1 <!-- markdownlint-disable -->
3 # DNS based ad/abuse domain blocking
6 A lot of people already use adblocker plugins within their desktop browsers, but what if you are using your (smart) phone, tablet, watch or any other (wlan) gadget!? Getting rid of annoying ads, trackers and other abuse sites (like facebook) is simple: block them with your router. When the DNS server on your router receives DNS requests, you will sort out queries that ask for the resource records of ad servers and return a simple 'NXDOMAIN'. This is nothing but **N**on-e**X**istent Internet or Intranet domain name, if domain name is unable to resolved using the DNS server, a condition called the 'NXDOMAIN' occurred.
9 * Support of the following fully pre-configured domain blocklist sources (free for private usage, for commercial use please check their individual licenses)
11 | Source | Enabled | Size | Focus | Information |
12 | :------------------ | :-----: | :--- | :--------------- | :-------------------------------------------------------------------------------- |
13 | adaway | x | S | mobile | [Link](https://github.com/AdAway/adaway.github.io) |
14 | adguard | x | L | general | [Link](https://adguard.com) |
15 | adguard_tracking | | L | tracking | [Link](https://github.com/AdguardTeam/cname-trackers) |
16 | android_tracking | | S | tracking | [Link](https://github.com/Perflyst/PiHoleBlocklist) |
17 | andryou | | L | compilation | [Link](https://gitlab.com/andryou/block/-/blob/master/readme.md) |
18 | anti_ad | | L | compilation | [Link](https://github.com/privacy-protection-tools/anti-AD/blob/master/README.md) |
19 | antipopads | | L | compilation | [Link](https://github.com/AdroitAdorKhan/antipopads-re) |
20 | anudeep | | M | compilation | [Link](https://github.com/anudeepND/blacklist) |
21 | bitcoin | | S | mining | [Link](https://github.com/hoshsadiq/adblock-nocoin-list) |
22 | cpbl | | XL | compilation | [Link](https://github.com/bongochong/CombinedPrivacyBlockLists) |
23 | disconnect | x | S | general | [Link](https://disconnect.me) |
24 | doh_blocklist | | S | doh_server | [Link](https://github.com/dibdot/DoH-IP-blocklists) |
25 | easylist | | M | compilation | [Link](https://easylist.to) |
26 | easyprivacy | | M | tracking | [Link](https://easylist.to) |
27 | firetv_tracking | | S | tracking | [Link](https://github.com/Perflyst/PiHoleBlocklist) |
28 | games_tracking | | S | tracking | [Link](https://www.gameindustry.eu) |
29 | hblock | | XL | compilation | [Link](https://hblock.molinero.dev) |
30 | lightswitch05 | | XL | compilation | [Link](https://github.com/lightswitch05/hosts) |
31 | notracking | | XL | tracking | [Link](https://github.com/notracking/hosts-blocklists) |
32 | oisd_big | | XXL | general | [Link](https://oisd.nl) |
33 | oisd_nsfw | | XXL | porn | [Link](https://oisd.nl) |
34 | oisd_small | | L | general | [Link](https://oisd.nl) |
35 | openphish | | S | phishing | [Link](https://openphish.com) |
36 | phishing_army | | S | phishing | [Link](https://phishing.army) |
37 | reg_cn | | S | reg_china | [Link](https://easylist.to) |
38 | reg_cz | | S | reg_czech+slovak | [Link](https://easylist.to) |
39 | reg_de | | S | reg_germany | [Link](https://easylist.to) |
40 | reg_es | | S | reg_espania | [Link](https://easylist.to) |
41 | reg_fi | | S | reg_finland | [Link](https://github.com/finnish-easylist-addition) |
42 | reg_fr | | M | reg_france | [Link](https://forums.lanik.us/viewforum.php?f=91) |
43 | reg_id | | S | reg_indonesia | [Link](https://easylist.to) |
44 | reg_it | | S | reg_italy | [Link](https://easylist.to) |
45 | reg_jp | | S | reg_japan | [Link](https://github.com/k2jp/abp-japanese-filters) |
46 | reg_kr | | S | reg_korea | [Link](https://github.com/List-KR/List-KR) |
47 | reg_nl | | S | reg_netherlands | [Link](https://easylist.to) |
48 | reg_pl | | M | reg_poland | [Link](https://kadantiscam.netlify.com) |
49 | reg_ro | | S | reg_romania | [Link](https://easylist.to) |
50 | reg_ru | | S | reg_russia | [Link](https://easylist.to) |
51 | reg_se | | S | reg_sweden | [Link](https://github.com/lassekongo83/Frellwits-filter-lists) |
52 | reg_vn | | S | reg_vietnam | [Link](https://bigdargon.github.io/hostsVN) |
53 | smarttv_tracking | | S | tracking | [Link](https://github.com/Perflyst/PiHoleBlocklist) |
54 | spam404 | | S | general | [Link](https://github.com/Dawsey21) |
55 | stevenblack | | VAR | compilation | [Link](https://github.com/StevenBlack/hosts) |
56 | stopforumspam | | S | spam | [Link](https://www.stopforumspam.com) |
57 | utcapitole | | VAR | general | [Link](https://dsi.ut-capitole.fr/blacklists/index_en.php) |
58 | wally3k | | S | compilation | [Link](https://firebog.net/about) |
59 | whocares | | M | general | [Link](https://someonewhocares.org) |
60 | winhelp | | S | general | [Link](https://winhelp2002.mvps.org) |
61 | winspy | | S | win_telemetry | [Link](https://github.com/crazy-max/WindowsSpyBlocker) |
62 | yoyo | x | S | general | [Link](https://pgl.yoyo.org/adservers) |
64 * List of supported and fully pre-configured adblock sources, already active sources are pre-selected.
65 <b><em>To avoid OOM errors, please do not select too many lists!</em></b>
66 List size information with the respective domain ranges as follows:
67 • <b>S</b> (-10k), <b>M</b> (10k-30k) and <b>L</b> (30k-80k) should work for 128 MByte devices,
68 • <b>XL</b> (80k-200k) should work for 256-512 MByte devices,
69 • <b>XXL</b> (200k-) needs more RAM and Multicore support, e.g. x86 or raspberry devices.
70 • <b>VAR</b> (50k-500k) variable size depending on the selection.
71 * Zero-conf like automatic installation & setup, usually no manual changes needed
72 * Simple but yet powerful adblock engine: adblock does not use error prone external iptables rulesets, http pixel server instances and things like that
73 * Supports five different DNS backend formats: dnsmasq, unbound, named (bind), kresd or raw (e.g. used by dnscrypt-proxy)
74 * Supports four different SSL-enabled download utilities: uclient-fetch, wget, curl or aria2c
75 * Supports SafeSearch for google, bing, duckduckgo, yandex, youtube and pixabay
76 * Supports RPZ-trigger 'RPZ-CLIENT-IP' to always allow/deny certain DNS clients based on their IP address (currently only supported by bind dns backend)
77 * Fast downloads & list processing as they are handled in parallel running background jobs with multicore support
78 * Supports a wide range of router modes, even AP modes are supported
79 * Full IPv4 and IPv6 support
80 * Provides top level domain compression ('tld compression'), this feature removes thousands of needless host entries from the blocklist and lowers the memory footprint for the DNS backend
81 * Provides a 'DNS File Reset', where the generated DNS blocklist file will be purged after DNS backend loading to save storage space
82 * Source parsing by fast & flexible regex rulesets, all rules and source information are placed in an external/compredd JSON file ('/etc/adblock/adblock.sources.gz')
83 * Overall duplicate removal in generated blocklist file 'adb_list.overall'
84 * Additional local blacklist for manual overrides, located in '/etc/adblock/adblock.blacklist'
85 * Additional local whitelist for manual overrides, located in '/etc/adblock/adblock.whitelist'
86 * Quality checks during blocklist update to ensure a reliable DNS backend service
87 * Minimal status & error logging to syslog, enable debug logging to receive more output
88 * Procd based init system support ('start', 'stop', 'restart', 'reload', 'enable', 'disable', 'running', 'status', 'suspend', 'resume', 'query', 'report', 'list', 'timer')
89 * Auto-Startup via procd network interface trigger or via classic time based startup
90 * Suspend & Resume adblock temporarily without blocklist reloading
91 * Provides comprehensive runtime information
92 * Provides a detailed DNS Query Report with DNS related information about client requests, top (blocked) domains and more
93 * Provides a powerful query function to quickly find blocked (sub-)domains, e.g. for whitelisting
94 * Provides an easily configurable blocklist update scheduler called 'Refresh Timer'
95 * Includes an option to generate an additional, restrictive 'adb_list.jail' to block access to all domains except those listed in the whitelist file. You can use this restrictive blocklist manually e.g. for guest wifi or kidsafe configurations
96 * Includes an option to force DNS requests to the local resolver
97 * Automatic blocklist backup & restore, these backups will be used in case of download errors and during startup
98 * Send notification E-Mails in case of a processing error or if the overall domain count is ≤ 0
99 * Add new adblock sources on your own, see example below
100 * Strong LuCI support, all relevant options are exposed to the web frontend
103 * [OpenWrt](https://openwrt.org), tested with the stable release series and with the latest rolling snapshot releases.
104 <b>Please note:</b> Devices with less than 128 MByte RAM are _not_ supported!
105 * A usual setup with an enabled DNS backend at minimum - dumb AP modes without a working DNS backend are _not_ supported
106 * A download utility with SSL support: 'wget', 'uclient-fetch' with one of the 'libustream-*' ssl libraries, 'aria2c' or 'curl' is required
107 * A certificate store such as 'ca-bundle' or 'ca-certificates', as adblock checks the validity of the SSL certificates of all download sites by default
108 * Optional E-Mail notification support: for E-Mail notifications you need to install the additional 'msmtp' package
109 * Optional DNS Query Report support: for DNS reporting you need to install the additional package 'tcpdump-mini' or 'tcpdump'
110 * Optional support for gnu awk as alternative to the busybox default, install the additional package 'gawk'
112 ## Installation & Usage
113 * Update your local opkg repository (_opkg update_)
114 * Install 'adblock' (_opkg install adblock_). The adblock service is enabled by default
115 * Install the LuCI companion package 'luci-app-adblock' (_opkg install luci-app-adblock_)
116 * It's strongly recommended to use the LuCI frontend to easily configure all aspects of adblock, the application is located in LuCI under the 'Services' menu
117 * Update from a former adblock version is easy. During the update a backup is made of the old configuration '/etc/config/adblock-backup' and replaced by the new config - that's all
119 ## Adblock CLI Options
120 * All important adblock functions are accessible via CLI as well.
122 ~# /etc/init.d/adblock
123 Syntax: /etc/init.d/adblock [command]
126 start Start the service
127 stop Stop the service
128 restart Restart the service
129 reload Reload configuration files (or restart if service does not implement reload)
130 enable Enable service autostart
131 disable Disable service autostart
132 enabled Check if service is started on boot
133 suspend Suspend adblock processing
134 resume Resume adblock processing
135 query <domain> Query active blocklists and backups for a specific domain
136 report [<search>] Print DNS statistics with an optional search parameter
137 list [<add>|<add_utc>|<add_eng>|<add_stb>|<remove>|<remove_utc>|<remove_eng>|<remove_stb>] <source(s)> List/Edit available sources
138 timer [<add> <tasks> <hour> [<minute>] [<weekday>]]|[<remove> <line no.>] List/Edit cron update intervals
139 version Print version information
140 running Check if service is running
141 status Service status
142 trace Start with syscall trace
145 ## Adblock Config Options
146 * Usually the auto pre-configured adblock setup works quite well and no manual overrides are needed
148 | Option | Default | Description/Valid Values |
149 | :----------------- | :--------------------------------- | :--------------------------------------------------------------------------------------------- |
150 | adb_enabled | 1, enabled | set to 0 to disable the adblock service |
151 | adb_srcarc | -, /etc/adblock/adblock.sources.gz | full path to the used adblock source archive |
152 | adb_srcfile | -, /tmp/adb_sources.json | full path to the used adblock source file, which has a higher precedence than the archive file |
153 | adb_dns | -, auto-detected | 'dnsmasq', 'unbound', 'named', 'kresd' or 'raw' |
154 | adb_fetchutil | -, auto-detected | 'uclient-fetch', 'wget', 'curl' or 'aria2c' |
155 | adb_fetchparm | -, auto-detected | manually override the config options for the selected download utility |
156 | adb_fetchinsecure | 0, disabled | don't check SSL server certificates during download |
157 | adb_trigger | -, not set | trigger network interface or 'not set' to use a time-based startup |
158 | adb_triggerdelay | 2 | additional trigger delay in seconds before adblock processing begins |
159 | adb_debug | 0, disabled | set to 1 to enable the debug output |
160 | adb_nice | 0, standard prio. | valid nice level range 0-19 of the adblock processes |
161 | adb_forcedns | 0, disabled | set to 1 to force DNS requests to the local resolver |
162 | adb_dnsdir | -, auto-detected | path for the generated blocklist file 'adb_list.overall' |
163 | adb_dnstimeout | 10 | timeout in seconds to wait for a successful DNS backend restart |
164 | adb_dnsinstance | 0, first instance | set to the relevant dns backend instance used by adblock (dnsmasq only) |
165 | adb_dnsflush | 0, disabled | set to 1 to flush the DNS Cache before & after adblock processing |
166 | adb_dnsallow | -, not set | set to 1 to disable selective DNS whitelisting (RPZ-PASSTHRU) |
167 | adb_lookupdomain | example.com | external domain to check for a successful DNS backend restart or 'false' to disable this check |
168 | adb_portlist | 53 853 5353 | space separated list of firewall ports which should be redirected locally |
169 | adb_report | 0, disabled | set to 1 to enable the background tcpdump gathering process for reporting |
170 | adb_reportdir | /tmp | path for DNS related report files |
171 | adb_repiface | -, auto-detected | name of the reporting interface or 'any' used by tcpdump |
172 | adb_replisten | 53 | space separated list of reporting port(s) used by tcpdump |
173 | adb_repchunkcnt | 5 | report chunk count used by tcpdump |
174 | adb_repchunksize | 1 | report chunk size used by tcpdump in MB |
175 | adb_represolve | 0, disabled | resolve reporting IP addresses using reverse DNS (PTR) lookups |
176 | adb_backup | 1, enabled | set to 0 to disable the backup function |
177 | adb_backupdir | /tmp | path for adblock backups |
178 | adb_tmpbase | /tmp | path for all adblock related runtime operations, e.g. downloading, sorting, merging etc. |
179 | adb_safesearch | 0, disabled | set to 1 to enforce SafeSearch for google, bing, duckduckgo, yandex, youtube and pixabay |
180 | adb_safesearchlist | -, not set | Limit SafeSearch to certain provider (see above) |
181 | adb_safesearchmod | 0, disabled | set to 1 to enable moderate SafeSearch filters for youtube |
182 | adb_mail | 0, disabled | set to 1 to enable notification E-Mails in case of a processing errors |
183 | adb_mailreceiver | -, not set | receiver address for adblock notification E-Mails |
184 | adb_mailsender | no-reply@adblock | sender address for adblock notification E-Mails |
185 | adb_mailtopic | adblock notification | topic for adblock notification E-Mails |
186 | adb_mailprofile | adb_notify | mail profile used in 'msmtp' for adblock notification E-Mails |
187 | adb_mailcnt | 0 | minimum domain count to trigger E-Mail notifications |
188 | adb_jail | 0 | set to 1 to enable the additional, restrictive 'adb_list.jail' creation |
189 | adb_jaildir | /tmp | path for the generated jail list |
192 **Change the DNS backend to 'unbound':**
193 No further configuration is needed, adblock deposits the final blocklist 'adb_list.overall' in '/var/lib/unbound' by default.
194 To preserve the DNS cache after adblock processing please install the additional package 'unbound-control'.
196 **Change the DNS backend to 'bind':**
197 Adblock deposits the final blocklist 'adb_list.overall' in '/var/lib/bind' by default.
198 To preserve the DNS cache after adblock processing please install the additional package 'bind-rdnc'.
199 To use the blocklist please modify '/etc/bind/named.conf':
201 in the 'options' namespace add:
202 response-policy { zone "rpz"; };
204 and at the end of the file add:
207 file "/var/lib/bind/adb_list.overall";
208 allow-query { none; };
209 allow-transfer { none; };
213 **Change the DNS backend to 'kresd':**
214 Adblock deposits the final blocklist 'adb_list.overall' in '/etc/kresd', no further configuration needed.
215 <b>Please note:</b> The knot-resolver (kresd) is only available on Turris devices and does not support the SafeSearch functionality yet.
217 **Use restrictive jail modes:**
218 You can enable a restrictive 'adb_list.jail' to block access to all domains except those listed in the whitelist file. Usually this list will be generated as an additional list for guest or kidsafe configurations (for a separate dns server instance). If the jail directory points to your primary dns directory, adblock enables the restrictive jail mode automatically (jail mode only).
220 **Manually override the download options:**
221 By default adblock uses the following pre-configured download options:
222 * aria2c: <code>--timeout=20 --allow-overwrite=true --auto-file-renaming=false --log-level=warn --dir=/ -o</code>
223 * curl: <code>--connect-timeout 20 --silent --show-error --location -o</code>
224 * uclient-fetch: <code>--timeout=20 -O</code>
225 * wget: <code>--no-cache --no-cookies --max-redirect=0 --timeout=20 -O</code>
227 To override the default set 'adb_fetchparm' manually to your needs.
229 **Enable E-Mail notification via 'msmtp':**
230 To use the email notification you have to install & configure the package 'msmtp'.
231 Modify the file '/etc/msmtprc':
244 from dev.adblock@gmail.com
248 Finally enable E-Mail support and add a valid E-Mail receiver address in LuCI.
250 **Service status output:**
251 In LuCI you'll see the realtime status in the 'Runtime' section on the overview page.
252 To get the status in the CLI, just call _/etc/init.d/adblock status_ or _/etc/init.d/adblock status\_service_:
254 ~#@blackhole:~# /etc/init.d/adblock status
255 ::: adblock runtime information
256 + adblock_status : enabled
257 + adblock_version : 4.1.4
258 + blocked_domains : 268355
259 + active_sources : adaway, adguard, adguard_tracking, android_tracking, bitcoin, disconnect, firetv_tracking, games_t
260 racking, hblock, oisd_basic, phishing_army, smarttv_tracking, stopforumspam, wally3k, winspy, yoyo
261 + dns_backend : unbound (unbound-control), /var/lib/unbound
262 + run_utils : download: /usr/bin/curl, sort: /usr/libexec/sort-coreutils, awk: /bin/busybox
263 + run_ifaces : trigger: wan, report: br-lan
264 + run_directories : base: /tmp, backup: /mnt/data/adblock-Backup, report: /mnt/data/adblock-Report, jail: /tmp
265 + run_flags : backup: ✔, flush: ✘, force: ✔, search: ✘, report: ✔, mail: ✔, jail: ✘
266 + last_run : restart, 3m 17s, 249/73/68, 2022-09-10T13:43:07+02:00
267 + system : ASUS RT-AX53U, OpenWrt SNAPSHOT r20535-2ca5602864
269 The 'last\_run' line includes the used start type, the run duration, the memory footprint after DNS backend loading (total/free/available) and the date/time of the last run.
271 **Edit, add new adblock sources:**
272 The adblock blocklist sources are stored in an external, compressed JSON file '/etc/adblock/adblock.sources.gz'.
273 This file is directly parsed in LuCI and accessible via CLI, just call _/etc/init.d/adblock list_:
275 /etc/init.d/adblock list
276 ::: Available adblock sources
278 Name Enabled Size Focus Info URL
279 ------------------------------------------------------------------
280 + adaway x S mobile https://adaway.org
281 + adguard x L general https://adguard.com
282 + andryou x L compilation https://gitlab.com/andryou/block/-/blob/master/readme.md
283 + bitcoin x S mining https://github.com/hoshsadiq/adblock-nocoin-list
284 + disconnect x S general https://disconnect.me
285 + dshield XL general https://www.dshield.org
287 + winhelp S general http://winhelp2002.mvps.org
288 + winspy x S win_telemetry https://github.com/crazy-max/WindowsSpyBlocker
289 + yoyo x S general https://pgl.yoyo.org
292 To add new or edit existing sources extract the compressed JSON file _gunzip /etc/adblock/adblock.sources.gz_.
293 A valid JSON source object contains the following required information, e.g.:
297 "url": "https://raw.githubusercontent.com/AdAway/adaway.github.io/master/hosts.txt",
298 "rule": "/^127\\.0\\.0\\.1[[:space:]]+([[:alnum:]_-]+\\.)+[[:alpha:]]+([[:space:]]|$)/{print tolower($2)}",
301 "descurl": "https://github.com/AdAway/adaway.github.io"
305 Add an unique object name, make the required changes to 'url', 'rule', 'size' and 'descurl' and finally compress the changed JSON file _gzip /etc/adblock/adblock.sources_ to use the new source object in adblock.
306 <b>Please note:</b> if you're going to add new sources on your own, please make a copy of the default file and work with that copy further on, cause the default will be overwritten with every adblock update. To reference your copy set the option 'adb\_srcarc' which points by default to '/etc/adblock/adblock.sources.gz'
307 <b>Please note:</b> when adblock starts, it looks for the uncompressed 'adb\_srcfile', only if this file is not found the archive 'adb\_srcarc' is unpacked once and then the uncompressed file is used
310 Please join the adblock discussion in this [forum thread](https://forum.openwrt.org/t/adblock-support-thread/507) or contact me by mail <dev@brenken.org>
projects / feed / packages.git / blob