Diversion Diversion ad blocking works with secure DNS disabled only

[texnote]

I have installed Diversion on my Asus RT-AC86U, firmware: 386.14_2. The only way I can get ad blocking to work is if I turn off secure DNS in browser (Chrome/Edge on Windows 11 or Chrome/Safari on MacOS). Is this the only way to enable Diversion on a laptop, or is there a way to have both browser-based secure DNS and Diversion ad blocking? Please see my router screenshots too in case I have configured something incorrectly. Thank you all so very much.

 

[ColinTaylor]

or is there a way to have both browser-based secure DNS and Diversion ad blocking?

No. The "secure" part of secure DNS means the browser talks directly to the target DNS server over a secure link. So by definition it will not talk to any other DNS server, be that Diversion, your ISP's, or anyone else.

 

[texnote]

So are all of the settings in my router (enable DNS over TLS, DNSDirector set to router, etc.) redundant and useless? When I SSH to the router and run a test I still see domains of ad servers properly resolved. Is that an issue?

admin@RT-AC86U-6D30:/tmp/home/root# nslookup ads.google.com 192.168.1.1
Server:    192.168.1.1
Address 1: 192.168.1.1 RT-AC86U-6D30.

Name:      ads.google.com
Address 1: 2607:f8b0:400a:801::200e pnseab-ab-in-x0e.1e100.net
Address 2: 142.250.73.78 pnseaa-am-in-f14.1e100.net

 

[Treadler]

What you’re doing with your browser will bypass the router.

 

[ColinTaylor]

So are all of the settings in my router (enable DNS over TLS, DNSDirector set to router, etc.) redundant and useless?

For a browser running secure DNS, yes.

When I SSH to the router and run a test I still see domains of ad servers properly resolved. Is that an issue?

admin@RT-AC86U-6D30:/tmp/home/root# nslookup ads.google.com 192.168.1.1
Server:    192.168.1.1
Address 1: 192.168.1.1 RT-AC86U-6D30.

Name:      ads.google.com
Address 1: 2607:f8b0:400a:801::200e pnseab-ab-in-x0e.1e100.net
Address 2: 142.250.73.78 pnseaa-am-in-f14.1e100.net

Try adwords.google.com instead.

 

[texnote]

Here it is

admin@RT-AC86U-6D30:/tmp/home/root# nslookup adwords.google.com 192.168.1.1
Server:    192.168.1.1
Address 1: 192.168.1.1 RT-AC86U-6D30.

Name:      adwords.google.com
Address 1: 2607:f8b0:400e:c0d::71 pz-in-f113.1e100.net
Address 2: 2607:f8b0:400e:c0d::65 pz-in-f101.1e100.net
Address 3: 2607:f8b0:400e:c0d::8a pz-in-f138.1e100.net
Address 4: 2607:f8b0:400e:c0d::66 pz-in-f102.1e100.net
Address 5: 192.178.163.101 tt-in-f101.1e100.net
Address 6: 192.178.163.138 tt-in-f138.1e100.net
Address 7: 192.178.163.139 tt-in-f139.1e100.net
Address 8: 192.178.163.102 tt-in-f102.1e100.net
Address 9: 192.178.163.100 tt-in-f100.1e100.net
Address 10: 192.178.163.113 tt-in-f113.1e100.net

 

[dave14305]

Here it is

If you’re using the oisd small standard list, test pagead.l.google.com instead. You need to test with a domain that is actually included in the blocking list.

 

[dave14305]

Also, why do you advertise Google DNS to your IPv6 LAN clients? That will also allow bypassing Diversion.

 

[texnote]

pagead.l.google.com does not resolve, so I guess that is a good sign. As for the Google IPv6 DNS I have no idea why it's there (I didn't put it). I will remove it. Should I also completely disable IPv6 in the router or disable only some settings? Please see my current IPv6 page.

 

[dave14305]

Should I also completely disable IPv6 in the router or disable only some settings? Please see my current IPv6 page.

Looks fine. No need to disable IPv6, in my opinion.