Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I currently update my local hosts file with advertising server domain names and direct them to nowhere. Well, almost nowhere. I point them to and I don't have a web service running so it is effectively nowhere. Anyway, it blocks a lot of ads and whatever else I discover undesirable in web pages as I surf the www. It doesn't force you to use a specific browser or OS. (A requirement because there is a different flavor combination of OS's and browsers and such changing here all the time)

I have a NAS drive on my local network so I copy my hosts file there every once in a while. Then when I use another computer on my local network, I have to go to the NAS drive and copy the updated hosts file to the local computer if I want to block my ads there too.

What I'd like to see is my little wi-fi router performing this task and letting me add my host file list to it. It has a local DNS service to mirror outgoing DNS queries or something like that.

Must I set up an independent DNS server on my network and make sure all my local computers use it? Do I have to have yet another computer on all the time, using electricity and helping heat the room and adding fan noise? I got the NAS drive to eliminate one more computer on my network for those reasons already.

Then if I use another box for DNS, just to keep my ad blocking, I need a DHCP service because the one built in the router won't let me tell it what DNS server to use. It uses itself by an unchangeable default. So I'd have to turn off the DHCP on my wi-fi router and purposely not use the DNS it provides either so I can have one more box running to maintain my shared hosts file.

On my network here I have a couple xp boxes that are not running 24/7, a vista that goes away to college but is here some weekends, a Debian linux and boot-able live-cd to be able to have a web-server or whatever on the fly, a Linksys wi-fi router and a DSL modem the phone company owns with no features to it other than 'firewall' or 'straight through', a cell phone surfs through it too, when it's here. But when someone else stops by with a laptop, I give them my wi-fi code and then they are temporarily on my network, hopefully not being advertised to and counted and tracked.

Is there another way to achieve this without spending increases? I know my NAS drive is really just a headless LINUX box that runs on a small 12-volt charger sized power supply. I ssh'd in to it and looked around but recommendations are that I don't mess with it's internal operations. Besides, I think it's kinda slow so does it really need to perform DHCP and DNS on top of being a file server?

Do I really need to replace my wi-fi router with some expensive industrial overkill router to accomplish this task?

share|improve this question

The DNS is the wrong tool for this job.

Let's deal with some silliness first:

Do I have to have yet another computer on all the time…?

No. This isn't the 1950s. Computers can run more than one server at once. Many Unices have been happily doing that, including running their own fully fledged resolving proxy DNS servers, as standard — out of the box — since the 1980s. Use the always-on computer that you say that you already have.

Setting up a DNS server is the next step when one wants to distribute a hosts file to multiple machines. That is, after all, pretty much the reason that the DNS came about in the first place. So a blinkered answer to your question

Must I set up an independent DNS server on my network and make sure all my local computers use it?

is "Yes.". That's what one does to scale up serving such data to an entire LAN.

However, the DNS is the wrong tool for the job that you want to do. I know that it may have seemed like a whizz-o idea to set up a hosts file with lots of names in it and block advertisements that way, but it's not scalable — as you've already discovered and as others discovered back in the 1980s — and (even if modified to use a content DNS server) it's not appropriate. It's not granular enough, and it's a layering violation.

  • It's a layering violation because you aren't stopping your WWW browser from fetching content via HTTP/HTTPS. Instead you are changing the name→address mappings that everything on your machines use. So you are changing the mappings for SMTP, IMAP, POP, FTP, HTTP, NTP, CIFS, … and everything else that looks up domain names and maps them to IP addresses. For those guests on your LAN who might want to do things other than WWW browsing with the domain names that you've unilaterally deemed to be "advertising", things are royally screwed up. You are attacking the situation at the wrong layer. The name→address mapping layer is not the one to muck around with. The HTTP/HTTPS layer is.
  • It's not granular enough because you'll find, once you've been doing this long enough, that the advertisers are wise to you. Perhaps the most blatant example of how this is problematic is that there's at least one web bug served up by Google whose URL has the domain name Block that using your sledgehammer-to-walnut approach, and you've blocked yourself off from pretty much the whole of Google. There are many other instances of the same thing, where the pop-up/pop-under scripts, first-party cookie injectors, web bugs, and other nasties are served up from the same domains as desirable content. I suggest a trawl through the database employed by adzapper — many of whose entries use regular expressions to match only some URLs of a domain — to see how widely this happens nowadays.

The right tool for this job is a proxy HTTP server, a PAC script, or an in-browser tool.

There are two choices of right approach, both of which operate at the HTTP layer and both of which have a finer granularity than entire domains:

  • Tell one's WWW browser directly where to send its HTTP/HTTPS transactions for undesirable content. One often does this with a PAC script, and there are many people who publish PAC scripts for zapping advertisements that one can build upon. (John R. Lo Verso's script has been around for over half a decade.) One puts the list of regular expressions into the PAC script, and tells the WWW browser where to load the script from. The WWW browser itself retargets its HTTP/HTTPS transactions, without any need to alter DNS service, without any need to mess around with additional/replacement equipment, and without affecting other protocols, other softwares, and other people's work.

    A plug-in that blocks advertising by redirecting/handling the HTTP transactions is effectively the same approach. The WWW browser process itself does the work, and nothing outwith it is affected.

  • Run a proxy HTTP server that has a set of pattern matching rules for a redirect/rewrite mechanism, and direct all WWW browsers to send their HTTP traffic through it. (This has the added benefit that one can, if one wants, then impose more draconian restrictions on HTTP traffic at the borders of one's LAN, since all traffic should originate from the back end of the proxy HTTP server.) Adzapper and Privoxy are two of several proxy HTTP servers available for this purpose. Instead of the WWW browser retargetting its WWW traffic, the proxy HTTP server does it. With some clever proxy HTTP servers one can do all sorts of tricks.

For nearly a decade, I used the first approach myself. Its disadvantage is that WWW browser handling of PAC scripts is fairly dodgy, even today. It's easy to make a script that won't work on all WWW browsers, the failure modes are atrocious (RealPlayer's in-built WWW browser hangs/crashes if presented with an incorrect PAC script, for example.) and the interactions between PAC scripts and the WWW browsing protection mechanisms employed by some anti-malware tools are often less than stellar. Nonetheless, it's an approach that I can vouch from experience will work, as long as one is very careful, across a wide range of WWW browsers running on various platforms.

For plug-ins, the disadvantages are similar. One has to ensure that every WWW browser has the plug-in, and it is rarely the case that one plug-in is available for all kinds of WWW browsers on all platforms.

I now use the second approach. It has the advantages, compared to PAC scripts and plug-ins, of being entirely browser-neutral, and only requiring debugging in one place (rather than in multiple WWW browsers of different types, including all of the built-in WWW browsers in tools like media players, hypertext help systems, desktop gadgets, automatic software update tools, and so forth).

Use the right tool for the job. The DNS is not that tool here.

share|improve this answer
I personally settle for the browser approach (but I am not locking down the rest of my computers) because there is always a point where the blocking is not desirable or the filters are too greedy. In those instances, I can toggle the blocker off to see if the problem resolves, and in those cases, it is voluntary. – horatio Nov 23 '11 at 15:56
Unless the network borders have additional draconian restrictions, as mentioned, one can toggle the use of a proxy HTTP server on and off, too. It's a single checkbox or radio button in most WWW browsers. Simplicity of bypassing the filter when necessary is much the same for both approaches. It's the browser neutrality, the debugging centralization, and the clever tricks (like, say, an domain name suffix where everything is unfiltered) where the proxy HTTP server approach is strongly differentiated. – JdeBP Nov 23 '11 at 18:00

You could use OpenDNS. You can set the router to use its dns servers and on the Website you can add either their lists of sites to block or your own or both. Then also instead of a blank screen when one loads a blacklisted site, you can have a customized page.

share|improve this answer
Yeah, I did set up a temporary local web server and got a black screen for a while but I kinda like to see that banner space at the top or down the side of a web page saying how the ad couldn't be loaded. :-) Also, if I use some outside source list, I may loose out from discovering who does what and why I might want to block or not block something if some third party is already blocking it. – TechAholic Nov 22 '11 at 20:25

You could look into a firewall distro such as ipcop, smoothwall, pfsense etc. you would then turn off DHCP etc on the wireless router. The correct way to do this would be to disable wifi on the router and install a third network adapter for wifi (one adapter to WAN, one to LAN, and a wifi for wireless).

Many of these packages have the added benefit of in-house anti-spam.

I have used ipcop and pfsense and they are easy to maintain, but if you have COAX (verizon fios for example), you might have to jump through some hoops (I did this, it is workable, but a power for some reason when the modem lost power, the "workaround" I used came back disabled and required user intervention to bring internet back up)

share|improve this answer
note I was respnding to your paragraph starting "Then if I use another box for DNS, just to keep my ad blocking..." – horatio Nov 22 '11 at 18:39
I don't know about ipcop or pfsense but I used smoothwall before. That is definitely another box running with two or more NIC's installed. My bedroom/computer lab is too warm to add another computer to leave running 24/7, which it would have to be if everything on the network uses it. – TechAholic Nov 22 '11 at 19:58
I do want to avoid the extra box running but on the other hand it would give me other filtering options than just blocking by domain names. State-full packet inspection could be handy. – TechAholic Nov 22 '11 at 20:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .