Using Unbound as an Ad-blocker - Revision history

Prabuanand: added heading

2025-11-06T15:40:41Z

added heading

← Older revision		Revision as of 15:40, 6 November 2025
Line 5:		Line 5:
	* You should have a {{Pkg\|dnsmasq}} (or another DHCP server) and [[Setting_up_unbound_DNS_server\|unbound]] both working on your network.		* You should have a {{Pkg\|dnsmasq}} (or another DHCP server) and [[Setting_up_unbound_DNS_server\|unbound]] both working on your network.

	== ~~Configuration~~ ==		== Ad-blocker blacklists ==

	~~There are few steps to setup Unbound to Block/Refuse unwanted addresses.~~ There are a number of freely available blacklists on the net. The installer mentioned above uses these lists by default:		There are a number of freely available blacklists on the net. The installer mentioned above uses these lists by default:
	*https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts		*https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
	*https://sysctl.org/cameleon/hosts		*https://sysctl.org/cameleon/hosts
Line 15:		Line 15:
	Alternatively, there is a set of curated lists at https://github.com/StevenBlack/hosts. There are various categories of lists there. The format of the file is a "host" (so you can put it in {{path\|/etc/hosts}} and be done).		Alternatively, there is a set of curated lists at https://github.com/StevenBlack/hosts. There are various categories of lists there. The format of the file is a "host" (so you can put it in {{path\|/etc/hosts}} and be done).

	In this guide, we will use the hosts file format. Unbound needs to include the <code>blacklists.conf</code> file into its main configuration. To do so, we need to create the include file in the following format:		== Configuration ==

			There are few steps to setup Unbound to Block/Refuse unwanted addresses. In this guide, we will use the hosts file format from https://github.com/StevenBlack/hosts. Unbound needs to include the <code>blacklists.conf</code> file into its main configuration. To do so, we need to create the include file in the following format:

	{{Cat\|/etc/unbound/blacklists.conf\|server:		{{Cat\|/etc/unbound/blacklists.conf\|server:

Prabuanand: added wikilink

2025-11-03T07:56:36Z

added wikilink

← Older revision		Revision as of 07:56, 3 November 2025
Line 55:		Line 55:

	== See also ==		== See also ==
	[[Setting_up_unbound_DNS_server\|unbound]]		* [[Setting_up_unbound_DNS_server\|unbound]]
			* [[Using Pi-hole with Unbound]]

	[[Category:Networking]]		[[Category:Networking]]

Prabuanand: changed headings and minor rewording with introduction

2025-11-03T05:52:25Z

changed headings and minor rewording with introduction

← Older revision		Revision as of 05:52, 3 November 2025
Line 1:		Line 1:
	~~== Basic Components ==~~		This page documents the steps to use Unbound as an Ad-blocker by using a publicly available blacklist in '''hosts''' file format.

	~~You should have {{Pkg\|dnsmasq}} (or another DHCP server) and [[Setting_up_unbound_DNS_server\|unbound]] both working on your network.~~		== Prerequisites ==

	~~== Setting up Unbound To Block/Refuse unwanted addresses ==~~		* You should have a {{Pkg\|dnsmasq}} (or another DHCP server) and [[Setting_up_unbound_DNS_server\|unbound]] both working on your network.

	There are a number of freely available blacklists on the net. The installer mentioned above uses these lists by default:		== Configuration ==

			There are few steps to setup Unbound to Block/Refuse unwanted addresses. There are a number of freely available blacklists on the net. The installer mentioned above uses these lists by default:
	*https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts		*https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
	*https://sysctl.org/cameleon/hosts		*https://sysctl.org/cameleon/hosts
Line 11:		Line 13:
	*https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt		*https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt

	Alternatively, there is a set of curated lists at https://github.com/StevenBlack/hosts. There are various categories of lists there. The format of the file is a "host" (so you can put it in {{path\|/etc/hosts}} and be done). ~~We will use the hosts file format:~~		Alternatively, there is a set of curated lists at https://github.com/StevenBlack/hosts. There are various categories of lists there. The format of the file is a "host" (so you can put it in {{path\|/etc/hosts}} and be done).

	~~unbound~~ needs to include the <code>blacklists.conf</code> file into its main configuration. To do so, we need to create the include file in the following format:		In this guide, we will use the hosts file format. Unbound needs to include the <code>blacklists.conf</code> file into its main configuration. To do so, we need to create the include file in the following format:

	{{Cat\|/etc/unbound/blacklists.conf\|server:		{{Cat\|/etc/unbound/blacklists.conf\|server:
Line 21:		Line 23:
	local-zone: "xyz.ads-r-us.com" refuse}}		local-zone: "xyz.ads-r-us.com" refuse}}

	Here is an example shell script to download the		Here is an example shell script to download the [https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts StevenBlack] hosts file, and then format it for unbound:
	[https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts StevenBlack]
	hosts file, and then format it for unbound:

	<pre>		<pre>
Line 35:		Line 35:
	>>/etc/unbound/blacklist.conf		>>/etc/unbound/blacklist.conf
	</pre>		</pre>


	You can run this once, or as part of a periodic cron task.		You can run this once, or as part of a periodic cron task.

	In the {{path\|/etc/unbound/unbound.conf}}, add the following line somewhere in the config:		In the {{path\|/etc/unbound/unbound.conf}}, add the following line somewhere in the config: {{Cat\|/etc/unbound/unbound.conf\|#include "/etc/unbound/blacklist.conf"}}

	{{Cat\|/etc/unbound/unbound.conf\|#include "/etc/unbound/blacklist.conf"}}

	Reload unbound, and verify the config loads.		Reload unbound, and verify the config loads.
Line 54:		Line 51:
	dhcp-option=6,[ip-of-unbound-server]		dhcp-option=6,[ip-of-unbound-server]
	</pre>		</pre>


	Enjoy Ad-Free browsing!		Enjoy Ad-Free browsing!

			== See also ==
			[[Setting_up_unbound_DNS_server\|unbound]]
	[[Category:Networking]]		[[Category:Networking]]

Nangel: /* Background */

2024-02-16T03:46:42Z

Background

← Older revision		Revision as of 03:46, 16 February 2024
Line 1:		Line 1:
	~~== Background ==~~

	There is a fairly popular software product that acts as a DNS blocker for Advertisements and Malware. It runs on the Raspberry <span style="color: red">Pi-</span> and claims to be a DNS Black <span style="color: red">Hole</span>. It extends dnsmasq with filtering based on a downloadable blacklist. There is a [https://gitlab.alpinelinux.org/alpine/aports/issues/9489 package request] for this software to run on Alpine Linux.

	The binary does compile on Alpine, however there is an extensive list of extraneous files, directories and packages that must be installed to get the modified version of {{Pkg\|dnsmasq}} to start. The "basic installer" is over 2600 lines of Bash code.

	~~Our goal is to get 80% of the functionality with 10% of the work.~~

	== Basic Components ==		== Basic Components ==

Zcrayfish: /* Setting up Unbound To Block/Refuse unwanted addresses */ Remove dead URLs.

2024-02-15T06:38:43Z

Setting up Unbound To Block/Refuse unwanted addresses: Remove dead URLs.

← Older revision		Revision as of 06:38, 15 February 2024
Line 15:		Line 15:
	There are a number of freely available blacklists on the net. The installer mentioned above uses these lists by default:		There are a number of freely available blacklists on the net. The installer mentioned above uses these lists by default:
	*https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts		*https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
	*https://mirror1.malwaredomains.com/files/justdomains
	*https://sysctl.org/cameleon/hosts		*https://sysctl.org/cameleon/hosts
	*https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt		*https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt
	*https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt		*https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt
	*https://hosts-file.net/ad_servers.txt

	Alternatively, there is a set of curated lists at https://github.com/StevenBlack/hosts. There are various categories of lists there. The format of the file is a "host" (so you can put it in {{path\|/etc/hosts}} and be done). We will use the hosts file format:		Alternatively, there is a set of curated lists at https://github.com/StevenBlack/hosts. There are various categories of lists there. The format of the file is a "host" (so you can put it in {{path\|/etc/hosts}} and be done). We will use the hosts file format:

Zcrayfish: /* Dnsmasq configuration */ use path template.

2024-02-15T06:37:38Z

Dnsmasq configuration: use path template.

← Older revision		Revision as of 06:37, 15 February 2024
Line 57:		Line 57:
	== Dnsmasq configuration ==		== Dnsmasq configuration ==

	Dnsmasq defaults to using the resolver in ~~<code>~~/etc/resolv.conf~~</code>~~ — if unbound is listening on <code>127.0.0.1</code>, then have it use that as the resolver.		Dnsmasq defaults to using the resolver in {{path\|/etc/resolv.conf}} — if unbound is listening on <code>127.0.0.1</code>, then have it use that as the resolver.

	Alternatively, if unbound is running on another interface, or on a separate machine — use the dhcp-option configuration in dnsmasq:		Alternatively, if unbound is running on another interface, or on a separate machine — use the dhcp-option configuration in dnsmasq:

Zcrayfish: /* Setting up Unbound To Block/Refuse unwanted addresses */ More path template.

2024-02-15T06:36:56Z

Setting up Unbound To Block/Refuse unwanted addresses: More path template.

← Older revision		Revision as of 06:36, 15 February 2024
Line 49:		Line 49:
	You can run this once, or as part of a periodic cron task.		You can run this once, or as part of a periodic cron task.

	In the ~~<code>~~/etc/unbound/unbound.conf~~</code>~~, add the following line somewhere in the config:		In the {{path\|/etc/unbound/unbound.conf}}, add the following line somewhere in the config:

	{{Cat\|/etc/unbound/unbound.conf\|#include "/etc/unbound/blacklist.conf"}}		{{Cat\|/etc/unbound/unbound.conf\|#include "/etc/unbound/blacklist.conf"}}

Zcrayfish: /* Setting up Unbound To Block/Refuse unwanted addresses */ Convert list of URLs from preformatted to bulleted. Use path template.

2024-02-15T06:36:21Z

Setting up Unbound To Block/Refuse unwanted addresses: Convert list of URLs from preformatted to bulleted. Use path template.

← Older revision		Revision as of 06:36, 15 February 2024
Line 14:		Line 14:

	There are a number of freely available blacklists on the net. The installer mentioned above uses these lists by default:		There are a number of freely available blacklists on the net. The installer mentioned above uses these lists by default:
	~~<pre>~~		*https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
	https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts		*https://mirror1.malwaredomains.com/files/justdomains
	https://mirror1.malwaredomains.com/files/justdomains		*https://sysctl.org/cameleon/hosts
	~~http~~://sysctl.org/cameleon/hosts		*https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt
	https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt		*https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt
	https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt		*https://hosts-file.net/ad_servers.txt
	https://hosts-file.net/ad_servers.txt
	~~</pre>~~

	Alternatively, there is a set of curated lists at https://github.com/StevenBlack/hosts. There are various categories of lists there. The format of the file is a "host" (so you can put it in ~~<code>~~/etc/hosts~~</code>~~ and be done). We will use the hosts file format:		Alternatively, there is a set of curated lists at https://github.com/StevenBlack/hosts. There are various categories of lists there. The format of the file is a "host" (so you can put it in {{path\|/etc/hosts}} and be done). We will use the hosts file format:

	unbound needs to include the <code>blacklists.conf</code> file into its main configuration. To do so, we need to create the include file in the following format:		unbound needs to include the <code>blacklists.conf</code> file into its main configuration. To do so, we need to create the include file in the following format:
Line 56:		Line 54:

	Reload unbound, and verify the config loads.		Reload unbound, and verify the config loads.


	== Dnsmasq configuration ==		== Dnsmasq configuration ==

Arnaudv6 at 18:18, 13 February 2024

2024-02-13T18:18:42Z

← Older revision		Revision as of 18:18, 13 February 2024
Line 33:		Line 33:
	local-zone: "xyz.ads-r-us.com" refuse}}		local-zone: "xyz.ads-r-us.com" refuse}}

	Here is an example shell script to download the [https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts		Here is an example shell script to download the
	StevenBlack] hosts ~~format~~ file, and then format it for unbound:		[https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts StevenBlack]
			hosts file, and then format it for unbound:

	<pre>		<pre>

Bbbhltz: Formatting and added to Networking category

2023-04-18T13:31:42Z

Formatting and added to Networking category

← Older revision		Revision as of 13:31, 18 April 2023
Line 3:		Line 3:
	There is a fairly popular software product that acts as a DNS blocker for Advertisements and Malware. It runs on the Raspberry <span style="color: red">Pi-</span> and claims to be a DNS Black <span style="color: red">Hole</span>. It extends dnsmasq with filtering based on a downloadable blacklist. There is a [https://gitlab.alpinelinux.org/alpine/aports/issues/9489 package request] for this software to run on Alpine Linux.		There is a fairly popular software product that acts as a DNS blocker for Advertisements and Malware. It runs on the Raspberry <span style="color: red">Pi-</span> and claims to be a DNS Black <span style="color: red">Hole</span>. It extends dnsmasq with filtering based on a downloadable blacklist. There is a [https://gitlab.alpinelinux.org/alpine/aports/issues/9489 package request] for this software to run on Alpine Linux.

	The binary does compile on Alpine, however there is an extensive list of extraneous files, directories and packages that must be installed to get the modified version of dnsmasq to start. The "basic installer" is over 2600 lines of Bash code.		The binary does compile on Alpine, however there is an extensive list of extraneous files, directories and packages that must be installed to get the modified version of {{Pkg\|dnsmasq}} to start. The "basic installer" is over 2600 lines of Bash code.

	Our goal is to get 80% of the functionality with 10% of the work.		Our goal is to get 80% of the functionality with 10% of the work.


	== Basic Components ==		== Basic Components ==

	You should have dnsmasq (or another DHCP server) and [~~https://wiki.alpinelinux.org/wiki/~~Setting_up_unbound_DNS_server unbound] both working on your network.		You should have {{Pkg\|dnsmasq}} (or another DHCP server) and [[Setting_up_unbound_DNS_server\|unbound]] both working on your network.

	== Setting up Unbound To Block/Refuse unwanted addresses ==		== Setting up Unbound To Block/Refuse unwanted addresses ==
Line 24:		Line 23:
	</pre>		</pre>

	Alternatively, there is a set of curated lists at https://github.com/StevenBlack/hosts. There are various categories of lists there. The format of the file is a "host" (so you can put it in /etc/hosts and be done.) We will use the hosts file format:		Alternatively, there is a set of curated lists at https://github.com/StevenBlack/hosts. There are various categories of lists there. The format of the file is a "host" (so you can put it in <code>/etc/hosts</code> and be done). We will use the hosts file format:

	unbound needs to include the "blacklists.conf" file into its main configuration. To do so, we need to create the include file in the following format:		unbound needs to include the <code>blacklists.conf</code> file into its main configuration. To do so, we need to create the include file in the following format:

	~~<pre>~~		{{Cat\|/etc/unbound/blacklists.conf\|server:
	server:

	local-zone: "bad-site.com" refuse		local-zone: "bad-site.com" refuse
	local-zone: "bad-bad-site.com" refuse		local-zone: "bad-bad-site.com" refuse
	local-zone: "xyz.ads-r-us.com" refuse		local-zone: "xyz.ads-r-us.com" refuse}}
	~~</pre>~~

	~~Here is an example shell script to download the StevenBlack hosts format file, and then format it for unbound:~~

			Here is an example shell script to download the [https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
			StevenBlack] hosts format file, and then format it for unbound:

	<pre>		<pre>
Line 53:		Line 50:
	You can run this once, or as part of a periodic cron task.		You can run this once, or as part of a periodic cron task.

	In the /etc/unbound/unbound.conf, add the following line somewhere in the config:		In the <code>/etc/unbound/unbound.conf</code>, add the following line somewhere in the config:

	~~<pre>~~
	~~#include "/etc/unbound/blacklist.conf"~~
	~~</pre>~~

			{{Cat\|/etc/unbound/unbound.conf\|#include "/etc/unbound/blacklist.conf"}}

	Reload unbound, and verify the config loads.		Reload unbound, and verify the config loads.
Line 65:		Line 59:
	== Dnsmasq configuration ==		== Dnsmasq configuration ==

	Dnsmasq defaults to using the resolver in /etc/resolv.conf - if unbound is listening on 127.0.0.1, then have it use that as the resolver.		Dnsmasq defaults to using the resolver in <code>/etc/resolv.conf</code> — if unbound is listening on <code>127.0.0.1</code>, then have it use that as the resolver.

	Alternatively, if unbound is running on another interface, or on a separate machine - use the dhcp-option configuration in dnsmasq:		Alternatively, if unbound is running on another interface, or on a separate machine — use the dhcp-option configuration in dnsmasq:

	<pre>		<pre>
Line 75:		Line 69:

	Enjoy Ad-Free browsing!		Enjoy Ad-Free browsing!

			[[Category:Networking]]