I think at this point you're better off going network-wide blocking to cover all your devices instead of just the few empowered to provide this security themsel

I think at this point you're better off going network-wide blocking to cover all your devices instead of just the few empowered to provide this security themselves. I use a self-hosted DNS server called https://pi-hole.net/ https://pi-hole.net/ for that, it was created for Raspberry Pis but I put it into a Vagrantfile and combined it with block lists similar to Ghostery from https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts to form https://github.com/benlowry/pihole-extended-hosts https://github.com/benlowry/pihole-extended-hosts A commercial solution similar to that was just all over HN too - https://optimal.com https://optimal.com