Diversion Diversion ad blocking works with secure DNS disabled only

[texnote]

I have installed Diversion on my Asus RT-AC86U, firmware: 386.14_2. The only way I can get ad blocking to work is if I turn off secure DNS in browser (Chrome/Edge on Windows 11 or Chrome/Safari on MacOS). Is this the only way to enable Diversion on a laptop, or is there a way to have both browser-based secure DNS and Diversion ad blocking? Please see my router screenshots too in case I have configured something incorrectly. Thank you all so very much.

 

[ColinTaylor]

or is there a way to have both browser-based secure DNS and Diversion ad blocking?

No. The "secure" part of secure DNS means the browser talks directly to the target DNS server over a secure link. So by definition it will not talk to any other DNS server, be that Diversion, your ISP's, or anyone else.

 

[texnote]

So are all of the settings in my router (enable DNS over TLS, DNSDirector set to router, etc.) redundant and useless? When I SSH to the router and run a test I still see domains of ad servers properly resolved. Is that an issue?

admin@RT-AC86U-6D30:/tmp/home/root# nslookup ads.google.com 192.168.1.1
Server:    192.168.1.1
Address 1: 192.168.1.1 RT-AC86U-6D30.

Name:      ads.google.com
Address 1: 2607:f8b0:400a:801::200e pnseab-ab-in-x0e.1e100.net
Address 2: 142.250.73.78 pnseaa-am-in-f14.1e100.net

 

[Treadler]

What you’re doing with your browser will bypass the router.

 

[ColinTaylor]

So are all of the settings in my router (enable DNS over TLS, DNSDirector set to router, etc.) redundant and useless?

For a browser running secure DNS, yes.

When I SSH to the router and run a test I still see domains of ad servers properly resolved. Is that an issue?

admin@RT-AC86U-6D30:/tmp/home/root# nslookup ads.google.com 192.168.1.1
Server:    192.168.1.1
Address 1: 192.168.1.1 RT-AC86U-6D30.

Name:      ads.google.com
Address 1: 2607:f8b0:400a:801::200e pnseab-ab-in-x0e.1e100.net
Address 2: 142.250.73.78 pnseaa-am-in-f14.1e100.net

Try adwords.google.com instead.

 

[texnote]

Here it is

admin@RT-AC86U-6D30:/tmp/home/root# nslookup adwords.google.com 192.168.1.1
Server:    192.168.1.1
Address 1: 192.168.1.1 RT-AC86U-6D30.

Name:      adwords.google.com
Address 1: 2607:f8b0:400e:c0d::71 pz-in-f113.1e100.net
Address 2: 2607:f8b0:400e:c0d::65 pz-in-f101.1e100.net
Address 3: 2607:f8b0:400e:c0d::8a pz-in-f138.1e100.net
Address 4: 2607:f8b0:400e:c0d::66 pz-in-f102.1e100.net
Address 5: 192.178.163.101 tt-in-f101.1e100.net
Address 6: 192.178.163.138 tt-in-f138.1e100.net
Address 7: 192.178.163.139 tt-in-f139.1e100.net
Address 8: 192.178.163.102 tt-in-f102.1e100.net
Address 9: 192.178.163.100 tt-in-f100.1e100.net
Address 10: 192.178.163.113 tt-in-f113.1e100.net

 

[dave14305]

Here it is

If you’re using the oisd small standard list, test pagead.l.google.com instead. You need to test with a domain that is actually included in the blocking list.

 

[dave14305]

Also, why do you advertise Google DNS to your IPv6 LAN clients? That will also allow bypassing Diversion.

 

[texnote]

pagead.l.google.com does not resolve, so I guess that is a good sign. As for the Google IPv6 DNS I have no idea why it's there (I didn't put it). I will remove it. Should I also completely disable IPv6 in the router or disable only some settings? Please see my current IPv6 page.

 

[dave14305]

Should I also completely disable IPv6 in the router or disable only some settings? Please see my current IPv6 page.

Looks fine. No need to disable IPv6, in my opinion.

 

[Treadler]

pagead.l.google.com does not resolve, so I guess that is a good sign. As for the Google IPv6 DNS I have no idea why it's there (I didn't put it). I will remove it. Should I also completely disable IPv6 in the router or disable only some settings? Please see my current IPv6 page.

Yes, remove that Google reference.
Leaving IPv6 enabled though, will be fine.

 

[texnote]

Thank you all. Is there anything else wrong with my various settings?

 

[dave14305]

Thank you all. Is there anything else wrong with my various settings?

You don’t have any IPv6 servers listed in the DNS over TLS Server List, despite having ipv6 enabled.

Also, if you’re going to use Cloudflare anyway, you can switch to the 1.1.1.2 malware blocking service for added protection.

1.1.1.2
1.0.0.2
2606:4700:4700::1112
2606:4700:4700::1002
TLS hostname: security.cloudflare-dns.com

Network operators

Network operators, including Internet Service Providers (ISPs), device manufacturers, public Wi-Fi networks, municipal broadband providers, and security scanning services can use 1.1.1.1 in place of operating their own recursive DNS infrastructure.

developers.cloudflare.com

 

[texnote]

Did I do it right?

 

[dave14305]

Did I do it right?

Seems so. Verify at https://one.one.one.one/help/

 

[texnote]

Verifying at link above says I am connected to 1.1.1.1 (should it say 1.1.1.2?) However, testing https://malware.testcategory.com/ shows the test malware site is blocked.