HN Explorer

Ask HN: What ist your AdBlock strategy?

99 points by laserstrahl ↗ HN
Hi, Just installed OpenWRT. Which solutions for ad blocking and other trackers would you recommend? Pi-Hole is not a option, since I don't have one laying around.

So anything else I can try which will work out of the box? For links and guides I'd be happy. PS: I got dual antennas what would come into your mind to do with it?

188 comments

[ 3.2 ms ] story [ 226 ms ] thread
ttyprintk
It sounds like a small network with no need to block outbound 53.

Nextdns.io for out-of-the-box if you can’t run pi-hole.

Eumenes
Pihole with like 2 million blocked domains, no major social media use, wireguard on mobile, Brave browser, don't watch TV
beardyw
I just use Brave. It works on my phone.

and Chrome for Google integration.

reify
Either ublock origin with all filter lists checked

Ghostery with ad-blocking, anti-tracking and Never Consent enabled with Fanboy's Annoyance List added to custom filters

Mullvad DNS

https://mullvad.net/en/help/dns-over-https-and-dns-over-tls

morjom
You do not need all filter lists checked in uBlock. Maybe 3 or 4 + what it gives you out of the box.
swifthesitation
Brave browser, Mullvad/Proton, uBlock Origin, Privacy Badger, AdBlock, Cookie Auto Delete
marssaxman
Firefox + uBlock Origin works well for me! It's all I use.
berbec
I had a pihole for a while, but found ublock was more reliable. Occasionally the dns routing to 127.0.0.1 would wreck havoc on "Smart" devices, such as firetv etc
dawnerd
I do that plus adguard dns hosted on my local network and I use their paid dns on my phones when remote.
rsyring
Ditto except NextDNS as default on my network for DNS blocking.

I can switch to cloudflare DNS in Firefox to circumvent DNS routing which is occasionally necessary, mostly to make email links work.

newscracker
NextDNS does not work many a times. I prefer the iOS app so that it’s easy to disable when needed, but the app has not been updated for a few years. Many a times the test page at test.nextdns.io will show as unconfigured and sometimes it will show as passing the test.

On Apple TV, I have the NextDNS profile installed, but it still doesn’t work.

Most of the community forum posts on NextDNS don’t get any answers. I’m sure the DNS servers exist, but the clients and the configuration options have not been supported by the creators.

I wouldn’t recommend NextDNS to anyone because of this apathy by its creators.

AStonesThrow
NextDNS was working a treat for me, and it was only through NextDNS's meticulous logging that I immediately discovered that my consumer grade router was hopelessly compromised: joined a botnet, trafficking porn, IDK.

So I threw the router out the window, and signed up to rent CPE from my ISP; edge router security is now 100% their responsibility!

cyberpunk
What’s a CPE?
pmw
It's an networking term to distinguish between ISP-owned and customer-owned equipment. https://en.wikipedia.org/wiki/Customer-premises_equipment
jdsnape
minor nitpick, but it's not ownership so much as location. Sometimes the ISP will own the equipment, but it will be located on the customer premises rather than the ISP premises. It's an important distinction as you can't just rock up and do stuff to it.
g8oz
NextDNS is definitely worth the money. Setting up profiles for your kids devices is very useful functionality as well.
jackstraw14
Brave browser + uBlock Origin is still great for a Chromium-flavored experience too.
atmavatar
In addition to that, I use EFF's Privacy Badger

https://www.eff.org/pages/privacy-badger

extraduder_ire
The ublock origin FAQ recommends not using additional content blockers or you may run into effectiveness/detection problems.

I've never had the former happen, but it's something to be aware of.

throawayonthe
afaik there's nothing ublock doesn't block (or can't block with an extra filter or two) that Privacy Badger does, sorta redundant
nilslindemann
The same addon, but prefer Ungoogled Chromium as browser. Chrome, Firefox, Brave etc. have too many features I never asked for.
gtk40
I just use Firefox and disable Pocket, search suggestions, and everything on the new tab page and it feels fine to me.
e40
Found out 1Password doesn't work in this, so it killed my plan to switch to it. Currently using Brave, which seems like the next best choice.
brudgers
Pi-Hole is not a option, since I don't have one laying around.

Why not buy one?

ryandrake
Pi-Hole is the worst-named software. You don’t need to buy a Raspberry Pi to block ads at the DNS layer, and you don’t even need branded pi-hole software. It’s just dnsmasq which can run on anything.
gertop
Your comment reminds me a lot of the classic "Dropbox will never succeed, I can just use a Linux box with ftp" hn comment.

It's all about user experience.

brudgers
Using an RPi might be the simplest way for the OP to solve the problem because hardware is a useful abstraction. My response addressed the hard part of engineering: humans in the loop.
OSI-Auflauf
Don't waste your time with dns adblocking.

If you are serious about network side blocking do tls interception (lmao) but that is a lot of maintenance, adds other attack surface and the average openwrt device isn't beefy enough for such things.

Firefox and Ublock Origin against ads.

There is cooler stuff for Openwrt. Mesh nets between friends, to share internal services. Just tinkering with and learning about network stuff. Adding ipv6 to tunnel if isp doesn't support. Having Wifi whose autochannel doesn't suck.

Dual Antennas -> Sword fighting. Only fun with multiple devices and dabbling with mesh mode or throughput maxing. In ax dual channel 40mhz +160mhz bandwidth the throughput is faster than some cables.

runjake
- Pi-Hole can run on OpenWRT if your router is powerful enough, on a Linux box, in a Docker container, and on a Synology. You don't need a Raspberry Pi to run it.

- Look at https://nextdns.io as an alternative.

- I use uBlock Origin and NextDNS at home.

dizhn
I haven't looked at pihole once after I discovered adguard home.

https://openwrt.org/docs/guide-user/services/dns/adguard-hom...

uncharted9
How do you reduce the latency of the upstream DNS resolvers? The closest Cloudflare servers give me 20-25ms DNS resolution times, but with Cloudflare as the upstream DNS in Adguard Home, I'm getting more around 80-110ms.
dizhn
Is there a specific way to test that or just nslookup/dig/drill and look at the number there? I want to check this and get back to you.
uncharted9
Adguard Dashboard shows average DNS resolution time. I eventually shifted to Blocky which tracks logs of every DMS query. I strung a quick python script to make a dashboard similar to Adguard's and calculating avg resolution time for each resolved A records.
dizhn
Blocky looks good too. I will check it out at some point. Thanks.
cortesoft
What sort of workloads are you doing where 60ms extra time on your DNS lookups is an issue?
3eb7988a1663
I naively assumed most OS + routers cache DNS queries so that your typical sites will not even require a lookup. Or is that a bad assumption?
uncharted9
I switched from Adguard Home to Blocky because I noticed how much faster page loads were on Blocky. I've configured it to cache any query I resolve more than once in a 24 hour window. This makes most of my page loads really, really fast.

Adguard also has the ability to cache. But I haven't seen it to significantly speed up my page loads. The default resolution itself is much slower on Adguard + Cloudflare DNS compared to Blocky + Cloudflare DNS. So this makes Adguard double whammy.

kstrauser
DNS records commonly have cache lifetimes (“TTLs”) of a few minutes. It would be an error to cache those for much longer.
uncharted9
Nothing interesting particularly, but cached + faster DNS resolution is usually perceptible in general web browsing.
sigio
If you run adguard home with long blocklists on a consumer-level router, this will cause big delays, simply because the blocklists are large and eat all available memory and lots of processing on any dns request.

I've kept de blocklists in adguard home small, and then it works fine, but if I add hundreds of thousands of blocked domains, it gets painfully slow on my Edgerouter X running OpenWRT

uncharted9
I'm using same set of Blocklists (800k-1M rulesets) in my comparison between Adguard and Blocky with same upstream resolver.

I'm running them as system service on my laptop, and using my localhost as dns proxy.

tssva
The Edgerouter X had good specs for the time it was released but that was over 9 years ago at this point. I had to replace mine a few years ago because it didn't have the thruput for my 1Gbs internet connection.

Many modern consumer routers contain processors and memory which can easily handle Adguard Home. I have a GL.iNet MT-6000 with a MediaTek Filogic 830 processor which has 4 ARM A53 cores running at 2Ghz and offloads wifi and wired network packet processing from the cores. It also has 1GB of DDR4 memory. It has no problem handling Adguard home, my 1Gbs internet connection and gives me around 900Mbs of wirguard thruput.

stonegray
Maybe not what you’re looking for, but I put adguard home on a VPS (although later switched to a “real” dns software prior to benchmarking) and is faster^1 than connecting directly to cloudflare from home.

[1] https://stonegray.ca/dns/#performance

Edit: for the curious, I use technetium as the server, nginx to proxy it (security stuff, prioritize traffic from my zerotier network, do DNS/DoT translation, etc) and docker/letsencrypt/watchtower/netdata for auto updating and status reporting, packaged as a single docker compose I can deploy easily.

uncharted9
This looks really interesting. I am not in North American region and hence this would be slow from my region. But nonetheless interesting project. Have you documented the entire setup journey on a blog or video?
sam29681749
Ignorant question: what ad blocking is required outside of your browser to require anything more than something like ublock?
palata
Mobile apps show ads and use trackers, for instance.
jackstraw14
ProtonVPN blocks ads and trackers, it's my solution and reasonably affordable.
FeistySkink
Plenty of "smart" appliances phone home unnecessarily.
cortesoft
That isn’t adblocking, though
crtasm
Well, it's blocking the data being sold on to advertising companies.
Marsymars
It saves me bandwidth to not serve ads to family members and other guests on my Wi-Fi.
Havoc
Even with ublock the network wide blockers catch stuff. Ublock is good but not perfect
graftak
Security works best in layers
dotcoma
Iridium browser with Ublock Origin on my Mac and Wipr with Safari on my phone.
sandreas
1. Fallback Adblock DNS Server (root)

2. pi-hole

3. Firefox with ublock origin

4. wireguard VPN

Yawrehto
I, not yet wanting particularly to extricate myself from Chrome, use Ublock Origin Lite. It works about as well as the original (although it's less good with paywalls and blocking individual site elements, by which I mean 'not good at all'.) If you can and don't already I would try to replace as much as you can with RSS (which is also really good with paywalls - I use feeder.co and it lets me get around the Atlantic's paywall. Its privacy policy is here: https://feeder.co/help/legal/privacy-policy/. It's hosted in Sweden, in the EU, for what that's worth.)

But as you might have figured out from my use of Chrome, I'm mostly ok with the fact that Google knows everything about me. So I'm probably not the best person to ask.

Brajeshwar
I’ve used Pi-Hole before, and I had to troubleshoot in a few instances when I was traveling away from home. I stopped using it to simplify my setup.

The ideal setup I want to try is to have something like AdGuard Home at the Router. My current setup on our devices already has AdGuard App running with NextDNS as the DNS Resolver. This setup works pretty well while connecting to any network. NextDNS handles the DNS, while AdGuad AdBlocker works well with the client side on all browsers.

Issues pop up occasionally when the OS gets upgraded, but they are bearable. https://brajeshwar.com/2024/i-block-ads/

andrei_says_
I run adguard on a raspberry pi - setup similar to pi-hole. It works well but does not block YouTube ads. Is there a setting I am missing to enable this?
uncharted9
Change VPN to India and signup YT Premium individual for less than $2/month, or share Family plan with 5 people for less than $1/month.

I'm sure even VPN + YT Premium would be cheaper than local subscription pricing .

reboot81
I got one r-pi zero running pi-hole at .220, and another pi-hole on a server dockerized at .221. If that server goes down, another server has a dockerized pi-hole that takes over the .221 IP. The failover is handled with keepalived.

At parents house they got one r-pi set as DNS 1, and 9.9.9.9 as DNS 2.

paulcole
I don’t use an ad blocker on any device.

Despite claims to the contrary by people here on HN, it’s fine.

theandrewbailey
I guess having my device run code that doesn't benefit my experience, unnecessarily consumes resources, and comes from somewhere I don't know is technically "fine". To me, it sounds like a security, privacy, and efficiency nightmare.
skwee357
I have GL-inet brume 2 which runs in drop in gateway mode alongside my main router, and on it I have AdGuard home
jeeybee
Got a pihole a few years ago, works like a charm. The only annoyance is when you actually look for produces and nearly all links in google are dead due to ads.
thomassmith65
Add *.google.com to the blacklist: problem solved.
Marsymars
This was a major factor in getting a Kagi subscription for my wife.
ActorNightly
Ive got enough "mental fortitude" not to really care that much about ads.
xk_id
The ad industry is very proud of you
deafpolygon
uBlock origin, or just avoiding the site if it doesn't work.
superkuh
Noscript temporary whitelist only combined with uBlock origin and sponsorblock. A CSS toggle button is important too to be able to read text when the page doesn't display correctly. As well as a "superstop" button to (near) completely end all JS execution in a tab after loading.

After 15 years of using NoScript this way I have developed a sixth sense for the minimal set of individual hostnames/ips need to be JS allowed on a typical site. I'm quite fast at it. But wix.com hosted sites and others like it that have one JS domain required to load another and so on serially 5x deep I just close rather than refreshing the page 5 times.

Linux-Fan
I use Firefox + uMatrix to achieve a similar setup.

One advantage of using only a script blocker in favor of a proper ad blocker is that I don't shut off reasonable ads but only the ones that do shady stuff with a lot of computation and tracking on the client PC.

uMatrix has the advantage that it additionally blocks cookies by default, making the tracking even harder.

sashk
nextdns for whole network dns if you don't want to host yourself. if you feel like hosting, there is pihole and adguard home.
cowboylowrez
I feel sort of odd never having installed an ad blocker, but firefox must do some stuff also because a few websites still complain and tell me to turn it off, whatever "it" is. I'm pretty good with the youtube skip button does that count?