Guides

Block ads on your whole network with router ad blocking

Set up Blokada Cloud on your router once, and every device at home is covered, including TVs, game consoles and smart speakers that cannot run an ad blocker.

Your details

This guide is filled in with the details of your device.

DNS name (DNS over TLS)
<your-id>.cloud.blokada.org
DoH link (DNS over HTTPS)
https://cloud.blokada.org/<your-id>

The DNS names and links on this page contain <your-id>, a short code for your device. Sign in to the dashboard to see yours. If you open this guide with the dashboard’s “Open on another device” link, it is filled in for you.

Fill in my details

Every device on your network asks the router which DNS server to use. Point the router at Blokada Cloud, and ads and trackers are blocked for everything behind it. That includes smart TVs, game consoles, streaming sticks and smart home devices, which have no room for an ad blocker app.

What your router needs

Your router must support encrypted DNS with a host name, that is DNS over TLS (DoT) or DNS over HTTPS (DoH). Many recent routers do, including the models below. Depending on which your router supports, you need your DNS name or your DoH link, both under Your details above.

Only plain IP addresses? Many internet provider routers only accept plain IP addresses for DNS. Support for those is on the way. Until then, set up your devices one at a time: Android, Mac and Apple TV, Windows, Linux, and browsers. You can also run a small forwarder on a Raspberry Pi, as described in the Pi-hole guide.

FRITZ!Box

FRITZ!OS 7.20 or later.

  1. Open http://fritz.box and go to Internet → Account Information, then the DNS Server tab.
  2. Turn on Encrypted name resolution in the internet (DNS over TLS).
  3. In Resolved Names of the DNS Server, enter only <your-id>.cloud.blokada.org. Remove every other entry. The FRITZ!Box uses all listed resolvers, and any other one lets ads through.
  4. Tick the option that enforces certificate verification, and untick the one that allows fallback to unencrypted name resolution.
  5. If you see Failover to public DNS servers when DNS disrupted, turn it off.
  6. Click Apply.

ASUS

ASUS firmware later than 3.0.0.4.386.4xxxx, and Asuswrt-Merlin.

  1. Open the router admin page and go to WAN → Internet Connection.
  2. Under WAN DNS Setting, set DNS Privacy Protocol to DNS-over-TLS (DoT) and DNS-over-TLS Profile to Strict.
  3. Remove every entry from the DNS-over-TLS Server List, then add one:
    • Address: 193.180.80.10
    • TLS Hostname: <your-id>.cloud.blokada.org
  4. Click Apply.

OpenWrt

  1. In System → Software, update the lists and install luci-app-https-dns-proxy.
  2. Open Services → HTTPS DNS Proxy. Delete the instances for other providers.
  3. Add an instance with a custom resolver URL: https://cloud.blokada.org/<your-id>
  4. Save & Apply. The package points dnsmasq at it automatically.

Other routers

Look for a setting called DNS over TLS, Private DNS, Encrypted DNS or DNS over HTTPS. Enter your Blokada DNS name or DoH link from above, and remove every other DNS server, including fallback servers.

Check that it works

  1. Restart one device, or turn its Wi-Fi off and on, so it picks up the change.
  2. Browse for a minute, then open the Activity page in the dashboard. Your network's lookups show up there.

If some devices still show ads

Some devices bypass the router: phones with Private DNS set, browsers with secure DNS set to another provider, and devices that hard-code their own DNS. Set those up on the device itself, or turn their own DNS setting off.

Behind the router, all devices share one address, so the dashboard shows your network as a single device. Set up phones and laptops with their own Blokada DNS name if you want to see them separately. They also keep their blocking when they leave home.

Updated

Questions and comments