitch Ads: Like YouTube, Twitch injects ads directly into the live video stream from the same media servers delivering the broadcast.
2. Native First-Party App Tracking & Analytics
  • Smart TVs & Streaming Boxes: DNS filters often fail to block tracking and sponsored recommendations built into the home screens of Roku, Fire TV, and Apple TV. Blocking their domains entirely frequently breaks device updates, app stores, or core system functionality.
  • Mobile App Telemetry: Many mobile applications bundle their analytics and ads directly into their main server API endpoints, preventing a DNS filter from separating legitimate app data from usage tracking.
3. Circumvention Tactics (Hardcoded DNS)
  • Smart Speakers: Devices like Google Nest/Home and Amazon Echo are often hardcoded to bypass your router's DNS settings entirely. They are programmed to query Google's (8.8.8.8) or Amazon's own DNS servers directly, completely ignoring your custom DNS filter unless you set up advanced firewall rules (like LAN redirection) to force them back.
  • DoH/DoT Apps: An increasing number of modern apps and browsers use DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) by default. If an app uses its own secure, encrypted DNS protocol, it bypasses your local network-level DNS filter entirely.
4. Malicious Content on Legitimate Sites
  • Phishing Links on Cloud Services: DNS filters cannot block a phishing page hosted on a legitimate domain like ://google.com or sharepoint.com. If the filter blocks the root domain to stop the scam, it accidentally blocks the entire cloud service for the user.
 
You must log in or register to reply here.
Important Forum Advisory Note
This forum is moderated by volunteer moderators who will react only to members' feedback on posts. Moderators are not employees or representatives of HWZ Forums. Forum members and moderators are responsible for their own posts. Please refer to our Community Guidelines and Standards and Terms and Conditions for more information.
Top