#!/bin/sh # adblock cgi remote script - dns based ad/abuse domain blocking # Copyright (c) 2026 Dirk Brenken # This is free software, licensed under the GNU General Public License v3. # (s)hellcheck exceptions # shellcheck disable=all # load relevant uci options # nft_remote="$(uci -q get adblock.global.adb_nftremote)" nft_macremote="$(uci -q get adblock.global.adb_nftmacremote)" nft_remotetimeout="$(uci -q get adblock.global.adb_nftremotetimeout)" nft_authorized="0" # parse query # query_str="${QUERY_STRING}" query_mac="${query_str#*mac=}" query_mac="${query_mac%%&*}" query_mode="${query_str#*mode=}" query_mode="${query_mode%%&*}" [ "${query_mac}" = "${query_str}" ] && query_mac="" [ "${query_mode}" = "${query_str}" ] && query_mode="" # URL decode helper # urldecode() { printf '%b' "${1//%/\\x}" } # lowercase helper # tolower() { local low="${1}" low="${low//A/a}" low="${low//B/b}" low="${low//C/c}" low="${low//D/d}" low="${low//E/e}" low="${low//F/f}" printf '%s' "${low}" } # determine MAC if not provided # if [ -z "${query_mac}" ]; then query_ip="${REMOTE_ADDR}" query_mac="$(ip neigh show 2>/dev/null | awk -v ip="${query_ip}" '$1==ip {print $5; exit}' 2>/dev/null)" else query_mac="$(urldecode "${query_mac}")" fi # validate MAC address # case "${query_mac}" in [0-9A-Fa-f][0-9A-Fa-f]:[0-9A-Fa-f][0-9A-Fa-f]:[0-9A-Fa-f][0-9A-Fa-f]:[0-9A-Fa-f][0-9A-Fa-f]:[0-9A-Fa-f][0-9A-Fa-f]:[0-9A-Fa-f][0-9A-Fa-f]) query_mac="$(tolower "${query_mac}")" ;; *) query_mac="" ;; esac # validate mode # [ "${query_mode}" = "renew" ] || query_mode="" # output header and start html # printf '%s\n\n' "Content-Type: text/html" printf '%s\n' " Adblock Remote Allow

Adblock Remote Allow

" # check if remote allow is enabled and MAC addresses are configured # if [ "${nft_remote}" != "1" ] || [ -z "${nft_macremote}" ]; then printf '%s\n' "
Adblock Remote Allow is not enabled or no MAC addresses configured
" exit 0 fi if [ -z "${query_mac}" ]; then printf '%s\n' "
MAC address could not be determined
" exit 0 fi # check MAC authorization # nft_macremote="$(tolower "${nft_macremote}")" case " ${nft_macremote} " in *" ${query_mac} "*) nft_authorized="1" ;; esac if [ "${nft_authorized}" = "0" ]; then printf '%s\n' "
This device (${query_mac}) is not registered for Adblock Remote Allow
" exit 0 fi # extract remaining timeout # remaining="$(nft list set inet adblock mac_remote 2>/dev/null | awk -v mac="${query_mac}" ' $0 ~ mac { for (i = 1; i <= NF; i++) { if ($i == "expires") { val = $(i+1) gsub(/[,}]/, "", val) sub(/s.*/, "s", val) print val exit } } } ')" # show renew option # if [ -z "${query_mode}" ] && [ -z "${remaining}" ]; then printf '%s\n' "
This device currently does not bypass ad blocking
Bypass
" exit 0 fi # add MAC and redirect to main page to show remaining time # if [ -z "${remaining}" ] && [ "${query_mode}" = "renew" ]; then printf '%s\n' "
Adding device...
" nft add element inet adblock mac_remote "{ ${query_mac//[!0-9a-f:]/} }" >/dev/null 2>&1 printf '%s\n' "" exit 0 fi # show remaining time # printf '%s\n' "
This device temporarily bypasses ad blocking
Remaining time: ${remaining:-${nft_remotetimeout}m}
" exit 0