MikroTik

There's a fancy dream of all web users to make it safer and faster. One of a relly good tools for that is AdBlockPlus Service. This service supplys regex filter rules of a harmfull content, as such https://easylist-downloads.adblockplus. ... s_full.txt

Is it possible to apply AdBlockPlus regex filter rules as a basic traffic filter in RouterOS?

If such feature would get available it would make dream come true about routers of all home users ever. I'd even pay for it. I use at home MikroTik RB951G-2HnD with RouterOS 5.26

There's a fancy dream of all web users to make it safer and faster. One of a relly good tools for that is AdBlockPlus Service. This service supplys regex filter rules of a harmfull content, as such https://easylist-downloads.adblockplus. ... s_full.txt

Is it possible to apply AdBlockPlus regex filter rules as a basic traffic filter in RouterOS?

If such feature would get available it would make dream come true about routers of all home users ever. I'd even pay for it. I use at home MikroTik RB951G-2HnD with RouterOS 5.26

https://github.com/aziraphale/routeros-dns-adblock

Just in case anyone else runs across this in a google search like I did. Be sure to read the "ReadMe" as always, but it works out great for me on my RB450G.

Has anyone implemented this: https://github.com/aziraphale/routeros-dns-adblock

adblock-dns.rsc
adblock-addrlist.rsc

Is this lists updated Daily or how often.?

also created an updatable lightweight version of it (13.5k entries ATM). it uses the http://winhelp2002.mvps.org/hosts.txt file.

You might want to look at the size of your DNS cache. I have not done napkin math to tell you the exact cache size required for almost 150k entries, but I guess you could increase it to 200MB for starters, and if it's still full try increasing it even more. There is enough memory available on the board you are using. On a side note, I think loading MIkroTik's simple DNS service with hundreds of thousands of static entries is a horrible idea, but I support your experiment and would love to hear the results you get from this. People use dedicated appliances like PiHole for this purpose - which often proves to be unreliable solution.

Regarding firewall rule, your in-interface is wrong - it should be your local network interface (or master port if you use hardware switch feature, or bridge interface if you use software switching), not gateway one.

/ip firewall filter add chain=forward action=reject reject-with=tcp-reset connection-state=new protocol=tcp 
dst-address=240.0.0.0/4 in-interface=bridge-local log=yes log-prefix="adblock.prime"

Did you increase size of DNS cache? Default 2MB is nowhere near enough for what you want to achieve. If you did not do that, most probably you see no hits because your DNS cache is not working at all. If you did increase the cache size, another firewall rule is interfering with your rule - in this case export firewall rules and paste them here in

Code: Select all

 tags.[/quote]


Hob bit this should be ?

/ip dns print
                servers: 8.8.8.8
        dynamic-servers: 
  allow-remote-requests: yes
    max-udp-packet-size: 4096
   query-server-timeout: 2s
    query-total-timeout: 10s
             [b]cache-size: 2048KiB[/b]
          cache-max-ttl: 1w
             cache-used: 2048KiB
             
             
 [b]cache-size: ? [/b]

You might want to look at the size of your DNS cache. I have not done napkin math to tell you the exact cache size required for almost 150k entries, but I guess you could increase it to 200MB for starters, and if it's still full try increasing it even more. There is enough memory available on the board you are using. On a side note, I think loading MIkroTik's simple DNS service with hundreds of thousands of static entries is a horrible idea, but I support your experiment and would love to hear the results you get from this. People use dedicated appliances like PiHole for this purpose - which often proves to be unreliable solution.

Regarding firewall rule, your in-interface is wrong - it should be your local network interface (or master port if you use hardware switch feature, or bridge interface if you use software switching), not gateway one.

I made a change and now I have bridge-local interface and I still do not see any blocked traffic by this reject rule and I still see ads.

Code: Select all

/ip firewall filter add chain=forward action=reject reject-with=tcp-reset connection-state=new protocol=tcp 
dst-address=240.0.0.0/4 in-interface=bridge-local log=yes log-prefix="adblock.prime"

Please support me what may cause this problem and how to fix this ?