Xfinity > SB8200 > RT-BE86U (AsusWRT-Merlin) > Protectli FW2B "Tenderloin" (Arch Linux) dnsmasq, Tailscale exit node, Self-hosted Technitium DNS, recursive resolution, DoT/TLS 1.3, Hagezi blocklists. No upstream resolver. No third party in the chain. The robots behave. The ads do not resolve.