Diversion https ads being allowed

[Ellenswamy]

This could also be an issue specific to iOS and their policies for handling certificates (specifically pixelserv-tls uses user made certificates.).

Right. I imported it into my Mac but haven’t into my phone yet. I saw it wasn’t required but I guess could help. I saw that you can do this for the router also..is that recommended?

 

[SomeWhereOverTheRainBow]

Right. I imported it into my Mac but haven’t into my phone yet. I saw it wasn’t required but I guess could help. I saw that you can do this for the router also..is that recommended?

not necessary for the router itself. that is just for users who want a consistent user certificate.

 

[Ellenswamy]

You should be doing fine. The https traffic you see being returned for the "blocked" domains should be pixelservtls responding with its pixel obviously it would be as if you did not see an ad appearance wise because where the ad would have been you would have a tiny pixel. Any non https should be blocked as A.

With pixelserv tls disabled , and Diversion lite, your https will just time out, and you would see blank ad space where the ad normally would be, but fails to load.

So https according to the Logs should show blocked if it’s an ad? Mine is showing blocked for A record and then shows allowed for the same url over https.

 

[SomeWhereOverTheRainBow]

So https according to the Logs should show blocked if it’s an ad? Mine is showing blocked for A record and then shows allowed for the same url over https.

Okay can you be more specific? are you able to see this ad you are observing in an actual browser at the same time you are observing it being allowed in the logs?

 

[Ellenswamy]

Okay can you be more specific? are you able to see this ad you are observing in an actual browser at the same time you are observing it being allowed in the logs?

Ok so now it seems to be acting as expected. I reinstalled diversion yesterday and also changed Merlin to force doh to yes. I wonder if that was part of the issue, was set to auto before.

since my % blocked went from about 1.5% to almost 14%

 

[SomeWhereOverTheRainBow]

Ok so now it seems to be acting as expected. I reinstalled diversion yesterday and also changed Merlin to force doh to yes. I wonder if that was part of the issue, was set to auto before.

since my % blocked went from about 1.5% to almost 14%

I noticed a similar behavior one time, but I wasn't able to replicate it later on so I assumed it went away. Maybe it could be an issue with auto at the firmware level. @RMerlin would have to look into that. I am not going to pretend to know what goes on in those lines of code in the firmware. I notice on my router settings I have mine set to yes as well.

 

[chongnt]

So https according to the Logs should show blocked if it’s an ad? Mine is showing blocked for A record and then shows allowed for the same url over https.

I had this issue before that DNS query type 65 (https) is not blocked. I could not recall for what reason I removed tls certificate from my device. Anyway, I manage to use iptables to blanket block all DNS query type 65. You may give it a try.

Diversion - Seeing Ads (Mobile/Tablets)

It actually blocks the character 65, so it also blocks dns queries with a total length of 65 lol. It seems better to create custom firmware using the source below. https://github.com/rozahp/dnsmasq Like others I found a few normal query blocked due to this as well. I tested by manually adding...

www.snbforums.com

 

[Treadler]

Ok so now it seems to be acting as expected. I reinstalled diversion yesterday and also changed Merlin to force doh to yes. I wonder if that was part of the issue, was set to auto before.

since my % blocked went from about 1.5% to almost 14%

FWIW, my normal Diversion blocked % ranges from about 14 to 21.
Sounds like you’re on the right track now.

 

[Ellenswamy]

I had this issue before that DNS query type 65 (https) is not blocked. I could not recall for what reason I removed tls certificate from my device. Anyway, I manage to use iptables to blanket block all DNS query type 65. You may give it a try.

Diversion - Seeing Ads (Mobile/Tablets)

It actually blocks the character 65, so it also blocks dns queries with a total length of 65 lol. It seems better to create custom firmware using the source below. https://github.com/rozahp/dnsmasq Like others I found a few normal query blocked due to this as well. I tested by manually adding...

www.snbforums.com

I am confused at how to run this, still a newb lol. Also any downsides?

 

[chongnt]

I am confused at how to run this, still a newb lol. Also any downsides?

You can apply it in ssh. It blocks all DNS query type 65, so such request will not even reach diversion. I don’t face any downside. You can run the unblock commands to remove it or a reboot will clear it.

 

[Ellenswamy]

You can apply it in ssh. It blocks all DNS query type 65, so such request will not even reach diversion. I don’t face any downside. You can run the unblock commands to remove it or a reboot will clear it.

Ah ok. So after a reboot you will have to reapply

 

[chongnt]

Ah ok. So after a reboot you will have to reapply

Yes. If you want to keep it can put it in /jffs/scripts/firewall-start scripts.