I use Unbound[1] for DNS caching and local DNS. I have Unbound configured to forward queries to a local Stubby[2] instance that does DNS over TLS to CloudFlare.

Stubby does keep-alives and not restricted to a single thread and opening a new connection per query like Unbound which is why I used it as a forwarder as a few more features than Unbound.

In my Unbound config I have an include to a blocklist generated from https://github.com/StevenBlack/hosts, essentially I pipe the data from that repo through awk [3]

I have an Android TV box so also have a firewall rule to redirect all queries to 8.8.8.8 and 8.8.4.4 port 53 to my local DNS server.

No GUI's, solid and stable. Only thing missing is I need to write a cron job to fetch the latest block list, validate, convert to Unbound format and reload the daemon. It's only a 10 minutes job just something I haven't got round to yet.

OpenBSD is really good for running this stuff.

[1] https://www.nlnetlabs.nl/projects/unbound/about/ [2] https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Daemon+-+... [3] https://deadc0de.re/articles/unbound-blocking-ads.html

I simply use plain old dnsmasq running on my router device. Configure DHCP to hand out my gateway IP as the LAN's DNS server. Then configure dnsmasq to point it to the block list:

  address=/0.0.0.0/0.0.0.0
  addn-hosts=/path/to/dns_blocklist

Then, once a week, cron updates the block lists, invoking something like:

  wget -qO- "http://winhelp2002.mvps.org/hosts.txt" "http://someonewhocares.org/hosts/zero/hosts" "http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&showintro=0&startdate[day]=&startdate[month]=&startdate[year]=&mimetype=plaintext&useip=0.0.0.0" | grep -w ^0.0.0.0 | sed $'s/\r$//' | sort -u >> /path/to/dns_blocklist

You can pick your favorite blocklists to be more or less aggressive, and you also don't have to update directly from the Internet if you don't inherently trust those blocklist sources. No web UI or Pi-Hole branding. Been working great for years and years.

Before PI-hole I would download Privoxy to my router. One of the features I really like was that you set it up to default to blocking everything network-wide and have a local proxy you could set up to remove blocking.

https://openwrt.org/docs/guide-user/services/proxy/privoxy http://www.privoxy.org

I run dnscrypt-proxy on a Pi on my LAN. It's set to pick a random resolver from a preset list and then it encrypts and forwards incoming requests to this resolver. Naturally, my DHCP server dishes out the IP address of the Pi to my devices.

I also use the DNS66 app on Android devices to set my DNS and block ads when I'm using a mobile network.

dnscrypt-proxy on VPS with some blocklists updated twice a day. Nginx+letsencrypt for providing dns-over-http and dns-over-tls (so I can use my own DNS on mobile). And few iptables rules.

Setting this up takes half an hour.

Additionally I am also running strongswan for VPN on the same server.

I am paying 10$ per year for VPS.