Simple-adblock stopped working when network split

Installing and Using OpenWrt
1

I have had simple-adblock successfully blocking all the ads on my Roku screen for a few years. Recently for security reasons, I decided to move them to a sequestered network segment. Now I can't get simple-adblock to work.

Old topology (standard):

  • "lan" interface (static address protocol) = 10.11.30.0/24, br-lan device
  • lan firewall zone (accept/accept/accept)
  • 2.4 and 5GHz WiFi SSID's both attached to "lan" network

New topology:

  • "xeno" interface (static address protocol) = 172.16.1.1/24, phy0-ap1 device
  • "jail" firewall zone (reject/accept/reject)
  • New 2.4GHz SSID "SEQUESTER" added attached to "xeno" network
  • ports 53 and 68 manually accepted in input firewall rules for "jail" zone

Simple Adblock is set to "Force Router DNS server to all local devices" - I suspect the problem is the way it defines a "local device". That said, I can detect nothing in the "lan" interface that is any different from the "xeno" interface in the way it's set up. Does Simple Adblock assume "local" = "lan"-zone by name?

2

The adblock-fast, a spiritual successor to simple-adblock can target more interfaces than just lan for DNS Hijack. Reference: https://docs.mossdef.org/adblock-fast/#force_dns_interface

3

So my conjecture was correct. Simple Adblock just assumes the "lan" firewall zone when it sets up "Force Router DNS server to all local devices" - it just defines "local" as "lan" firewall zone.

I got it to work, but I had to customize /etc/init.d/simple-adblock. Basically just edit it, search for "lan" and duplicate the json commands for the added zone. I renamed my sequestered interface and associated firewall zone both "styx". So:

json_add_object ""
json_add_string type redirect
json_add_string target DNAT
json_add_string src lan
json_add_string proto "tcp udp"
json_add_string src_dport "$c"
json_add_string dest_port "$c"
json_add_string family any
json_add_boolean reflection 0
json_close_object

becomes:

# For lan zone
json_add_object ""
json_add_string type redirect
json_add_string target DNAT
json_add_string src lan
json_add_string proto "tcp udp"
json_add_string src_dport "$c"
json_add_string dest_port "$c"
json_add_string family any
json_add_boolean reflection 0
json_close_object
# VA1DER - Do same for our 'styx' zone
json_add_object ""
json_add_string type redirect
json_add_string target DNAT
json_add_string src styx # or whatever your sequestered zone is
json_add_string proto "tcp udp"
json_add_string src_dport "$c"
json_add_string dest_port "$c"
json_add_string family any
json_add_boolean reflection 0
json_close_object

Basically for every "json_add_object" to "json_close_object" group that contains the word 'lan', duplicate the whole group with the name of your sequestered zone.

Thanks so much! I hadn't realized that simple-adblock was out of date - my whole install is woefully out of date, I haven't had the time or energy to focus on OpenWRT for a while. I really need to make a new build. When I do, I'll look at adblock-fast.

Thanks!

4

Yep, if you're stuck on an older build, that's the way to go, I should have mentioned that.