best way to block Ads on the network side

[EVPower2k21]

Hi, I like untangle firewall but some feature aren't optimum.

My untangle/arista is one network to external (modem) and another network car internal (192.168.1.x).

1 Switch for the internal stuff (Acess Point, Qnap, PC, Console, TV).

Right now, adblock installed on my browser is blocking more than the current implementation of untangle adblock.

I want to remove ads on mobile phone, tablet and TV on my home setup from just my firewall.

From what I research, I can install Adguard or use Nord VPN.

Using Nord VPN and their software is suppose to block youtube / web ads and more.

https://www.vpnblade.com/does-nordvpn-block-youtube-ads/

Can I use untangle to transfer all web traffic (web and youtube) goes to nord vpn and get filtered? Is it possible and how to do it?

I`m working in IT but networking is not my forte.

Thanks

[donhwyo]

Check out pi-hole.net . It is a dns black hole for ads.

[oj88]

Passing all traffic through a VPN will significantly reduce your bandwidth, would it not?

I agree with the above reply.... use Pi-Hole on the network and then uBlock Origin on the browser.

The Ad Blocker included in ETM does absolutely nothing (zero blocked ad events in the last month), but I still keep it on in case an ad from the 90's pops up. Ads nowadays uses https so it goes straight to your browser, leaving Ad Blocker without a clue what just happened.

Is Nord Premium cheaper than just paying for Youtube Premium to get rid of ads?

[RonV42]

I second oj88's comments. You have to use a multi-approach technique, pi-hole for the entire LAN + uBlock to handle the stragglers on the PC. There is almost nothing that will handle the inline web site ads and I am seeing more and more of them. I will say I was out of town only lived with uBlock since the hotel I stated at wouldn't let my VPN connect and I am still impressed how well it worked.

[gravenscroft]

The Ad Blocker included in ETM does absolutely nothing (zero blocked ad events in the last month), but I still keep it on in case an ad from the 90's pops up. Ads nowadays uses https so it goes straight to your browser, leaving Ad Blocker without a clue what just happened.

I always say that you get what you pay for and Ad Blocker is a free app. It's worth remembering that it was built something like a decade ago, for the version of the web that existed at that time, and hasn't been updated. Even updating its definitions isn't likely to help much.

The 'Web Advertisements' category in Web Filter is more effective than the Ad Blocker app, but it's still not 100%.

[donhwyo]

I always say that you get what you pay ...

Unfortunately you don't always get what you pay for. You don't always get what you want but if try sometimes you get what you need. One thing is a partial solution only.

[jcoehoorn]

The Ad Blocker included in ETM does absolutely nothing (zero blocked ad events in the last month)

It's a lot more effective if you have SSL Inspector setup correctly. Without it, the Ad Blocker can't see most of the page content.

But I agree with other opinions that UBlock Origin in the browser is the better option. There are WAAAY too many false positives otherwise. Users need local control of this with an agent that can immediately show them the action take and allow the user to bypass. You can't do that in the network only.

[oj88]

So far, no issues with running Pi Hole on the network. It doesn't stop all ads but there's definitely a very significant reduction, particularly on mobile devices.

My kids complain that their apps would suddenly be inundated with ads when they're out and about (connected to 4G/5G data). But when connected to the WiFi at home, they seldom see any, if at all.

Makes me wonder if I should just configure their devices to VPN home so they will still get filtering.

[ccdmnk]

I had AdBlocker (+SSL inspection & WebFilter) running for 1+ years. Neither of these are getting much to work with as long as uBlock Origins is running. AdBlocker is basically obsolete as the WebFilter catches most of it. I used to run a pihole (later adguard home) but WebFilter "just works" and is good enough.

I made a powershell script that can (could?) parse some blocklists to Untangle if you're into that. Personally I've only added a country specific filter with ~100 domains- none of witch ever get hit as long as uBlock is running.

[oj88]

How do you guys objectively test the efficacy of an ad blocker solution in a controlled and repeatable manner?

[ccdmnk]

How do you guys objectively test the efficacy of an ad blocker solution in a controlled and repeatable manner?

Logs.
Most adblockers are just lists of domains or in the case of ublock some deeper capabilities, like actually removing the elements so the pages look normal. All of them would block everything if you asked them too.

I'd rather see some ads than try to block everything. Too much effort tryin to get it "perfect". When I used pihole I only had the default list + one country specific.

Disabled uBlock and ran Untangle AdBlock now for 4 hours. Didn't catch anything but WebFilter got most of them.

[bluechris]

Lately i went from PiHole to ADG Home on a linux vm. It works much better than pihole and much faster with the optimistic caching that it has and also the DNSSEC support for the external querries (i use quad9 and cloudlfare which are the fastest here in Greece. Of course you can use unbound with the global servers for anonymity but i don't mind that and ones i use makes the browsing super fast). Give it a go if you havent try it.
Of cource a companion of global redirect in Arista of the 53 port to ADG and secontly if you wanna be hard to some IoT devices that ignore everything (even some browsers do it that Arista cannot stop them) you can block totally the 853 port for outgoing connections (except ADG or PiHole) and final a global block list of DoH servers (except the ADG or PiHole again here).

With all the above i am always connected to home whenever i go throw Openvpn (my home license doesn't have wire-guard) and i am pretty happy with the outcome.

[balrog]

Lately i went from PiHole to ADG Home on a linux vm. It works much better than pihole and much faster with the optimistic caching that it has and also the DNSSEC support for the external querries (i use quad9 and cloudlfare which are the fastest here in Greece. Of course you can use unbound with the global servers for anonymity but i don't mind that and ones i use makes the browsing super fast). Give it a go if you havent try it.
Of cource a companion of global redirect in Arista of the 53 port to ADG and secontly if you wanna be hard to some IoT devices that ignore everything (even some browsers do it that Arista cannot stop them) you can block totally the 853 port for outgoing connections (except ADG or PiHole) and final a global block list of DoH servers (except the ADG or PiHole again here).

With all the above i am always connected to home whenever i go throw Openvpn (my home license doesn't have wire-guard) and i am pretty happy with the outcome.

You've pretty much summarize why i went with Adguard Home having used pihole for many years. Used quad9 as DNS forwarder as it's fast and the non-profit transferred their headquarters to Switzerland due to strict privacy laws which i like.

To the Original Poster, LAN-wide Adblocking multi layer defense is the way to go as others have mentioned. What i do is:
* 1st layer: Firefox/Chrome Browser based Ublock Origin plugin. PROS: can block youtube ads. CONS: only blocks on the browser level.
* 2nd layer: Adguard Home + DNS Forwarder. PROS: Blocks Ads everywhere on TV, android/iphone, etc. CONS: Initial Administration cost is high (your time) but I do administer it only once a week or adhoc afterwards.
* 3rd layer: Arista webfilter. PROS: Already there and free. CONS: Not really a con, since it never blocked anything for a couple of months due to Adguard Home.

Another reason for AD blockers like AGH/Pihole is the flexibility of using different custom DNS blocklist. My favorite is oisd.nl with 700K+ list, the site even dares you to find and report false positives which is manually curated. Another is crazy max's blocking windows/office telemetry.

[EVPower2k21]

Sorry for the delay, but Adguard Home works great for all connected devices. Will test other option for youtube ads.

Thanks again everybody.

[FWRCool]

I've been using NextDNS (nextdns.io) for the home and on mobile for several years now.

It works very well, with or without a DNS application installed.
They give you personal IPv4 and IPv6 DNS server IPs for each of your DNS profiles, so you can for example have different sets of rules for the kids, etc.
And then you can, if you wish, enable analytics and you can see what profiles hit what rules and when.