Safe Browsing - What software should I use?

[SashaSolitaire]

We currently have a home network with Ai-Mesh (details in my signature). Our household has two teenagers and two WFH parents. My goal is to have our kids and ourselves to have a safe, privacy oriented browsing experience. When I say safe and privacy oriented, I am looking at blocking any adult sites/content (to the extent possible), eliminate ads (to the extent possible) and mask the IP address(es). For a newbie like me, the options that are available in Merlin through amtm all seem very similar. I have been experimenting with some of the options, like Diversion and AdGuard Home. I tried to set up DNS-over-TLS, but the router always reverts it back. Looking for advice on what software I need to have running on my router to block adult sites/content, reduce ads and tracking, and mask the IP address(es).

 

[Tech9]

Almost anything running on the router has easy avoidance option. And you can't really mask IP addresses. Diversion and AdGuard Home are DNS-blockers, they do the same thing. Don't run both. DNS-over-TLS is DNS encryption method. The built-in AiProtection does basic IDS and URL-filtering, but doesn't see much encrypted. All modern browsers have sort of Safe Browsing enabled by default. Your devices actually have better protection as end point than your router passing mostly encrypted traffic. Your kids perhaps have mobile devices with data plans and access to other Wi-Fi networks. Your only option is parental controls on their devices.

 

[SashaSolitaire]

Which one is preferred, @Tech9, AdGuard or Diversion?

 

[Tech9]

Whatever you like better. Both do the same thing. Diversion is more router optimized minimalistic style, AdGuard Home was ported as an add-on with full blown WebUI and many configuration options. I personally like AdGuard Home better.

 

[EmeraldDeer]

I have not tried AdGuard, but if you choose Diversion, here are the custom blocking lists:

https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/dnsmasq/pro.txt
https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/dnsmasq/tif.txt
https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/dnsmasq/gambling.txt
https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/dnsmasq/nsfw.txt

Pro blocks Ads, Affiliate, Tracking, Metrics, Telemetry, Phishing, Malware, Scam, Fake, Cryptojacking and other "Crap".
TIF blocks Malware, Cryptojacking, Scam, Spam and Phishing. Blocks domains known to spread malware, launch phishing attacks and host command-and-control servers.
Gambling and NSFW are self-explanatory.
An alternative source are the following:

https://big.oisd.nl/dnsmasq2
https://nsfw.oisd.nl/dnsmasq2

You can use both and Diversion will deduplicate. I use both. Although both works fine on my router, I do not know about less powerful routers and slower USB drives.
Good luck!

 

[Tech9]

Which one is preferred

Actually, the easiest one is no DNS-blocking add-ons at all. AdGuard DNS upstream, supports DoT. Blocks ads, malware, phishing, etc. On your router just set AdGuard DNS in WAN settings and activate DNS Director to Router so it gives you some avoidance protection. But still... everything we discuss to this moment becomes useless with few clicks on a mobile device.

AdGuard DNS — ad-blocking DNS server

Create your ad-blocking DNS server that will protect your personal data, prevent tracking and allow you to control access to specific content on the Internet.

adguard-dns.io

 

[EmeraldDeer]

For DNS-over-TLS using free DNS from Control D, use the following four IP addresses:

76.76.2.11
76.76.10.11
2606:1a40::11
2606:1a40:1::11

Use the following on all four lines for TLS Hostname:

no-ads-porn-gambling-typo-malware.freedns.controld.com

You need to type into the boxes for each line and click + (plus)
After the four lines are there, you must click Apply at the bottom for it to take effect. Maybe this was your problem before.

Here are the other DNS settings:

The DNS Server only matters as the router reboots. I just take the ISP default DNS servers for reliable reboots. They will not be used when DoT starts.
I pay for Control D, so there are more options available.

 

[Tech9]

@EmeraldDeer, AdGuard DNS is built-in option. Don't remember which exact flavour, but it covers it all.

No SSH access, custom scripts and USB sticks needed. About the same final results in 10 seconds time.