[xrtxrt]

I need to block an unlimited number of web addresses, (over a hundred as of date and counting). Is there a limit to how many I can block in DD-WRT ? I know I could use my computer's hosts file but there isn't such a thing on some of my other internet enabled devices.
I don't care if I must input every address one by one.

[xrtxrt]

Just a bump, just to say i'm still here.

[JAMESMTL]

with some well crafted iptable chains on a modern router with external storage you should have no issue blocking >10K IPs / CIDR ranges.

Without external storage free nvram space will be a bigger issue.

A 100 or so IPs is relatively minor.

see https://www.dd-wrt.com/wiki/index.php/Iptables_command

Another solution is to use dnsmasq address or host-record option to null route or redirect the host names.

you can also use privoxy and configure block lists

[Alozaros]

i guess it's more useful to use AD blocking way, just replace the host file location to your desired host to dl the file or edit it manually ...

https://www.dd-wrt.com/wiki/index.php/Ad_blocking

[JAMESMTL]

the ad blocking way is the dnsmasq host-record option. if you have a dual stack network ipv4/ipv6 and the hosts you are blocking have ipv6 connectivity then you need to null route for ipv6 as well otherwise the network devices will use the AAAA record returned by dnsmasq. This method also does not null route sub-domains.

the dnsmasq address method resolves both of those isues.

[Alozaros]

yep as i dont have ISP ipv6 provider i don't use it at all, but in dnsmasq address method to put all the addresses in the box and then you get out of ram in case of low ram device or im wrong

[bobs]

You really need to use RegEx to keep your block list down.

Also, you COULD consider using a proxy on a Raspberry Pi or similar SoC board, all HTTP / HTTPS connections will then go via that filtering proxy. It can also be a caching proxy too to speed up surfing and keep your (if applicable) WAN quota low.

Going this proxy SoC would give you far more capability and power, and of course storage (limited to SD Card size).

One other thing to do, check FORCE DNS REDIRECT otherwise DNS blocks can be bypassed (Windows also manages to find it's own sneaky way around DNS for some odd reason even when it is not configured for other DNS's!). This way, even if a client is configured for other DNS (OpenDNS or GoogleDNS etc) they will always go via your DNSMasq. Also set it to Authorititive too. You really want to lock it down.

If you have problems on DD-WRT with DNSMasq you can offload it to a Raspberry Pi and configure the DNS in DD-WRT to look there. That is how I do my OpenVPN and other network tasks, using a small itty bitty SoC board.

These are basically Linux machines, with far more storage availability and ease of installing/programming than DD-WRT. You also get a desktop you can run from Windows (Xming X display server if need be, then run it headless as a little useful server)