mirror of
https://github.com/novatiq/packages.git
synced 2026-04-30 15:38:40 +01:00
adblock: update to 0.60.0
* "zero-conf" installation & setup, usually no manual config changes required (i.e. ip address, network devices etc.) * full IPv4 and IPv6 support * new adblock list source (malwaredomainlist.com) * adblock related statistics will be done by iptables * removed curl dependency * for IPv6 support you need 'kmod-ipt-nat6' * fix Chaos Calmer compability * various small changes & fixes * updated documentation * updated maintainer email address Signed-off-by: Dirk Brenken <dirk@brenken.org>
This commit is contained in:
Dirk Brenken
+47
-75
@@ -5,20 +5,22 @@ A lot of people already use adblocker plugins within their desktop browsers,
|
||||
but what if you are using your (smart) phone, tablet, watch or any other wlan gadget...
|
||||
...getting rid of annoying ads, trackers and other abuse sites (like facebook ;-) is simple: block them with your router.
|
||||
|
||||
When the dns server on your router receives dns requests, you’ll sort out queries that ask for the [A] resource records of ad servers and return the local ip address of your router and the internal web server delivers a transparent pixel instead.
|
||||
When the dns server on your router receives dns requests, you will sort out queries that ask for the resource records of ad servers and return the local ip address of your router and the internal web server delivers a transparent pixel instead.
|
||||
|
||||
## Main Features
|
||||
* support of the following domain blocklist sources (free for private usage, for commercial use please check their individual licenses):
|
||||
* [adaway.org](https://adaway.org)
|
||||
* => infrequent updates, approx. 400 entries
|
||||
* => infrequent updates, approx. 400 entries (enabled by default)
|
||||
* [disconnect.me](https://disconnect.me)
|
||||
* => numerous updates on the same day, approx. 6.500 entries
|
||||
* => numerous updates on the same day, approx. 6.500 entries (enabled by default)
|
||||
* [dshield.org](http://dshield.org)
|
||||
* => daily updates, approx. 4.500 entries
|
||||
* [feodotracker.abuse.ch](https://feodotracker.abuse.ch)
|
||||
* => daily updates, approx. 0-10 entries
|
||||
* [malwaredomains.com](http://malwaredomains.com)
|
||||
* => daily updates, approx. 16.000 entries
|
||||
* [malwaredomainlist.com](http://www.malwaredomainlist.com)
|
||||
* => daily updates, approx. 1.500 entries
|
||||
* [palevotracker.abuse.ch](https://palevotracker.abuse.ch)
|
||||
* => daily updates, approx. 15 entries
|
||||
* [shallalist.de](http://www.shallalist.de) (categories "adv" "costtraps" "spyware" "tracker" "warez" enabled by default)
|
||||
@@ -33,93 +35,63 @@ When the dns server on your router receives dns requests, you’ll sort out quer
|
||||
* => weekly updates, approx. 2.500 entries (enabled by default)
|
||||
* [zeustracker.abuse.ch](https://zeustracker.abuse.ch)
|
||||
* => daily updates, approx. 440 entries
|
||||
* zero-conf like automatic installation & setup, usually no manual changes needed (i.e. ip address, network devices etc.)
|
||||
* full IPv4 and IPv6 support
|
||||
* each blocklist source will be updated and processed separately
|
||||
* timestamp check to download and process only updated blocklists
|
||||
* overall duplicate removal in separate blocklists (will be automatically disabled on low memory systems)
|
||||
* blocklist parsing by fast & flexible regex rulesets
|
||||
* timestamp check to download and process only updated adblock list sources
|
||||
* overall duplicate removal in separate adblock lists (will be automatically disabled on low memory systems)
|
||||
* adblock source list parsing by fast & flexible regex rulesets
|
||||
* additional white- and blacklist support for manual overrides
|
||||
* use of dynamic adblock network interface
|
||||
* use of dynamic uhttpd instance as pixel server
|
||||
* use of quality checks after adblocklist updates to ensure a reliable dnsmasq service
|
||||
* quality checks during/after update of adblock lists to ensure a reliable dnsmasq service
|
||||
* wan update check, to wait for an active wan uplink before update
|
||||
* basic adblock statistics via iptables packet counters
|
||||
* status & error logging to stdout and syslog
|
||||
* use of dynamic uhttpd instance as adblock pixel server
|
||||
* optional features (disabled by default):
|
||||
* powerful adblock list backup/restore handling
|
||||
* wan interface check, useful for rc.local based autostart and (mobile) multiwan setups to update only on pre-defined wan interfaces
|
||||
* domain query logging as a background service to easily identify free and already blocked domains (see example output below)
|
||||
* adblock statistics (req. query logging)
|
||||
* ntp time sync
|
||||
* status & error logging to separate file (req. ntp time sync)
|
||||
* adblock list backup/restore
|
||||
* debug logging to separate file
|
||||
|
||||
## Prerequisites
|
||||
* [openwrt](https://openwrt.org) (tested only with trunk > r47025), CC should also work
|
||||
* additional software packages:
|
||||
* curl
|
||||
* wget (due to an openwrt bug still needed for certain https requests - see ticket #19621)
|
||||
* optional: busybox find with *-mtime* support for logfile housekeeping (enabled by default with r47362, will be disabled if not found)
|
||||
* the above dependencies and requirements will be checked during package installation & script startup, please check console output or *logread -e "adblock"* for errors
|
||||
* [openwrt](https://openwrt.org), tested with latest stable release (Chaos Calmer 15.05) and with current trunk (Designated Driver > r47025)
|
||||
* required software packages:
|
||||
* wget
|
||||
* optional for IPv6 support: kmod-ipt-nat6
|
||||
* the above dependencies and requirements will be checked during package installation & script runtime, please check console output or *logread -e "adblock"* for errors
|
||||
|
||||
## Usage
|
||||
* select & install adblock package (*opkg install adblock*)
|
||||
* configure */etc/config/adblock* to your needs, see additional comments in *adblock.conf.sample*
|
||||
* at least configure the ip address of the local adblock interface/uhttpd instance, it needs to be a different subnet from the normal LAN
|
||||
* recommendation: there is no need to enable all blacklist sites at once, for normal use one to three lists should be sufficient
|
||||
* recommendation: to handle all blacklists at once add an usb stick or any other storage device to supersize your /tmp directory with a swap partition
|
||||
* install the adblock package (*opkg install adblock*)
|
||||
* optional: for an update installation please replace your existing */etc/config/adblock* with a copy of */etc/samples/adblock.conf.sample* to get the latest changes
|
||||
* optional: enable/disable your required adblock list sources in */etc/config/adblock* - 'adaway', 'disconnect' and 'yoyo' are enabled by default
|
||||
* start */usr/bin/adblock-update.sh* and check console output or *logread -e "adblock"* for errors
|
||||
|
||||
## Tweaks
|
||||
* there is no need to enable all blacklist sites at once, for normal use one to three adblock list sources should be sufficient
|
||||
* if you really need to handle all blacklists at once add an usb stick or any other storage device to supersize your /tmp directory with a swap partition
|
||||
* => see [openwrt wiki](https://wiki.openwrt.org/doc/uci/fstab) for further details
|
||||
* add additional domain white- or blacklist entries, one domain per line (wildcards & regex are not allowed!), both lists are located in */etc/adblock*
|
||||
* by default openwrts main uhttpd instance is bind to all ports of your router,
|
||||
* for a working adblock setup you have to bind uhttpd to the standard LAN port only, please change listen_http accordingly
|
||||
* start /usr/bin/adblock-update.sh and check console output or *logread -e "adblock"* for errors
|
||||
* add static, personal domain white- or blacklist entries, one domain per line (wildcards & regex are not allowed!), by default both lists are located in */etc/adblock*
|
||||
* enable the backup/restore feature, to restore automatically the latest, stable backup of your adblock lists in case of any processing error
|
||||
* enable the debug log feature for continuous logfile writing to monitor the adblock runs over a longer period
|
||||
|
||||
## Distributed samples
|
||||
* all sample configuration files stored in */etc/adblock/samples*
|
||||
* to enable/disable additional domain query logging set the dnsmasq option *logqueries* accordingly, see *dhcp.config.sample*
|
||||
* to bind uhttpd to standard LAN port only, see *uhttpd.config.sample*
|
||||
* for a fully blown adblock configuration with all explained options see *adblock.conf.sample*
|
||||
* for some dnsmasq tweaks see *dhcp.config.sample* and *dnsmasq.conf.sample*
|
||||
* for rc.local based autostart and /tmp resizing on the fly see *rc.local.sample*
|
||||
* for scheduled call of *adblock-update.sh* see *root.crontab.sample*
|
||||
* to redirect/force all dns queries to your router see *firwall.user.sample*
|
||||
* for further dnsmasq tweaks see *dnsmasq.conf.sample*
|
||||
|
||||
## Examples
|
||||
## Background
|
||||
This adblock package is a dns/dnsmasq based adblock solution for openwrt.
|
||||
Queries to ad/abuse domains are never forwarded and always replied with a local IP address which may be IPv4 or IPv6.
|
||||
For that purpose adblock uses an ip address from the old reserved [class 'E'](https://tools.ietf.org/html/rfc1700) subnet (254.0.0.1 / ::ffff:fe00:0001) by default.
|
||||
Furthermore all ad/abuse queries will be filtered by ip(6)tables and redirected to internal adblock pixel server (in PREROUTING chain) or rejected (in FORWARD chain).
|
||||
All iptables and uhttpd related adblock additions are non-destructive, no hard-coded changes in 'firewall.user', 'uhttpd' config or any other openwrt related config files.
|
||||
|
||||
adblock log file excerpt:
|
||||
|
||||
adblock[11780] info : domain adblock processing started (0.40.1, r47929, 20.12.2015 21:59:56)
|
||||
adblock[11780] info : backup/restore will be disabled
|
||||
adblock[11780] info : wan update check will be disabled
|
||||
adblock[11780] info : get ntp time sync (192.168.254.254), after 0 loops
|
||||
adblock[11780] info : source doesn't change, no update required (whocares)
|
||||
adblock[11780] info : adblocklists with overall 11619 domains loaded, backups disabled
|
||||
adblock[11780] info : adblock statistics for query date 20151220 (total: 2495, blocked: 154)
|
||||
adblock[11780] info : domain adblock processing finished (0.40.1, r47929, 20.12.2015 22:00:03)
|
||||
|
||||
|
||||
domain blocklist for dnsmasq (disconnect.me after overall duplicate removal):
|
||||
|
||||
address=/0000mps.webpreview.dsl.net/192.168.2.1
|
||||
address=/0001.2waky.com/192.168.2.1
|
||||
address=/001wen.com/192.168.2.1
|
||||
address=/002it.com/192.168.2.1
|
||||
address=/00game.net/192.168.2.1
|
||||
[...]
|
||||
address=/zzsgssxh.com/192.168.2.1
|
||||
address=/zzshw.net/192.168.2.1
|
||||
address=/zztxdown.com/192.168.2.1
|
||||
address=/zzxcws.com/192.168.2.1
|
||||
#------------------------------------------------------------------
|
||||
# adblock-update.sh (0.40.0) - 3710 ad/abuse domains blocked
|
||||
# source: https://s3.amazonaws.com/lists.disconnect.me/simple_malvertising.txt
|
||||
# last modified: Thu, 17 Dec 2015 09:21:17 GMT
|
||||
|
||||
|
||||
domain query log excerpt:
|
||||
|
||||
query[A] www.seenby.de from fe80::6257:18ff:fe6b:4667
|
||||
query[A] tarifrechner.heise.de from 192.168.1.131
|
||||
query[A] www.mittelstandswiki.de from fe80::6257:18ff:fe6b:4667
|
||||
query[A] ad.doubleclick.net from 192.168.1.131
|
||||
ad.doubleclick.net is 192.168.2.1
|
||||
|
||||
|
||||
The first three queries are OK (not blocked), the last one has been blocked and answered by local dnsmasq instance.
|
||||
## Removal
|
||||
* remove the adblock package (*opkg remove adblock*)
|
||||
* remove all script generated adblock lists in */tmp/dnsmasq.d/*
|
||||
* kill the running adblock uhttpd instance (ps | grep "[u]httpd.*\-h /www/adblock")
|
||||
* run /etc/init.d/dnsmasq restart
|
||||
* run /etc/init.d/firewall restart
|
||||
|
||||
Have fun!
|
||||
Dirk
|
||||
|
||||
Reference in New Issue
Block a user