Firewall > URL filter

[PrivateJoker]

How does this feature actually work?

I like to filter out tracking stuff, ad delivery services, etc., and also block a few websites that I find useless but whose links are everywhere. I had been using OpenDNS for this, but had run into their hard limit of domains that can be blocked.

Now I've been trying the URL blocking built into Merlin's great build, but (at least from my not super technical background) it seems to take more tries to go out and find something, not find it, try again, not find it, etc., then finally tell browser "no I couldn't find that" vs. whatever method OpenDNS is able to use by their block list.

Like I said this is just my subjective observation, I don't know, it could be the same method but I'm comparing from different devices on different days under different conditions. . .

But the more I tend to use IPV6 now, I can't use OpenDNS, they only have an IPV6 recursive sandbox going, so I have to use my ISP's DNSes.

thanks for any input!

 

[PrivateJoker]

Well I poked around Asus's website and for a different router they described it as follows: The URL Filter is based on DNS query. So when you want to access the website which has address contains the keyword you set, the router will block the DNS query. But if the local PC already accessed the address before, a DNS cache will be saved in OS. And thus the URL filter function cannot work normal.


Ok I just tested it myself by blocking a sample domain (funnyjunk.com) in OpenDNS and using that as my DNS, within 2 seconds it returns and says "domain blocked. . ."

Then I tried reverting my DNS to normal and adding funnyjunk.com to the blocked list of URLs under Asus RT-N66 firewall, and it took over a minute of trying to resolve before it gave up!

This explains why trying to subvert ad trackers, misc. ads and other stuff using the Asus's built in URL filter is totally useless, it just makes page loads hang (if I'm trying to filter out a banner ad or some such thing on a known good page that might have some unwanted content on it from other domains).

Guess I'll be turning the URL filter back off on the router and I'm kinda stuck not being able to use OpenDNS because it limits you to only 20 or so domains ( going to cnet.com alone grabs content and trackers from almost 20 domains) which I've maxed out and also it doesn't do IPV6, why my ISP's DNS does in fact do.

I don't know if this is a something RMerlin can improve, or if Asus has inherently designed it in a crappy way that cannot be made better?

 

[coxhaus]

Maybe try a UTM device behind your router and let it do the filtering. They are faster than a router for that kind of filtering.

 

[PrivateJoker]

Maybe try a UTM device behind your router and let it do the filtering. They are faster than a router for that kind of filtering.

@coxhaus it's funny you say that, I have been thinking of doing that exact thing, maybe the Astaro. So many options!

 

[RMerlin]

Look at ryzhov_al's instructions on how to implement a firewall-level ad blocker, using ipset. It might be usable for similar uses.

I might eventually take a look at how Asus implement the various access control features, but with so many things on my todo list, these aren't anywhere near the top yet I'm afraid.