GoKawiilHow cheap can you build a hardware-based ad-blocking DNS filter? "Free," if you're willing to salvage some used hardware that's being thrown away. What if you aren't so lucky? In the era of the RAMageddon, even a Raspberry Pi will cost you a couple hundred bucks. But you know, you don't even need something that powerful. In fact, you can use a $5 microcontroller to build a fully functional ad-blocking filter with over 500,000 domains blocked and around 10ms latency.
We know that's possible because Egyptian full-stack developer ZedAxis (@M-Abozaid on GitHub) has already built one. Using an ESP32-C3 "SuperMini" board, he's created a backup DNS for his home network that still provides ad blocking. His primary router is a Pi-hole, which is a Raspberry Pi running specialized software to manage DHCP addressing and DNS resolution with integrated ad-blocking. The SuperMini serves as a backup when the Pi-Hole is rebooting or otherwise unavailable.
The specific ESP32-C3 SuperMini board that ZedAxis used. (Image credit: ZedAxis/YouTube)
Strictly speaking, we haven't seen ZedAxis' creation in action, but there's no reason to believe it doesn't work. The ESP32 family of embedded Wi-Fi-enabled microcontrollers is a well-known quantity, and this functionality is by no means outside the realm of its capabilities. In fact, this specific trick allows the use of the ESP32-C3, which is a cost-reduced version of the chip that doesn't have the 8MB of PSRAM found on some higher-end models. (There are MANY variants of the ESP32.)
Latest Videos From Watch full video here:
Instead, the ESP32-C3 used by ZedAxis has just 400KB of RAM, and 4MB of flash memory. With these limited specifications, he wasn't able to store a plaintext blocklist of any real size; it's simply too much data. So, he did what any enterprising hacker would do: he started hashing the data to reduce its size. Using 40-bit FNV-1a hashes, because 32-bit would give too many collisions and 64-bit wastes too much space, he can store some 537,000 domains in the flash memory of the device.
The project includes a rudimentary GUI where you can see some statistics and configure custom domains for blocking. (Image credit: ZedAxis/YouTube)
The clever part isn't really the hashing, though. Rather than storing the domains themselves, the build process downloads one or more public blocklists, strips out duplicate entries and comments, hashes each remaining domain into a 40-bit value, sorts the resulting list, and writes the finished database into the ESP32's flash memory. When a DNS query arrives, the device hashes the requested hostname the same way and performs a binary search against the sorted hash table. If it finds a match, the request is blocked. Otherwise, the query is forwarded to an upstream resolver. According to ZedAxis, the finished firmware uses only around 50KB of RAM while answering blocked lookups in roughly 10 milliseconds.
I built a $2 ad-blocker for my whole network - YouTube Watch On
There's another neat compromise hiding in the design, too. The ESP32 normally reserves enough flash memory to hold two complete copies of its firmware, allowing over-the-air (OTA) updates without risking a failed flash leaving the device unbootable. If you don't care about wireless firmware updates, you can reclaim that second firmware partition for the blocklist database instead. With OTA support enabled, the project tops out at around 250,000 blocked domains. Give up OTA, and that jumps to roughly 537,000 domains on a microcontroller that you can usually buy for the price of a fast-food lunch. ZedAxis describes the price as $2; I wasn't able to find SuperMini boards any cheaper than about $5 US, but at that price there's not much need to quibble about the difference.
... continue reading