Running dnsmasq with a huge config file like pihole - possible/sensible?

[chrisisbd]

I currently run dnsmasq on a server on my LAN with a pihole-like configuration. I.e. I have a huge list of advertising sites to ignore in /etc/dnsmasq.d/dnsmasq.blacklist.txt, The file is just a long list of entries like:-

...
...
address=/krer.com/   
address=/kreruf.wiki/
address=/kresimir.emiliamilena.pl/
address=/krespyst.com/
address=/krestinaful.com/
address=/krestovskiy.nik.siteme.org/
address=/kreten.banjalucke-ljepotice.ru/
address=/kreud.com/
address=/kreuz.hopto.org/
...
...

The blacklist gets updated weekly using a cron job. It's about 12Mb, 400000 lines.

Can the dnsmasq on an Asus router (e.g. DSL-AC68U) cope with something like this? I know some people have got pihole running on Asuswrt-Merlin and the above dnsmasq configuration is basically what pihole does, so it seems that it should work OK. I have entware installed, there's a USB stick providing 32Gb of disk space, so disk space isn't an issue for the file (it won't need to be in /jffs), I just wonder about the memory requirements of dnsmasq when it loads the file.

Any/all feedback would be very welcome.

 

[dave14305]

Most Merlin users just run the Diversion Addon to do ad-blocking. That wheel has already been invented.

Diversion - Diversion 5.1.3 - the Router Ad-Blocker, May 09, 2024

Welcome This is Diversion - the Router Ad-Blocker for Asuswrt-Merlin For more about Diversion check out the Diversion website. What's new in this Diversion 5.1.3 patch release Deregisters additional Dnsmasq instance IPs when rebooting. Diversion is free to use under the GNU General Public...

www.snbforums.com

 

[martinr]

Most Merlin users just run the Diversion Addon to do ad-blocking. That wheel has already been invented.

And with great success and satisfaction, too.

 

[ColinTaylor]

It's about 12Mb, 400000 lines.

My blocklist is 5.3MB, 204805 lines. dnsmasq's total memory consumption on my router is 12MB. You shouldn't have a problem on your DSL-AC68U.

 

[glens]

Most Merlin users just run the Diversion Addon to do ad-blocking. That wheel has already been invented.

Diversion - Diversion 5.1.3 - the Router Ad-Blocker, May 09, 2024

Welcome This is Diversion - the Router Ad-Blocker for Asuswrt-Merlin For more about Diversion check out the Diversion website. What's new in this Diversion 5.1.3 patch release Deregisters additional Dnsmasq instance IPs when rebooting. Diversion is free to use under the GNU General Public...

www.snbforums.com

But some Merlin (and stock FW?) users (raising hand here re: Merlin) rely instead on WWW browser extensions which have much more intimate (thus more specific) knowledge, plus running relatively very much more effortlessly on superior hardware...

 

[bluepoint]

But some Merlin (and stock FW?) users (raising hand here re: Merlin) rely instead on WWW browser extensions which have much more intimate (thus more specific) knowledge, plus running relatively very much more effortlessly on superior hardware...

Which means your ad blocking is not universal. With diversion everyone in your network is covered.

 

[glens]

Not worried about "everything in my network"... Client phone apps are going to do what they do, and I doubt Meta (which I don't use, despite having an /extremely/ low user ID, if they remember me) is using DNS anyway. They make their living doing end-runs on that kind of stuff. Web browser traffic is the only thing /I/ consider worth fighting over, and the few clients which do that here are very easily maintained individually; duckduckgo browsers and same browser extension plus uBlock Origin browser extension does all I deem necessary.

Prior to google pushing HTTPS on everybody/everything I used to maintain an elaborate privoxy setup. Nothing like making web pages do/act like one wants instead of how /they/ want it to behave. I'm confident that google's "we want to keep everybody safe" shirt really means "we don't want anybody thwarting our efforts by using proxies."

 

[bluepoint]

Not worried about "everything in my network"... Client phone apps are going to do what they do, and I doubt Meta (which I don't use, despite having an /extremely/ low user ID, if they remember me) is using DNS anyway. They make their living doing end-runs on that kind of stuff. Web browser traffic is the only thing /I/ consider worth fighting over, and the few clients which do that here are very easily maintained individually; duckduckgo browsers and same browser extension plus uBlock Origin browser extension does all I deem necessary.

Prior to google pushing HTTPS on everybody/everything I used to maintain an elaborate privoxy setup. Nothing like making web pages do/act like one wants instead of how /they/ want it to behave. I'm confident that google's "we want to keep everybody safe" shirt really means "we don't want anybody thwarting our efforts by using proxies."

No one apps/browser escapes DNS and when Global router is controlled everyone is diversioned. Don't get me wrong I use UO with my browser when watching youtube only, it's a good thing UO can be toggled on/off effectively using on demand when needed.

 

[glens]

No one apps/browser escapes DNS

Methinks investigating that notion might prove worthwhile to you. Anti-"thwarting" measures go well beyond dumping the HTTP (non-S) protocol. DNS block-lists are old-school anymore. Not entirely without value yet, but certainly much less so than historically.

 

[bluepoint]

Methinks investigating that notion might prove worthwhile to you. Anti-"thwarting" measures go well beyond dumping the HTTP (non-S) protocol. DNS block-lists are old-school anymore. Not entirely without value yet, but certainly much less so than historically.

Thwarting is the reason google wants us to use DoH, safari for different method to avoid being mis-directed but knowledgeable user knows how to avoid them or use different way(DoT) if wants DNS encrypted. Users need to cope with time and not get stuck with old habits.

 

[glens]

That's what I'm saying...