MegaMango
New Around Here
Hello everyone,
As many of you know, the Asus RT-BE88U router does not yet have Merlin firmware support. I wanted to ensure the security and privacy of my network while using the stock Asus firmware, particularly for blocking ads and malicious sites.
This led me to adopt and update a project originally developed by Tomasz Wiszkowski nearly 7 years ago: dnsmasq-surrogate.
I’ve modified and improved the original project to work on the RT-BE88U, fixing various issues and bugs along the way. Find the latest release here (github.com).
One of the challenges with the stock firmware is that any changes you make to the dnsmasq.conf file (for example, to add ad-blocking hosts) get overwritten by the firmware every time the dnsmasq service restarts. This makes it impossible to permanently customize dnsmasq behavior by simply editing the configuration file.
This is where surrogate comes in.
It intercepts and updates the dnsmasq.conf configuration automatically, allowing to:
Once installed, dnsmasq-surrogate can feed dnsmasq with any additional hosts files, providing ad-blocking and custom DNS filtering.
For example, you can download StevenBlack’s adblock and fake news hosts lists using the following commands:
After placing the files in /jffs/dnsmasq-surrogate/hosts/ and restarting the service, check the dnsmasq.conf for changes:
You should see something like this:
This script automatically updates the blocklists and removes any domains listed in your whitelist.
Add domains you want to whitelist (e.g., s.youtube.com). The script will ensure that any whitelisted domains are excluded from the blocklists.
Please note: I’m primarily a C# developer, and this is my first experience working with C/C++ projects. I’ve done my best to adapt and improve this project for the BE88U, but there may still be some rough edges. If you encounter any issues or have suggestions, feel free to post it here.
speedtest.com when surrogate is off
speedtest.com when it is on
As many of you know, the Asus RT-BE88U router does not yet have Merlin firmware support. I wanted to ensure the security and privacy of my network while using the stock Asus firmware, particularly for blocking ads and malicious sites.
This led me to adopt and update a project originally developed by Tomasz Wiszkowski nearly 7 years ago: dnsmasq-surrogate.
I’ve modified and improved the original project to work on the RT-BE88U, fixing various issues and bugs along the way. Find the latest release here (github.com).
What Is dnsmasq-surrogate?
The dnsmasq-surrogate acts as an intermediary for dnsmasq, allowing to manage additional hosts files that block ads, malicious websites, and other unwanted domains. This is similar to ad-blocking functionality, and it runs on top of the stock Asus firmware.One of the challenges with the stock firmware is that any changes you make to the dnsmasq.conf file (for example, to add ad-blocking hosts) get overwritten by the firmware every time the dnsmasq service restarts. This makes it impossible to permanently customize dnsmasq behavior by simply editing the configuration file.
This is where surrogate comes in.
It intercepts and updates the dnsmasq.conf configuration automatically, allowing to:
- Add custom hosts files for ad-blocking and security.
- Make persistent changes that won't be overwritten by the Asus firmware.
- Control which domains are blocked and whitelisted without manually editing the config every time the service restarts.
Installation Instructions
Before you begin, you’ll need to install Entware, which provides the necessary environment for installing dnsmasq-surrogate on the stock Asus firmware.Prerequisites:
- Install Entware by following the guide here: Entware on Asus Stock Firmware.
- most likely you will need these opkg packages: nano, curl, tar
- Run this command from the router to download latest binary and unarchive it to the `/opt` folder
Bash:
cd /opt && curl -L https://github.com/daniellavrushin/asus-dnsmasq-surrogate/releases/download/2.2.0/dnsmasq-surrogate-be88u-2.2.0.tar.gz | tar -zxOnce installed, dnsmasq-surrogate can feed dnsmasq with any additional hosts files, providing ad-blocking and custom DNS filtering.
Setting Up Ad Blocking
To enable ad-blocking, simply place any hosts file (such as those provided by StevenBlack) in the following directory:
Code:
/jffs/dnsmasq-surrogate/hosts/For example, you can download StevenBlack’s adblock and fake news hosts lists using the following commands:
Bash:
curl -o /jffs/dnsmasq-surrogate/hosts/adblock.hosts https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
curl -o /jffs/dnsmasq-surrogate/hosts/fakenews.hosts https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews/hostsAfter placing the files in /jffs/dnsmasq-surrogate/hosts/ and restarting the service, check the dnsmasq.conf for changes:
Code:
nano /etc/dnsmasq.confYou should see something like this:
Code:
# Config file generated using dnsmasq surrogate
addn-hosts=/jffs/dnsmasq-surrogate/hosts/adblock.hosts
addn-hosts=/jffs/dnsmasq-surrogate/hosts/fakenews.hostsExtra: Automatic Hosts File Updates
For convenience, I’ve also created a simple script to automate the process of downloading and updating the blocklists:
Bash:
#!/bin/sh
# Download the updated hosts files
curl -o /jffs/dnsmasq-surrogate/hosts/adblock.hosts https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
curl -o /jffs/dnsmasq-surrogate/hosts/fakenews.hosts https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews/hosts
# Path to whitelist
WHITELIST=/jffs/dnsmasq-surrogate/whitelist
# Filter out whitelisted domains from adblock.hosts
grep -vFf $WHITELIST /jffs/dnsmasq-surrogate/hosts/adblock.hosts > /tmp/adblock.hosts
mv /tmp/adblock.hosts /jffs/dnsmasq-surrogate/hosts/adblock.hosts
# Filter out whitelisted domains from fakenews.hosts
grep -vFf $WHITELIST /jffs/dnsmasq-surrogate/hosts/fakenews.hosts > /tmp/fakenews.hosts
mv /tmp/fakenews.hosts /jffs/dnsmasq-surrogate/hosts/fakenews.hosts
# Restart dnsmasq to apply changes
service restart_dnsmasqWhitelisting Domains
Sometimes, blocking certain domains can cause issues with services you use. For example, blocking s.youtube.com can prevent YouTube from remembering your video history. To resolve this, you can create a whitelist file:
Code:
nano /jffs/dnsmasq-surrogate/whitelistConclusion
If you’re using the Asus RT-BE88U and want ad-blocking functionality similar to Merlin firmware, give dnsmasq-surrogate a try. You might want to try this in another BE router, but I am not sure if it will work there or not.Please note: I’m primarily a C# developer, and this is my first experience working with C/C++ projects. I’ve done my best to adapt and improve this project for the BE88U, but there may still be some rough edges. If you encounter any issues or have suggestions, feel free to post it here.
PS
You can use this adblock test site to see the difference, in my case it is 97% blocked having all browser adblock extensions disabled in my browser:speedtest.com when surrogate is off
speedtest.com when it is on
Last edited:
