net/adblock/files/README.md

   1 # dns based ad/abuse domain blocking
   2
   3 ## Description
   4 A lot of people already use adblocker plugins within their desktop browsers, but what if you are using your (smart) phone, tablet, watch or any other wlan gadget...getting rid of annoying ads, trackers and other abuse sites (like facebook ;-) is simple: block them with your router. When the dns server on your router receives dns requests, you will sort out queries that ask for the resource records of ad servers and return the local ip address of your router and the internal web server delivers a transparent pixel instead.
   5
   6 ## Main Features
   7 * support of the following domain blocklist sources (free for private usage, for commercial use please check their individual licenses):
   8     * [adaway](https://adaway.org)
   9     * => infrequent updates, approx. 400 entries (enabled by default)
  10     * [blacklist]()
  11     * => static local blacklist, located by default in '/etc/adblock/adblock.blacklist'
  12     * [disconnect](https://disconnect.me)
  13     * => numerous updates on the same day, approx. 6.500 entries (enabled by default)
  14     * [dshield](http://dshield.org)
  15     * => daily updates, approx. 4.500 entries
  16     * [feodotracker](https://feodotracker.abuse.ch)
  17     * => daily updates, approx. 0-10 entries
  18     * [hphosts](https://hosts-file.net)
  19     * => monthly updates, approx. 50.000 entries
  20     * [malwaredomains](http://malwaredomains.com)
  21     * => daily updates, approx. 16.000 entries
  22     * [malwaredomainlist](http://www.malwaredomainlist.com)
  23     * => daily updates, approx. 1.500 entries
  24     * [openphish](https://openphish.com)
  25     * => numerous updates on the same day, approx. 1.800 entries
  26     * [palevo tracker](https://palevotracker.abuse.ch)
  27     * => daily updates, approx. 15 entries
  28     * [ransomware tracker](https://ransomwaretracker.abuse.ch)
  29     * => daily updates, approx. 150 entries
  30     * [rolist/easylist](https://easylist-downloads.adblockplus.org/rolist+easylist.txt)
  31     * => weekly updates, approx. 600 entries
  32     * [ruadlist/easylist](https://code.google.com/p/ruadlist)
  33     * => weekly updates, approx. 2.000 entries
  34     * [securemecca](http://www.securemecca.com)
  35     * => infrequent updates, approx. 25.000 entries
  36     * [shallalist](http://www.shallalist.de) (categories "adv" "costtraps" "spyware" "tracker" "warez" enabled by default)
  37     * => daily updates, approx. 32.000 entries (a short description of all shallalist categories can be found [online](http://www.shallalist.de/categories.html))
  38     * [spam404](http://www.spam404.com)
  39     * => infrequent updates, approx. 5.000 entries
  40     * [sysctl/cameleon](http://sysctl.org/cameleon)
  41     * => weekly updates, approx. 21.000 entries
  42     * [whocares](http://someonewhocares.org)
  43     * => weekly updates, approx. 12.000 entries
  44     * [winhelp](http://winhelp2002.mvps.org)
  45     * => infrequent updates, approx. 15.000 entries
  46     * [winspy](https://github.com/crazy-max/WindowsSpyBlocker)
  47     * => infrequent updates, approx. 120 entries
  48     * [yoyo](http://pgl.yoyo.org/adservers)
  49     * => weekly updates, approx. 2.500 entries (enabled by default)
  50     * [zeus tracker](https://zeustracker.abuse.ch)
  51     * => daily updates, approx. 440 entries
  52 * zero-conf like automatic installation & setup, usually no manual changes needed (i.e. ip address, network devices etc.)
  53 * supports a wide range of router modes (incl. AP mode), as long as firewall and dnsmasq are installed and in use
  54 * full IPv4 and IPv6 support
  55 * each blocklist source will be updated and processed separately
  56 * timestamp check to download and process only updated adblock list sources
  57 * overall duplicate removal in separate adblock lists (will be automatically disabled on low memory systems)
  58 * adblock source list parsing by fast & flexible regex rulesets
  59 * additional whitelist for manual overrides, located by default in /etc/adblock/adblock.whitelist
  60 * quality checks during & after update of adblock lists to ensure a reliable dnsmasq service
  61 * adblock statistics, last runtime and list states/counts/update times will be stored in uci config for LuCI frontend
  62 * status & error logging to stdout and syslog
  63 * use two dynamic uhttpd instances as adblock pixel server, separated for ads delivered on port 80 and on port 443
  64 * use dynamic iptables chains/rulesets for adblock related redirects/rejects
  65 * init system support (start/stop/restart/reload/toggle/stats/cfgup)
  66 * hotplug support, the adblock start will be triggered by wan 'ifup' event, this can be restricted to a certain wan interface or disabled at all (see config options below)
  67 * toggle to quickly switch adblock 'on' or 'off'
  68 * query function to quickly identify blocked (sub-)domains, i.e. for whitelisting
  69 * optional: automatic adblock list backup/restore, backups will be (de-)compressed on the fly (disabled by default)
  70 * optional: add new adblock sources via uci config (see example below)
  71
  72 ## Prerequisites
  73 * [openwrt](https://openwrt.org), tested with latest stable release (Chaos Calmer) and with current trunk (Designated Driver)
  74 * [LEDE project](https://www.lede-project.org), tested with trunk > r98
  75 * usual setup with enabled 'iptables', 'dnsmasq' and 'uhttpd' - dump AP modes without these basics are _not_ supported!
  76 * additional required software packages:
  77     * a download utility: 'uclient-fetch' and 'wget' (full versions with ssl support) are supported. Normally you should use 'wget', it's quite stable and supports the online timestamp checks. If you need a smaller memory footprint try 'uclient-fetch' without openssl dependency. The default ustream ssl backend 'libustream-polarssl' has issues with certain https sites and is currently not supported. To change the ssl backend see example below.
  78     * optional: 'kmod-ipt-nat6' for IPv6 support
  79 * the above dependencies and requirements will be checked during package installation & script runtime
  80
  81 ## OpenWrt / LEDE trunk Installation & Usage
  82 * install 'adblock' (_opkg install adblock_)
  83 * adblock starts automatically during boot, triggered by wan-ifup event, check _logread -e "adblock"_ for adblock related information
  84 * optional: start/restart/stop the adblock service manually with _/etc/init.d/adblock_
  85 * optional: enable/disable your required adblock list sources in _/etc/config/adblock_ - 'adaway', 'disconnect' and 'yoyo' are enabled by default
  86 * optional: maintain the adblock service in LuCI under 'System => Startup'
  87
  88 ## LuCI adblock companion package
  89 * for easy management of the various blocklist sources and adblock options there is also a nice & efficient LuCI frontend available
  90 * install 'luci-app-adblock' (_opkg install luci-app-adblock_)
  91 * the application is located in LuCI under 'Services' menu
  92 * _Thanks to Hannu Nyman for this great adblock LuCI frontend!_
  93
  94 ## Chaos Calmer installation notes
  95 * 'adblock' and 'luci-app-adblock' are _not_ available as .ipk packages in the Chaos Calmer download repository
  96 * download both packages from a development snapshot package directory:
  97     * for 'adblock' look [here](https://downloads.lede-project.org/snapshots/packages/x86_64/packages/)
  98     * for 'luci-app-adblock' look [here](https://downloads.lede-project.org/snapshots/packages/x86_64/luci/)
  99 * manually transfer the packages to your routers temp directory (with tools like _sshfs_ or _winscp_)
 100 * install the packages with _opkg install <...>_ as described above
 101
 102 ## Tweaks
 103 * **storage:** to process & store all blocklist sources at once it might helpful to enlarge your temp directory with a swap partition => see [openwrt wiki](https://wiki.openwrt.org/doc/uci/fstab) for further details
 104 * **white-/blacklist:** add domain white- or blacklist entries to always-allow or -deny certain (sub) domains, by default both lists are located in _/etc/adblock_. Please add one domain per line - ip addresses, wildcards & regex are _not_ allowed (see example below)
 105 * **backup/restore:** enable the backup/restore feature, to restore automatically the latest compressed backup of your adblock lists in case of any processing error (i.e. a single blocklist source is down). Please use an (external) solid partition and _not_ your volatile router temp directory for this
 106 * **list updates:** for a scheduled call of the adblock service add an appropriate crontab entry (see example below)
 107 * **hotplug fine tuning:** to restrict hotplug support to a certain wan interface or to disable it at all, you can set 'adb\_hotplugif' to an existing interface like 'wan' or to a non-existing 'dummy' interface
 108 * **new list sources:** you could add new blocklist sources on your own via uci config, all you need is a source url and an awk one-liner (see example below)
 109 * **AP mode:** in 'AP mode' adblock uses automatically the local router ip as nullip address. To make sure that your LuCI interface will be still accessible, you have to change the local uhttpd instance to ports <> 80/443 (see example below), also make sure that firewall and dnsmasq are installed and running
 110 * **restricted mode:** to disable flash writes with adblock status information to the adblock config file (used by LuCI frontend), please set 'adb\_restricted' to '1'
 111 * **adblock toggle:** to quickly switch adblocking 'on' or 'off', simply use _/etc/init.d/adblock toggle_
 112 * **adblock statistics:** to update only the adblock statistics (without updating the block lists as well), please run _/etc/init.d/adblock stats_
 113 * **adblock query `<DOMAIN>`:** to query the active blocklists for a specific domain, please run _/etc/init.d/adblock query `<DOMAIN>`_ (see example below)
 114 * **configuration update:** to update an outdated adblock config file with the current default version, please run _/etc/init.d/adblock cfgup_, make your individual changes and start the adblock service again
 115 * **debugging:** for script debugging please set the 'adb\_debug' variable in the header of _/etc/init.d/adblock_ to '1'
 116 * **disable active dns probing in windows:** to prevent a possible yellow exclamation mark on your internet connection icon (which wrongly means connected, but no internet), please change the following registry key/value from "1" to "0" _HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet\EnableActiveProbing_
 117
 118 ## Further adblock config options
 119 * usually the adblock autodetection works quite well and no manual config overrides are needed, all options apply to the 'global' config section:
 120     * adb\_enabled => main switch to enable/disable adblock service (default: '1', enabled)
 121     * adb\_cfgver => config version string (do not change!) - adblock will check this entry during startup
 122     * adb\_lanif => name of the logical lan interface (default: 'lan')
 123     * adb\_nullport => port of the adblock uhttpd instance used for ads delivered on port 80 (default: '65534')
 124     * adb\_nullportssl => port of the adblock uhttpd instance used for ads delivered on port 443 (default: '65535')
 125     * adb\_nullipv4 => IPv4 blackhole ip address (default: '198.18.0.1', in AP mode: local router ip)
 126     * adb\_nullipv6 => IPv6 blackhole ip address (default: '::ffff:c612:0001', in AP mode: local router ip)
 127     * adb\_forcedns => redirect all local DNS queries to the local dnsmasq resolver (default: '1', enabled / always disabled in 'AP mode')
 128     * adb\_fetchttl => set the timeout for list downloads (default: '5' seconds)
 129     * adb\_restricted => disable updates of the adblock config file (no flash writes) during runtime (default: '0', disabled)
 130     * adb\_hotplugif => restrict hotplug support to a certain wan interface or disable it at all (default: '', disabled)
 131
 132 ## Examples
 133
 134 **example to change the ssl backend for 'uclient-fetch':**
 135 <pre><code>
 136 opkg update
 137 opkg remove --force-depends libustream-polarssl
 138 opkg install libustream-mbedtls
 139 </code></pre>
 140
 141 **example cronjob for a regular block list update:**
 142 <pre><code>
 143 # configuration found in /etc/crontabs/root
 144 # start adblock script once a day at 6 a.m.
 145 #
 146 0 06 * * *    /etc/init.d/adblock start
 147 </code></pre>
 148
 149 **example blacklist entry (/etc/adblock/adblock.blacklist):**
 150 <pre><code>
 151 ads.example.com
 152
 153 This entry blocks the following (sub)domains:
 154   http://ads.example.com/foo.gif
 155   http://server1.ads.example.com/foo.gif
 156   https://ads.example.com:8000/
 157
 158 This entry does not block:
 159   http://ads.example.com.ua/foo.gif
 160   http://example.com/
 161 </code></pre>
 162
 163 **example whitelist entry (/etc/adblock/adblock.whitelist):**
 164 <pre><code>
 165 here.com
 166
 167 This entry removes the following (sub)domains from the blocklists:
 168   maps.here.com
 169   here.com
 170
 171 This entry does not remove:
 172   where.com
 173   www.adwhere.com
 174 </code></pre>
 175
 176 **example uhttpd configuration in AP mode:**
 177 <pre><code>
 178 # configuration found in /etc/config/uhttpd
 179 # change default http/https ports <> 80/443
 180 #
 181 config uhttpd 'main'
 182     list listen_http '0.0.0.0:88'
 183     list listen_https '0.0.0.0:445'
 184 </code></pre>
 185
 186 **example to query active blocklists for a certain (sub-)domain, i.e. for whitelisting:**
 187 <pre><code>
 188 /etc/init.d/adblock query "example.www.doubleclick.net"
 189 => distinct results for domain 'example.www.doubleclick.net' (overall 0)
 190    no matches in active blocklists
 191 => distinct results for domain 'www.doubleclick.net' (overall 1)
 192    adb_list.winhelp     : www.doubleclick.net
 193 => distinct results for domain 'doubleclick.net' (overall 252)
 194    adb_list.adaway      : ad-g.doubleclick.net
 195    adb_list.hphosts     : 1016557.fls.doubleclick.net
 196    adb_list.rolist      : feedads.g.doubleclick.net
 197    adb_list.securemecca : 1168945.fls.doubleclick.net
 198    adb_list.sysctl      : ad.co.doubleclick.net
 199    adb_list.whocares    : 3ad.doubleclick.net
 200    adb_list.winhelp     : 1435575.fls.doubleclick.net
 201
 202 The query function checks against the submitted (sub-)domain and recurses automatically to the upper top level domain(s).
 203 For every domain it returns the overall count plus a distinct list of active blocklists with the first relevant result.
 204 In the example above you have to whitelist "www.doubleclick.net" to free the submitted domain.
 205 </code></pre>
 206
 207 **example to identify blocked domains during web browsing, i.e. for whitelisting:**
 208 <pre><code>
 209 1. the easy way ...
 210 enable the network analysis builtins in chrome or firefox to identify domains
 211 which are redirected to the adblock null-ip (default 198.18.0.1), add these domains to your whitelist
 212
 213 2. a bit harder ...
 214 enable 'Log queries' in the dnsmasq configuration (via LuCI Network => DHCP/DNS),
 215 ssh to your router and start tracing with 'logread -f -e "dnsmasq" -e "198.18.0.1"'
 216 switch to your client, access the relevant site and check all domains
 217 that are blocked/listed in logread, add these domains to your whitelist
 218
 219 => finally restart the adblock service (/etc/init.d/adblock restart) in both variants
 220 </code></pre>
 221
 222 **example to add a new blocklist source:**
 223 <pre><code>
 224 1. the easy way ...
 225 example: https://easylist-downloads.adblockplus.org/rolist+easylist.txt
 226 adblock already supports an easylist source, called 'ruadlist'. To add the additional local easylist
 227 as a new source, copy the existing config source 'ruadlist' section and change only
 228 the source name, the url and the description - that's all!
 229
 230 config source 'rolist'
 231   option enabled '0'
 232   option adb_src 'https://easylist-downloads.adblockplus.org/rolist+easylist.txt'
 233   option adb_src_rset '{FS=\"[|^]\"} \$0 ~/^\|\|([A-Za-z0-9_-]+\.){1,}[A-Za-z]+\^$/{print tolower(\$3)}'
 234   option adb_src_desc 'focus on romanian ad related domains plus generic easylist additions, weekly updates, approx. 600 entries'
 235
 236 2. a bit harder ...
 237 to add a really new source with different domain/host format you have to write a suitable
 238 awk one-liner on your own, so basic awk skills are needed. As a starting point check the already
 239 existing awk strings (adb_src_rset) in adblock config, maybe you need only small changes for your individual list.
 240 Download the desired list and test your new awk string locally with:
 241   cat new.list | awk 'fs__individual search__search core__result'
 242   'fs' => field separator (optional)
 243   'individual search' => individual search part to filter out needless list information
 244   'search core' => always '([A-Za-z0-9_-]+\.){1,}[A-Za-z]+', this is part of all list sources and should be unchanged
 245   'result' => always '{print tolower(\$n)}', only the output column 'n' may vary
 246 the output result should be a sequential list with one domain/host per line - nothing more.
 247
 248 If your awk one-liner works quite well, add a new source section in adblock config and test your new source
 249 </code></pre>
 250
 251 ## Background
 252 This adblock package is a dns/dnsmasq based adblock solution.
 253 Queries to ad/abuse domains are never forwarded and always replied with a local IP address which may be IPv4 or IPv6. For that purpose adblock uses an ip address from the private 'Benchmark Test' subnet (198.18.0.1 / ::ffff:c612:0001) by default (in AP mode the local router ip address will be used). Furthermore all ad/abuse queries will be filtered by ip(6)tables and redirected to two uhttpd instances, separated for ads delivered on port 80 and on port 443 (in PREROUTING chain) or rejected (in FORWARD or OUTPUT chain). In 'AP mode' only the uhttpd related rules in PREROUTING chain are enabled.
 254
 255 All iptables and uhttpd related adblock additions are non-destructive, no hard-coded changes in 'firewall.user', 'uhttpd' config or any other system related config files. There is _no_ adblock background daemon running, the (scheduled) start of the adblock service keeps only the adblock lists up-to-date.
 256
 257 ## Support
 258 Please join the adblock discussion in this [openwrt forum thread](https://forum.openwrt.org/viewtopic.php?id=59803) or contact me by mail <dev@brenken.org>
 259
 260 ## Removal
 261 * stop all adblock related services with _/etc/init.d/adblock stop_
 262 * optional: remove the adblock package (_opkg remove adblock_)
 263
 264 Have fun!
 265 Dirk