Is there a way to integrate dnsmasq and the popular urlblacklist.com list?

I thought about adding all the entries with the -A flag, but that's a lot of hosts for dnsmasq to process, especially on a low-powered ARM device and I would need to write a script to parse the blacklist each time it needed to be updated, so I'm hoping there's a better approach to this overall.

To clarify the -A flag, taken from the man page for dnsmasq:

-A, --address=/<domain>/[domain/]<ipaddr> 

Specify an IP address to return for any host in the given domains.
Queries in the domains are never forwarded and always replied to with
the specified IP address which may be IPv4 or IPv6. To give both IPv4
and IPv6 addresses for a domain, use repeated -A flags. Note that
/etc/hosts and DHCP leases override this for individual names. A
common use of this is to redirect the entire doubleclick.net domain to
some friendly local web server to avoid banner ads. The domain
specification works in the same was as for --server, with the
additional facility that /#/ matches any domain. Thus
--address=/#/ will always return for any query not
answered from /etc/hosts or DHCP and not sent to an upstream
nameserver by a more specific --server directive.
  • when you say with -A flag do you mean iptables -A or which command? – cybernard Oct 7 '13 at 23:37
  • added relevant info about the -A flag. – Michael Lang Oct 8 '13 at 15:10
  • Does the offending traffic need to be redirected or can we just drop it? – cybernard Oct 8 '13 at 23:59
  • redirected. I'm actually digging into iptables now as that may be the better place to deal with what they call "discretionary access control (DAC)" For now, I did manage to get a limited version of what I ultimately wanted with squid3 as a transparent proxy and squidguard, but this only protects http/https browsing, not all ports. – Michael Lang Oct 9 '13 at 18:27
  • urlblacklist.com has 3 million entries. "iptables" by itself will suck. If you combine "iptables" with "ipset" then it won't kill your performance. One "iptables" tables rule will block a whole set of ip addresses(up to 65535 per set). You can create a list:set containing 8 individual sets. You will still, however, require many sets. However, the entire ipset config can be saved like this "ipset save >all.txt" or restored like this "ipset restore <all.txt" no matter how big or complex the configuration. – cybernard Oct 9 '13 at 21:51

The Best Ad Blocking Method with dnsmasq is doing exactly as what you are asking for.

The urlblacklist config file is under /etc/dnsmasq.d/: /etc/dnsmasq.d/dbab.adblock.conf, exactly in the format of


For details refer to

In the section "Faq: How to blacklist those bad sites".

From the blog:

  • Block accessing to the ad sites from the DNS level.
  • All ads will be replaced by a 1×1 pixel gif image served locally by the Pixelserv server

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.