Nice catch, fixed with this update:
3 Likes
Hi, I am struggling to get adblock working on my ASUS RT-AX59U running OpenWrt 25.12.5.
System Details:
- Router: ASUS RT-AX59U
- Firmware: OpenWrt 25.12.5 (r33051-f5dae5ece4)
- Adblock version: 4.5.7-r2
- Issue: dnsmasq backend repeatedly fails to restart with the error: dns backend restart with adblock blocklist failed.
Context:
I suspect the issue is related to ujail isolating the dnsmasq process. The ps output shows dnsmasq running inside ujail with restricted access (-w /tmp). When adblock attempts to write configuration files to /tmp/dnsmasq.d/, the jailed process cannot see them, causing the backend to fail.
Troubleshooting Steps Taken:
- Clean reinstall of adblock via apk.
- Tested both dnsmasq and nftsets backends.
- Manually created/permissioned /tmp/dnsmasq.d and /tmp/adblock-backup.
- Attempted to change adb_base to /etc/dnsmasq.d to bypass jail restrictions.
All attempts result in the same "dns backend restart failed" error in logread.
Logs indicate the process successfully downloads lists but cannot trigger the dnsmasq reload.
Is there a known workaround for adblock on hardware where dnsmasq is jailed, or is local adblocking fundamentally incompatible with this firmware's security policy?
Any guidance on getting this working—or confirmation that I should switch to an external DNS provider—would be greatly appreciated.
root@RT-AX59U:~# cat /etc/config/adblock /etc/config/dhcp
config global 'global'
option adb_enabled '1'
option adb_dns 'dnsmasq'
option adb_fetchcmd 'curl'
list adb_trigger 'wan'
option adb_safesearch '0'
option adb_report '0'
option adb_mail '0'
option adb_debug '0'
option adb_nicelimit '0'
option adb_fetchretry '5'
option adb_nftallow '0'
option adb_nftblock '0'
option adb_nftremote '0'
option adb_nftbridge '0'
option adb_nftforce '0'
option adb_repiface 'br-lan'
option adb_base '/tmp/dnsmasq.d'
option adb_dnsinstance '0'
option adb_dnsshift '1'
option adb_dnsflush '1'
list adb_feed 'yoyo'
config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
option filter_aaaa '0'
option filter_a '0'
option confdir '/tmp/dnsmasq.d'
list addnmount '/tmp/adblock-backup'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/odhcpd.leases'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
option piodir '/tmp/odhcpd-piodir'
option hostsdir '/tmp/hosts'
root@RT-AX59U:~# /etc/init.d/adblock status && logread | grep adblock | tail -n 20
::: adblock runtime information
+ adblock_status : error
+ frontend_ver : 4.5.7-r2
+ backend_ver : 4.5.7-r2
+ blocked_domains : 0
+ active_feeds : -
+ dns_backend : dnsmasq (2.93-r1), /tmp/adblock-backup, 2.26 MB
+ run_ifaces : trigger: wan, report: br-lan
+ run_information : base: /tmp, dns: /tmp/dnsmasq.d, backup: /tmp/adblock-backup, report: /tmp/adblock-report, error: /dev/null
+ run_flags : shift: ✔, custom feed: ✘, ext. DNS (std/prot/remote/bridge): ✘/✘/✘/✘, force: ✘, flush: ✔, tld: ✔, search: ✘, report: ✘, mail: ✘, jail: ✘, debug: ✘
+ last_run : -
+ system_info : cores: 4, fetch: curl, ASUS RT-AX59U, mediatek/filogic, OpenWrt 25.12.5 (r33051-f5dae5ece4)
Mon Aug 10 21:29:01 2026 user.info adblock-4.5.7-r2[24107]: adblock instance started ::: action: reload, priority: 0, pid: 24107
Mon Aug 10 21:29:49 2026 user.err adblock-4.5.7-r2[24107]: dns backend restart with adblock blocklist failed
Mon Aug 10 21:31:43 2026 user.info adblock-4.5.7-r2[25313]: adblock-related nft rules removed
Mon Aug 10 21:37:38 2026 user.info adblock-4.5.7-r2[26742]: adblock instance started ::: action: restart, priority: 0, pid: 26742
Mon Aug 10 21:38:26 2026 user.err adblock-4.5.7-r2[26742]: dns backend restart with adblock blocklist failed
Mon Aug 10 21:39:30 2026 user.err adblock-4.5.7-r2[28238]: dns backend not found, please set 'adb_dns' manually
Mon Aug 10 21:40:26 2026 user.info adblock-4.5.7-r2[28597]: adblock instance started ::: action: reload, priority: 0, pid: 28597
Mon Aug 10 21:41:07 2026 user.err adblock-4.5.7-r2[28597]: dns backend restart with adblock blocklist failed
Mon Aug 10 21:47:16 2026 user.info adblock-4.5.7-r2[30310]: adblock instance started ::: action: restart, priority: 0, pid: 30310
Mon Aug 10 21:47:52 2026 user.err adblock-4.5.7-r2[30310]: dns backend restart with adblock blocklist failed
You've borked your config, remove the following config entries:
from adblock confg ...
from dhcp config ...
Restart your router afterwards.
Thanks, i was working on it still and posted it midway
Here`s what i found though, there might be an incompatibility with tailscale package
I ran into an issue where the adblock package fails to start or restart on OpenWrt when Tailscale is running.
The logs consistently show:
dns backend restart with adblock blocklist failed
And the debug logs show f_dnsup timing out/failing with rc: 4.
The Root Cause:
When Tailscale is active, it takes over /etc/resolv.conf (for MagicDNS).
During its startup sequence, adblock.sh performs a health check to verify if the local DNS backend (e.g., dnsmasq) is up by using nslookup. Because it relies on the system's default resolver, the query is sent to Tailscale instead of the local dnsmasq. The check fails, and adblock aborts the startup.
I attempted to fix this natively via UCI by tweaking adb_lookupdomain, but it's currently impossible. In /usr/bin/adblock.sh, the lookup command hardcodes a trailing dot:
"${adb_lookupcmd}" "${adb_lookupdomain}."
Because of that trailing dot, you cannot pass a specific DNS server IP (like localhost 127.0.0.1) through the config without breaking the nslookup syntax.
The Fix / Workaround:
To resolve this, the startup check needs to explicitly query 127.0.0.1 to bypass the hijacked resolv.conf.
I patched /usr/bin/adblock.sh with the following command:
sed -i 's/"${adb_lookupcmd}" "${adb_lookupdomain}."/"${adb_lookupcmd}" "${adb_lookupdomain}" 127.0.0.1/g' /usr/bin/adblock.sh
After applying this patch, adblock starts perfectly and the f_dnsup check succeeds (rc: 0), even while Tailscale is fully active.
Hopefully, this helps anyone else running into the same issue. It would be great if a future update to adblock could either explicitly query local loopback for this check or allow defining a specific DNS server IP in the UCI config.
The trailing dot is not what prevents you from passing a server. The argument is quoted, so "${adb_lookupdomain}" is always a single word — with or without the dot. The dot is there on purpose, to suppress the search list. Your sed drops it, so with a search domain configured busybox nslookup may now query localhost.<searchdomain> first. That's a new failure mode you didn't have before.
Also, adb_lookupdomain is a domain field, not a resolver spec. It's reused in f_list and gets written to the allowlist via f_chkdom, so stuffing an IP in there would produce garbage elsewhere. Overloading that option was never going to work.
Hardcoding 127.0.0.1 also assumes the backend listens on loopback and that you're not IPv6-only. Fine as a local workaround, not as a default.
BTW, Tailscale taking over /etc/resolv.conf on a router that runs its own DNS affects everything on the box that resolves names, not just this check. --accept-dns=false is the usual setting there, and I'd fix it at that end regardless.
2 Likes
Hi,
Hagezi github has been down for 2 days now (his account got banned by a bot (again)).
https://github.com/hagezi/dns-blocklists
https://www.reddit.com/r/pihole/comments/1vkcklm/github_repo_hagezidnsblocklists_gone/
As a solution he has setup a new official mirror, that pulls directly from his build system
https://www.reddit.com/r/pihole/comments/1vkcklm/comment/p2zgh28/
Could the Hagezi lists be updated to point to the new mirror?
Thank you in advance and keep up the great work!
1 Like
Use the Custom Feed Editor and change the hagezi URL:
OLD: https://raw.githubusercontent.com/hagezi/dns-blocklists/main/
NEW: https://hagezi-mirror.dnsbunker.org/
Should work (untested) ...
3 Likes
Thank you so much for the quick support, overview and knowledge share
I have removed the magic dns from the tailscale device and adblock is now working correctly without patching it seems
1 Like
Short update notice: hagezi's primary github mirror is back again.
5 Likes
Why it is always get failed on my router.
BusyBox v1.37.0 (2026-08-07 17:26:12 UTC) built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt 25.12.5, r33051-f5dae5ece4 Dave's Guitar
-----------------------------------------------------
OpenWrt recently switched to the "apk" package manager!
OPKG Command APK Equivalent Description
------------------------------------------------------------------
opkg install <pkg> apk add <pkg> Install a package
opkg remove <pkg> apk del <pkg> Remove a package
opkg upgrade apk upgrade Upgrade all packages
opkg files <pkg> apk info -L <pkg> List package contents
opkg list-installed apk info List installed packages
opkg update apk update Update package lists
opkg search <pkg> apk search <pkg> Search for packages
------------------------------------------------------------------
For more information visit:
https://openwrt.org/docs/guide-user/additional-software/opkg-to-apk-cheatsheet
root@Flat82:~# uclient-fetch https://raw.githubusercontent.com/lynxthecat/adbloc
k-lean/master/abl-install.sh -O /tmp/abl-install.sh
Downloading 'https://raw.githubusercontent.com/lynxthecat/adblock-lean/master/abl-install.sh'
Connecting to 185.199.111.133:443
Writing to '/tmp/abl-install.sh'
/tmp/abl-install.sh 100% |*******************************| 27293 0:00:00 ETA
Download completed (27293 bytes)
root@Flat82:~# sh /tmp/abl-install.sh -v release
Downloading adblock-lean, version '0.8.1' (update channel: 'release').
Installing new files...
Copying file '/etc/init.d/adblock-lean'.
Copying file '/usr/lib/adblock-lean/abl-lib.sh'.
Copying file '/usr/lib/adblock-lean/abl-process.sh'.
adblock-lean (version '0.8.1') has been installed.
Set up adblock-lean now? (y|n)
y|n: y
/etc/init.d/adblock-lean is already executable.
Based on the total usable memory of this device (488.07 MiB), the recommended preset is 'large':
Elements count: ~1,200,000
raw_block_lists="hagezi:pro hagezi:tif"
max_file_part_size_KB="24000"
max_blocklist_file_size_KB="29000"
min_good_line_count="340000"
[C]onfirm this preset or [p]ick another preset?
c|p: c
Selected preset 'large'.
Checking dnsmasq instances.
Detected only 1 dnsmasq instance - skipping manual instance selection.
Selected dnsmasq indexes: '0'.
Selected dnsmasq conf-dirs: /tmp/dnsmasq.cfg01411c.d
Detected missing addnmount entries in /etc/config/dhcp for paths: /bin/busybox /var/run/adblock-lean/abl-blocklist.gz
Create missing addnmount entries automatically? (y|n)
y|n: y
Creating dnsmasq addnmount entries for dnsmasq instance 0.
Cron job configuration:
A cron job can be created to enable automatic list updates.
The default schedule is '0 5 * * *': daily at 5am (5 o'clock at night)
The cron job will run with an added random number of minutes.
Create cron job with default schedule for automatic list updates? (y|n)
'n' will set the 'cron_schedule' setting to 'disable'. You can later create a cron job with a custom schedule as described in:
https://github.com/lynxthecat/adblock-lean/blob/master/README.md
y|n: y
Generating new default config for adblock-lean from preset 'large'.
Saving new config file to '/etc/adblock-lean/config'.
Enabling the adblock-lean service.
Updating cron job for adblock-lean.
Creating cron job with schedule '0 5 * * *'.
Found existing dnsmasq addnmount entries.
GNU awk is already installed.
GNU sed is already installed.
GNU sort is already installed.
Setup is complete.
Start adblock-lean now? (y|n)
y|n: y
Starting adblock-lean, version 0.8.1.
gawk detected so using gawk for fast (sub)domain match removal and entries packing.
GNU sed detected so list processing will be fast.
coreutils-sort detected so sort will be fast.
Checking dnsmasq instances.
No existing blocklist found.
Testing connectivity.
Downloading and processing blocklist parts (max parallel jobs: 2).
Not using any allowlist for blocklist processing.
No local blocklist identified.
Processing raw blocklist: hagezi:pro (mirror: github)
Processing raw blocklist: hagezi:tif (mirror: github)
Error: Line count in downloaded blocklist part 'hagezi:tif' is 0, which is less than configured minimum: 1.
Error: Failed download attempt for list 'hagezi:tif'.
uclient-fetch output:
'Downloading 'https://raw.githubusercontent.com/hagezi/dns-blocklists/main/wildcard/tif-onlydomains.txt'
Connecting to 185.199.108.133:443
Connection error: Connection timed out'.
Processing job for list 'hagezi:tif' is sleeping for 5 seconds after failed download attempt.
Successfully processed list: hagezi:pro [ 3.87 MiB - 214,122 lines ]
Processing raw blocklist: hagezi:tif (mirror: gitlab)
Error: Size of blocklist part 'hagezi:tif' reached the maximum value set in config (24000 KB).
Consider either increasing this value in the config or removing the corresponding blocklist part path or URL from config.
Error: Processing job (PID 24690) for list 'hagezi:tif' returned error code '2'.
Skipping file and continuing.
Successfully generated preprocessed blocklist file with 214,122 entries.
Sorting and merging the blocklist parts into a single blocklist file.
Stopping dnsmasq.
Checking the resulting blocklist with 'dnsmasq --test'.
Error: Entries count (214,122) is below the minimum value set in config (340,000).
Error: Failed to generate new blocklist.
Restoring saved blocklist file.
Error: No previous blocklist file found.
Stopping adblock-lean.
Removing any adblock-lean blocklist files.
Restarting dnsmasq.
Waiting for dnsmasq initialization.
Restart of dnsmasq completed.
Stopped adblock-lean.
Checking for adblock-lean updates.
The locally installed adblock-lean is the latest version.
Cleaning up...
root@Flat82:~#
That's an impressive flood of output – thank goodness none of it comes from adblock. That's adblock-lean, a different package by a different maintainer, so its own support thread is the place to ask.
And if you ever want something that just says "blocklist loaded, 1.2 million domains, done" instead of narrating its inner life: apk add luci-app-adblock. It's in the repo, no install script required – and then you'd be in the right thread, too. 
4 Likes
That is a different package and is maintained by a different group.. try their support thread
1 Like
Extremely sorry
I came here after uninstalling adblock lean to install adblock and somehow i post the logs here 
Anyway to delete that post?
1 Like
No, please keep it ... it's easier (at least for me) to follow your post. Thanks!
1 Like
A newbie question, should 'dns report' only be enabled for troubleshooting purposes? Or can I set & forget this option and then periodically use the dns report tab for broader (time based/history) statistics?
You can just set and forget.
Just a quick note, the DNS Report is not a real-time statistics report. What this means is you need to click the "Refresh.." button at the bottom of the DNS Report to get the latest statistical info. Depending how heavy the DNS query traffic on your device, the data it holds can be be 1 day or just few hours. It doesn't store historical data like last week, last month etc.
1 Like