Ad blocking

[unixpgmr]

I want to block googleadservices, as well as others. I have added it, applied and then went to a site that has ads. It doesn't block them. I hover over the add and see it is from googleadservices.com. What am I doing wrong?

[yourfriendarmando]

Hi, you may have reached a point where you have set up a DNS server, but now need to make sure it is THE DNS server for your network.

Clients such as browsers and phones now come standard with the means to bypass your DNS server.

Originally, one would just block port 53
Now, we can redirect requests destined to the internet, back to localhost port 53 UDP, and TCP while we're at it.

Unfortunately, there are now more protocols on which to acquire DNS information.

You have to block 853, for DNS over TLS.
You cannot redirect 853 since unbound does not natively provide DNS over TLS.

That further closes the loop, however, now we have the problem of having DNS over HTTPs, web servers that respond to DNS-like queries.

Back then we could use a proxy, but now you can grab external block lists to just block reaching a server that provides any form of DNS request.
There are block lists at the IP firewall level, and DNS block lists, there is a built in list available in that screen you attached, in the category "Hagezi Targeted Lists", select "DoH/VPN/TOR/Proxy Bypass".

I got my initial redirect and block ideas from the earlier parts of this thread.

https://forum.opnsense.org/index.php?topic=9245.0

Throughout the thread, you will see various solutions, including from yours truly, on how to mitigate blocking of alternate DNS services for untrusted clients.
If you want to test if your current block lists are working, you may need to shut off a feature like this, as attached, on the browser you use.
Also make sure your computer is pointing to your firewall as the DNS server.

Cheers

[nero355]

I want to block googleadservices, as well as others.

I have added it, applied and then went to a site that has ads.
It doesn't block them.
I hover over the add and see it is from googleadservices.com.

What am I doing wrong?

Where did you test this exactly ?

Do you realize that hovering over the ad does not mean you will reach the domain behind it after clicking on it ?



And slightly offtopic :
The webGUI screenshot you shared makes me sad when I look at it while knowing how much easier and more logical all of this is with Pi-Hole :'(

Management of :
- Blocklists
- Allowlists
- Denied Domains
- Allowed Domains
- Wildcard Domains
- RegEx based Allow/Deny Rules

All of them are less "crowded" than shown on your screenshot :)