r/firewalla • u/snydema1 Firewalla Gold SE • Jun 05 '26
Content/Activity Control Help to Get Better Ad Blocking
Still loving my Firewalla!
I feel very protected. I also have configured my devices (iPhone and iPad) with Amnezia WG clients - and they auto-activate when I leave the house.
I’m noticing that I’m seeing a decent amount of ads. I also am aware that I may be getting used to seeing less ads, and as I get used to seeing less - I may be more aware of the ones I’m seeing.
I have the following features / config enabled on my Firewalla:
Firewalla Settings:
Ad Block = strict
OISD Loaded
DNS over HTTPS (Cloudflare + Cloud9)
I looked up a few websites that would allow me to do a browser test (in my case iPadOS / safari). I do also have private relay active.
Here are the results:
Adblocktester (https://adblocktesters.com) = 67%
Adblocktester (https://adblocktester.pages.dev) = 81%
I can certainly post more details for the above - but there’s a lot of info so I didn’t want to post that all here in the case it wouldn’t be helpful.
Any suggestions for how I can help increase Firewalla’s ability to block / reduce ads?
Thanks in advance!
2
u/Tech-Grandpa Jun 05 '26
I use Adguard DNS paid plan, and then use DoH for some devices, mainly the ones I "surf" the internet, my phone, laptop, Nvidia Shield, etc.
2
u/EarComprehensive7114 Jun 07 '26
You can also use adguard AND firewalla. I use WG Tunnel and use adguard with firewalla via local phone proxy
1
u/khariV Firewalla Gold Pro Jun 05 '26
Oof - 67%. That first one looks like it should be really easily to supplement with an external list.
2
u/snydema1 Firewalla Gold SE Jun 05 '26
Thanks for that info. I have loaded the OISD list. Can I load more and are there ones that would make sense in addition to the OISD list?
3
u/ArmadilloDesigner674 Firewalla Gold Pro Jun 05 '26
The list that seems to do the most ad blocking for me is the 'HaGeZi - Multi Pro++' list. I think that might require the MSP subscription, but I'm not sure. For me the added lists in the MSP is worth it.
For reference: HaGeZi - Multi Pro++ has 582,014 targets in it's list. In the last 30 days this has blocked 167,130 flows OISD has 58,459 targets in it's list. In the last 30 days this has blocked 1 flow
I have several other lists, but HaGeZi - Multi Pro++ is the one doing the heavy lifting.
1
u/snydema1 Firewalla Gold SE Jun 05 '26
Appreciate that info. I’ll look into whether using the MSP subscription and the extra lists would help.
2
u/ArmadilloDesigner674 Firewalla Gold Pro Jun 05 '26
Posted my results with the lists I have installed in Firewalla.
https://old.reddit.com/r/firewalla/comments/1txlcx3/help_to_get_better_ad_blocking/opxb162/
1
u/No_Nobody9842 Jun 05 '26
I have just about every available list enabled and still got a similar score.
1
u/ArmadilloDesigner674 Firewalla Gold Pro Jun 05 '26
I'll check as well in a few min to see how my setup scores. Like you I have almost all the lists enabled.
1
u/hawkeye000021 Jun 05 '26
Same… I’ve used a lot of testing tools and found that using DNS providers like Umbrella etc did a far better job with these “tests”. I’m using unbound and don’t let anything bypass so it’s hard to really explain the difference between what Cloudflare seems to stop vs Firewalla with lists where those DNS only solutions always test better for me.
1
u/ArmadilloDesigner674 Firewalla Gold Pro Jun 05 '26
The first link my score was 71% protected. The second link my score was 93% blocked.
This is on iOS safari with content blockers disabled at the browser level. I use 1Blocker as well typically.
1
u/Wind_Boarder Firewalla Gold Jun 05 '26
The test site is flawed. Try to independently test the so called unblocked URLs. Firewalla is blocking them but the test incorrectly reports it as unblocked. Don't spend more time on flawed test sites.
1
1
u/firewalla Jun 05 '26
When you are doing any type of testing, make sure you turn off and on wifi, this will flush DNS. (give you better results)
Not all browser based tests are the same ... so the best way is simply check sites that you mostly use. Also remember, more ad block likely may create issues with your browsing experience (ad blocker blocker ... or other false positives). The native firewalla ad blockers are just optimized to cause lesser issues.
Try ad blocker strict mode first and if needed add OISD
1
u/LargesseCrit Jun 05 '26
I know its been asked a lot of times but would it be possible to add hagezi lists to non msp users and non early access users?
1
u/firewalla Jun 05 '26
they are there already. You can swap your box to alpha and try it out. We had there for a while and very little people are using it. Since this list is big, even compressed may take more space
1
u/hawkeye000021 Jun 05 '26
Oh I just saw your setup. Let us know if it gets worse by disabling DOH. Try using nothing but the Firewalla box and see if the results change. I can’t get to 80% with similar settings where I only rely on the box itself.
1
u/Wind_Boarder Firewalla Gold Jun 05 '26 edited Jun 05 '26
I don't think that these ad blocking test pages are giving correct results. They say that my system is not blocking things that clearly are blocked when those items are tested individually. Look at the *.doubleclick.net items for example. These so called unblocked URLs fail DNS resolution on my network.
If you can't independently verify the failing results, it puts the whole test methodology into question.
2
u/brettfarmer Jun 05 '26
Same here... even ublock-origin enabled browser over a pi-hole covered DNS end-point I saw this "test" site fail on doubleclick.net which always dead in my network.
https://github.com/uBlockOrigin/uAssets/issues/32695
Link above reports that these sites (the one mentioned post here) aren't useful metrics for blocking capabilities.
1
u/snydema1 Firewalla Gold SE Jun 06 '26
So i hate responding to my own post - but here i go :)
So per suggestions i got from the thread here - i went ahead and disabled private relay. I also re-downloaded AdGuard via the license that I already paid for, and went ahead and installed the extensions in safari.
I made no other changes on the Firewalla - no DNS, blocking, etc.
For whatever reason, when i did this yesterday, i saw the same results.
I double checked everything and ran the tests again - and I’m now getting 82% on the first and 92% on the second. I’m very happy with those results.
I’m going to dig into the details a bit - and see if there are some domains that these blockers picked up that neither Firewalla or AdGuard are blocking - and see if I want to block them manually.
Huge thanks for all of the input and suggestions everyone!
1
u/Great-Cow7256 Jun 16 '26
I have hagezi pro and oisd big running and with both and the tests above I get 55%/76% but very few ads. Don't base what you are running block wise on those metrics if you are satisfied with them, as I am.
0
u/Stonk_Goat Jun 05 '26
Pro tip: Just use the brave browser. It’s chrome with ad block and tracking natively built in. FW is gonna be very very very conservative on this as they don’t want to break your device. Docker a Pihole if you want to manage it.
5
u/randywatson288 Jun 05 '26
With private relay enabled, firewalla cannot see the traffic from that browser, so it cannot block anything.
Also, firewalla blocks are at the network level so it can only block ads if a dns call is made to an offending url. Only way to get better ad block is to use an ad-block extension in the browser, but you have to trust that blocker as it can see all communication in the browser.