[lazardo]

Update:
* wget has no TLS support
* 'killall -HUP dnsmasq' rereads /etc/hosts but does not reread dnsmasq_options
These have been adjusted in this post.

Start with the 'pro' and 'doh' blocklists from https://github.com/hagezi/dns-blocklists/tree/main/dnsmasq. Most lists are updated daily and appear to be well managed.

Add to 'Services -> Additional Options' a line for each list, turn on logging

[Alozaros]

have you tried your script on DDWRT router... ?

wget will not do https..you'd need curl instead...

killall -HUP dnsmasq &

or

stopservice dnsmasq && sleep 2 && startservice dnsmasq my do better...

also running this adblock what is the output of netstat -npla

[lazardo]

[lazardo]

Blocklist now ~300K entries, dnsmasq memory footprint 18.2MB,no router performance issues (RT-AC68U).

NXDOMAIN is returned for blocked DNS query:

[Alozaros]

Those big chunky lists are double aged dagger, as it may break some stuff around...there are tons of adblockers based on the same idea and few blocklists too...to find the happy medium is a bit of a work...i always add and remove some hosts from there than kill dnsmasq in order changes to take in to an action....but thanks for the block-list link...
cheers

[lazardo]

hagezi has 5 or 6 list levels from light/easy to heavy/complex, with clear documentation and no overlaps. Volatile lists are updated daily, others weekly.

dnsmasq_options

[lazardo]

Final updates on this thread.

* Now using 850K blocklist entries (hagezi tif.txt replaces tif.normal.txt above), still with zero performance issues.

[Alozaros]

its probably not a bad idea to add a sed/sort/grep line, where it will DL only the lines with
'local=/<url>/' format..so in this case if someone takes over that hosts page you will not add a malicious stuff to your DNS hosts..allowing some odd connections...

if you look at most of the ad-blocker scripts available around..you will see something like...in all of them...

[lazardo]

Did not consider dnsmasq would have that issue since NXDOMAIN is always returned.

[Alozaros]

yes it is..intensive and sluggish..better and faster blocking use IPset...

In the past I was using something like...

_rogue=0.\0\.0\.0
echo -e "n=1\nwhile ! wget -q -O /tmp/hsts http://sbc.io/hosts/hosts ; do\n\t[ \$n -gt 5 ] && break\n\tlet n+=1\n\tsleep 30\ndone\ngrep "^0\.0\.0\.0" /tmp/hsts | grep -v localhost | awk '{print \"$_rogue\\\t\"\$2}' | tr -d '\\\015' >/tmp/badhosts\nrm /tmp/hsts\nkillall -HUP dnsmasq" >/tmp/wh
sh /tmp/wh &

you could just use curl and change the _rogue=

or this one made by SurprisedItWorks ( i cant find the forum link ) but there are many AD-blocking scripts...

( cd /tmp; touch badhosts; sleep 30
sed 's/\./\\./g;s/.*/\/( |\\.)&$\/d/' <<'ENDOFWHITE' >badhosts.whitelist
hulu.com
huluad.com
ENDOFWHITE
( EXA=0 ; EXB=0 ; EXC=0
curl http://winhelp2002.mvps.org/hosts.txt || EXA=$?
curl http://sbc.io/hosts/hosts || EXB=$?
curl -k https://someonewhocares.org/hosts/zero/hosts || EXC=$?
echo $EXA $EXB $EXC > badhosts.codes
) 2>badhosts.log \
| sed 's/\t/ /g; /^0\.0\.0\.0 /!d; s/ *\#.*$//; s/\r//' | sort -u \
| sed -Ef badhosts.whitelist > badhosts
echo $(wc -l /tmp/badhosts | awk '{print $2,"has",$1,"lines,"}') \
'curl exit codes' $(cat badhosts.codes) \
| logger -p user.info -t "startup-code adblocker"
) && killall -HUP dnsmasq &


Im on IPset rules for AD-blocking...so, im not using this script any more......but just as an examples...

[egc]

Like @Alozoros said there are several nice examples this is the one I am using:
https://github.com/egc112/ddwrt/tree/main/adblock/dnsmasq

[lazardo]