home-dns-adblock

Project Overview

home-dns-adblock is a home-network DNS-level ad-blocking setup: dnsmasq answers ad domains of Chinese free-content apps (Hongguo short dramas, Tomato Novel) with 0.0.0.0. No root, no certificates, no app modification — point devices' DNS at one always-on host, and keep blocking on the go through a Tailscale tunnel.

218 exact-domain rules, zero false positives, one host protecting the whole family.

Key Features

• DNS blackholing: ad domains resolve to 0.0.0.0 so ads fail to load and get skipped
• Exact-domain rules: 218 precise rules with whitelist protection for main content, no keyword rules
• Works on the go: Tailscale routes 4G and remote Wi-Fi DNS back home through an encrypted tunnel
• Multi-format lists: dist/ ships AdGuard, hosts, Clash, Surge and Quantumult X subscriptions
• Ad-domain discovery: adblock-helper.sh mines DNS logs by timestamp to pinpoint new ad domains
• Rule generator: gen_rules.py merges community rule sets with manual additions
• One-shot deploy: install.sh plus verify.sh self-check
• Full query logs: watch what each device resolves and what got blocked

Target Audience

• Users annoyed by Hongguo/Tomato ads
• Self-hosters with an always-on Linux box
• Families wanting zero-config protection
• Users who only want to subscribe to the lists

Quick Start

1. Prepare an always-on Linux host with a fixed LAN IP
2. Install dnsmasq and copy config/ files into /etc/dnsmasq-adblock/
3. Edit listen-address and two other marked lines, then start dnsmasq
4. Point devices or the router's DHCP DNS at the host IP
5. For remote use, install Tailscale and enable "Override local DNS"

Core Advantages

• Non-invasive: no root, no profiles, no CA certificates, nothing changes on devices
• Domain-first blocking: ad IPs change daily but domains don't
• Tiny footprint: about 2.5 MB RAM, fine on a Raspberry Pi
• Two ways to use: run your own DNS or just subscribe to ready-made lists

System Requirements

Item	Requirement
Server	Any always-on Linux (Ubuntu/Debian/OpenWrt/Raspberry Pi)
Dependencies	dnsmasq; a Tailscale account for remote use
License	MIT

Notes

• Cannot block in-stream live ads sharing the content CDN with the main video
• Cached ads still play, and DoH or system-level VPNs bypass the local DNS
• Test new rules on a single device before enabling them for the whole home
• On iOS keep only this DNS server; unreachable public DNS entries will break connectivity