Diversion Diversion - the Router Ad-Blocker

[thelonelycoder]

Yes, exactly.

Already built in!
In Diversion, enter ds, enable it and set "6. log-queries=extra" to on. Now you can use the exact IP to filter.

 

[Asad Ali]

Already built in!
In Diversion, enter ds, enable it and set "6. log-queries=extra" to on. Now you can use the exact IP to filter.

Oh Nice, yep this is exactly what I wanted but since it's already implemented can you also add this ability in "filter by blocked domains" as well lol [emoji2960][emoji15][emoji15]

Same concept, show all the blocked domains but originating only from the IP address we mention.

 

[thelonelycoder]

Oh Nice, yep this is exactly what I wanted but since it's already implemented can you also add this ability in "filter by blocked domains" as well lol [emoji2960][emoji15][emoji15]

Same concept, show all the blocked domains but originating only from the IP address we mention.

You're pushing it. But that would be similar to the AB-Solution function to filter by device. It was coded much more elaborate and I did not want to port it to Diversion.
This would be a better replacement. We'll see

 

[Asad Ali]

You're pushing it. But that would be similar to the AB-Solution function to filter by device. It was coded much more elaborate and I did not want to port it to Diversion.
This would be a better replacement. We'll see

Lol I'm not in a hurry, feel free to take your time and decide.

I'm just asking because that way it'll be a lot easier to identify a rouge domain to whitelist without getting any noise from other devices on your network.

 

[thelonelycoder]

I booted into GParted to format the device to EXT2 and everything but your script detects it as EXT2. Also, your script definitely has a memory leak somewhere or some logging ( stored in memory? ) that just keeps getting larger and larger. My freezing issue is gone but my ram usage has increased nearly 15% over the past week and getting larger and larger. Do you have a list of all settings related to logging?

I doubt there's a memory leak. Diversion uses Dnsmasq and I'm sure it has no memory leak.
As for the settings, you can disable logging and there are Dnsmasq settings in ds to optimize for your needs.
The RAM increase is normal and one should not worry about it. It has been discussed at nauseum here in several threads.

 

[dave14305]

TL;DR: Has anyone else enabled local-ttl in dnsmasq.conf.add?

I was troubleshooting an annoying issue with Firefox when logged into my router webgui using router.asus.com. The dnsmasq.log file would have multiple queries in per second to resolve router.asus.com (from etc hosts). I eventually figured out that Firefox was not caching this hostname in its dns cache, and neither was Windows (although Edge and Chrome do better). That led me to figure out that dnsmasq by default assigns a dns time-to-live (TTL) to zero for anything resolved from the hosts file or DHCP leases. This seems to also apply to the Diversion blocking files.

To resolve the overlogging of router.asus.com, I set the local-ttl=3600 (1 hour) since they should rarely change on an hourly basis.

But I guess this has some repercussions for Diversion. Whitelisting will not take effect immediately if a client has cached the block IP. I’m also guessing the Diversion stats will be skewed to the low side since clients will only query once per hour for a given blocked site.

There was only one other thread I found about local-ttl, so I’m guessing it’s not a popular option. But I am a believer in not sending unnecessary work to the router.

Anyone else ever experiment with this setting?

 

[Digital Noise]

So I just 'upgrade' to Diversion, and I'm having a really odd issue after my router reboots - essentially, Diversion 'disappears'. There are no errors in the installation log; but when I attempt to run the ui after the router reboots, this is the result:

ASUSWRT-Merlin RT-AC66U 380.68-0 Fri Aug 18 21:39:50 UTC 2017
┌─[sys][RT-AC66R-B608][/tmp/home/root]
└─▪ diversion
/tmp/opt/bin/diversion: exec: line 77: /opt/bin/diversion: not found
┌─[sys][RT-AC66R-B608][/tmp/home/root]
└─▪

And indeed, amtm indicates that Diversion isn't installed - but all the files are present; and if I chose to install from the amtm menu, Diversion will install and start up - but again, it's missing after a reboot.

I also tried installing Diversion straight from the website, but the behavior is exactly the same.

Any help? As of now, my network no longer has any ad blocking.

 

[thelonelycoder]

So I just 'upgrade' to Diversion, and I'm having a really odd issue after my router reboots - essentially, Diversion 'disappears'. There are no errors in the installation log; but when I attempt to run the ui after the router reboots, this is the result:

ASUSWRT-Merlin RT-AC66U 380.68-0 Fri Aug 18 21:39:50 UTC 2017
┌─[sys][RT-AC66R-B608][/tmp/home/root]
└─▪ diversion
/tmp/opt/bin/diversion: exec: line 77: /opt/bin/diversion: not found
┌─[sys][RT-AC66R-B608][/tmp/home/root]
└─▪

And indeed, amtm indicates that Diversion isn't installed - but all the files are present; and if I chose to install from the amtm menu, Diversion will install and start up - but again, it's missing after a reboot.

I also tried installing Diversion straight from the website, but the behavior is exactly the same.

Any help? As of now, my network no longer has any ad blocking.

Post the content of /jffs/scripts/post-mount.

cat /jffs/scripts/post-mount

 

[thelonelycoder]

TL;DR: Has anyone else enabled local-ttl in dnsmasq.conf.add?

I was troubleshooting an annoying issue with Firefox when logged into my router webgui using router.asus.com. The dnsmasq.log file would have multiple queries in per second to resolve router.asus.com (from etc hosts). I eventually figured out that Firefox was not caching this hostname in its dns cache, and neither was Windows (although Edge and Chrome do better). That led me to figure out that dnsmasq by default assigns a dns time-to-live (TTL) to zero for anything resolved from the hosts file or DHCP leases. This seems to also apply to the Diversion blocking files.

To resolve the overlogging of router.asus.com, I set the local-ttl=3600 (1 hour) since they should rarely change on an hourly basis.

But I guess this has some repercussions for Diversion. Whitelisting will not take effect immediately if a client has cached the block IP. I’m also guessing the Diversion stats will be skewed to the low side since clients will only query once per hour for a given blocked site.

There was only one other thread I found about local-ttl, so I’m guessing it’s not a popular option. But I am a believer in not sending unnecessary work to the router.

Anyone else ever experiment with this setting?

Don't give me headaches
You best keep that to yourself or some Diversion user tries to "improve" their router by setting this and conveniently forgetting about it.
Later on, helpful members of this board and I will have a hard time to figure out what's wrong with DNS for that user.

 

[Digital Noise]

Post the content of /jffs/scripts/post-mount.

cat /jffs/scripts/post-mount

I will as soon as I get home tonight; I don't have remote access enabled.

 

[Digital Noise]

Post the content of /jffs/scripts/post-mount.

cat /jffs/scripts/post-mount

Here you go

ASUSWRT-Merlin RT-AC66U 380.68-0 Fri Aug 18 21:39:50 UTC 2017
┌─[sys][RT-AC66R-B608][/tmp/home/root]
└─▪ cat /jffs/scripts/post-mount
#!/bin/sh
. /jffs/scripts/post-mount.div # Added by Diversion
swapon /tmp/mnt/sda1/myswap.swp # Swap file created by Diversion

 

[Skeptical.me]

I can't find it in this topic, so I wanted to share this TrendMicro Telemetry list:
http://www.weatherimagery.com/blog/asus_trendmicro_data_collection/

Thanks again for this, I have entered them into the black list. My router may be a bit more private now. Are you having success blocking these addresses with Diversion?

 

[Skeptical.me]

Is anyone aware of a Hosts List for iOS apps, like a general ad/tracker list with commonly used servers by app developers? I'm still getting some in-app adverts. For example WeatherUnderground.

Edit: Nevermind, for some reason Skynet, Diversio, amtm didn't start or the USB drive was plugged in correctly. Everything is being blocked now.

 

[Mutzli]

Thanks again for this, I have entered them into the black list. My router may be a bit more private now. Are you having success blocking these addresses with Diversion?

Isn't that list already in the filter since it's part of the ASUS Firmware AiProtection from Trend Micro itself?

 

[Skeptical.me]

Isn't that list already in the filter since it's part of the ASUS Firmware AiProtection from Trend Micro itself?

I'm not sure. The OP seemed to think the addresses aren't, he made a blog and post and I think he indicated that there was data being sent out from his router to these addresses.

Or do you mean these addresses are whitelisted?

 

[Eric22]

Some basic questions:
1. How can I backup the white/black lists? and log files?
2. Is it possible to see for a specific website, what URLs/IPs are called in the background? This is because I can see that in some website there are lots of advertising/marketing activities are going on in the background.

 

[thelonelycoder]

Here you go

ASUSWRT-Merlin RT-AC66U 380.68-0 Fri Aug 18 21:39:50 UTC 2017
┌─[sys][RT-AC66R-B608][/tmp/home/root]
└─▪ cat /jffs/scripts/post-mount
#!/bin/sh
. /jffs/scripts/post-mount.div # Added by Diversion
swapon /tmp/mnt/sda1/myswap.swp # Swap file created by Diversion

That looks good. Do you see any errors for the USB device in the Syslog when the router reboots?

 

[thelonelycoder]

Some basic questions:
1. How can I backup the white/black lists? and log files?
2. Is it possible to see for a specific website, what URLs/IPs are called in the background? This is because I can see that in some website there are lots of advertising/marketing activities are going on in the background.

1. Use the backup function in c.
2. No, the router does not know what program is sending the requests, it only sees the IP of the device. This is best done in the browser itself. Chrome and Firefox (in the Web Developer menu) have tools built in to monitor this.

 

[Eric22]

1. Use the backup function in c.
2. No, the router does not know what program is sending the requests, it only sees the IP of the device. This is best done in the browser itself. Chrome and Firefox (in the Web Developer menu) have tools built in to monitor this.

Thanks. I will check Chrome developer options.

 

[Mutzli]

I'm not sure. The OP seemed to think the addresses aren't, he made a blog and post and I think he indicated that there was data being sent out from his router to these addresses.

Or do you mean these addresses are whitelisted?

I know that Skynet does add all attempts blocked by Trend Micro into the block list.