I use a chrooted instance of Bind as it's a LAN only dns server, /etc/bind/named.conf includes: include "/etc/bind/adblock.conf"; That file is generated b

I use a chrooted instance of Bind as it's a LAN only dns server, /etc/bind/named.conf includes: include "/etc/bind/adblock.conf"; That file is generated by a script that uses a hosts file maintained on http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/ the script is something like: #!/bin/bash cat /etc/bind/adblock.conf | xz -z - > /etc/bind/adblock.conf-$(date "+%Y%m%d-%H%M%S").xz echo "" > /etc/bind/adblock.conf curl -o - http://someonewhocares.org/hosts/ | sed -rn 's:^127\.0\.0\.1 ([^ #\t]+).*$:\1:p' > /tmp/addrs.txt cat /tmp/addrs.txt | while read line; do ! egrep -i $line /etc/bind/whitelist.txt >/dev/null \ && echo 'zone "'${line}'" IN { type master;notify no; file "/etc/bind/pri/adblock.zone";};' >> /etc/bind/adblock.conf done which can be called from cron or similar (if you do you need to reload/SIGHUP bind to reload its condiguration) you can whitelist stuff by adding a FQDN to /etc/bind/whitelist.txt The file /etc/bind/pri/adblock.zone contains something like: @ 1 IN SOA localhost. root.localhost. (1000 7200 120 1209600 3600) @ 259200 IN NS localhost. * 259200 IN A X.X.X.X @ 2 IN A X.X.X.X where X.X.X.X is an IP on different (but private and not internet routable) subnet, and iptables rules something like: iptables -N DNSBLACKHOLE iptables -A DNSBLACKHOLE -j LOG --log-prefix "DNSBLACKHOLE ::" iptables -A DNSBLACKHOLE -j REJECT iptables -A OUTPUT -p all -d X.X.X.X -j DNSBLACKHOLE iptables -A FORWARD -p all -d X.X.X.X -j DNSBLACKHOLE Transparent proxying is accomplished by iptables rules redirecting port 80 and 443 through SQUID which essentially performs a MITM, you can find out how to do this here: http://blog.davidvassallo.me/2011/03/22/squid-transparent-ssl-interception/ http://blog.davidvassallo.me/2011/03/22/squid-transparent-ss... Edit: it's also worth mentioning I transparently redirect all DNS traffic the router sees to my own bind instance, so untrusted devices are unable to use an alternative dns server.