Block ads on your whole network with router ad blocking

What your router needs

There are two ways to set up a router:

• Encrypted DNS with a host name, that is DNS over TLS (DoT) or DNS over HTTPS (DoH). Many recent routers support it, including the models below. Depending on which your router supports, you need your DNS name or your DoH link, both under Your details above.
• A plain IPv6 DNS address. Many internet provider routers only accept plain IP addresses for DNS. If yours does and your connection has IPv6, Blokada gives you an IPv6 address to enter. See Routers that only take an IP address.

Use encrypted DNS if your router supports it. Lookups stay private on their way to Blokada.

FRITZ!Box

FRITZ!OS 7.20 or later.

1. Open http://fritz.box and go to Internet → Account Information, then the DNS Server tab.
2. Turn on Encrypted name resolution in the internet (DNS over TLS).
3. In Resolved Names of the DNS Server, enter only <your-id>.cloud.blokada.org. Remove every other entry. The FRITZ!Box uses all listed resolvers, and any other one lets ads through.
4. Tick the option that enforces certificate verification, and untick the one that allows fallback to unencrypted name resolution.
5. If you see Failover to public DNS servers when DNS disrupted, turn it off.
6. Click Apply.

ASUS

ASUS firmware later than 3.0.0.4.386.4xxxx, and Asuswrt-Merlin.

1. Open the router admin page and go to WAN → Internet Connection.
2. Under WAN DNS Setting, set DNS Privacy Protocol to DNS-over-TLS (DoT) and DNS-over-TLS Profile to Strict.
3. Remove every entry from the DNS-over-TLS Server List, then add one:
   • Address: 193.180.80.10
   • TLS Hostname: <your-id>.cloud.blokada.org
4. Click Apply.

OpenWrt

1. In System → Software, update the lists and install luci-app-https-dns-proxy.
2. Open Services → HTTPS DNS Proxy. Delete the instances for other providers.
3. Add an instance with a custom resolver URL: https://cloud.blokada.org/<your-id>
4. Save & Apply. The package points dnsmasq at it automatically.

Other routers

Look for a setting called DNS over TLS, Private DNS, Encrypted DNS or DNS over HTTPS. Enter your Blokada DNS name or DoH link from above, and remove every other DNS server, including fallback servers. If there is no such setting, use a plain IPv6 address as below.

Routers that only take an IP address

Your router and your internet connection need IPv6 for this. Support for plain IPv4 addresses is coming later.

1. In the dashboard, open Setup and choose Router, TV, game console.
2. Name the router, for example Home router, and select Get address. The name shows up in your activity and can't be changed later.
3. In the router's settings, find the DNS servers for IPv6, often under Internet, WAN or IPv6, and enter the address as the only DNS server.
4. Remove every other DNS server, IPv4 ones included. Devices that still get an IPv4 DNS server from the router send some lookups past Blokada. If the router can't leave IPv4 DNS empty, set up your devices one at a time instead: Android, Mac and Apple TV, Windows, Linux, and browsers.

The same setup works for a TV or game console that lets you enter a DNS server by hand. Give each one its own address, so it shows up by name in your activity.

Check that it works

1. Restart one device, or turn its Wi-Fi off and on, so it picks up the change.
2. On that device, turn off Blokada if it runs it, then open go.blokada.org/test. It shows whether your DNS goes through Blokada.
3. Browse for a minute, then open the Activity page in the dashboard. Your network's lookups show up there.

If some devices still show ads

Some devices bypass the router: phones with Private DNS set, browsers with secure DNS set to another provider, and devices that hard-code their own DNS. Set those up on the device itself, or turn their own DNS setting off.