Adblock troubleshooting

jiberjaber · June 16, 2020, 10:16pm

Keen not to go through the joy of a total reset, I’ve never successfully got my broadband back up and running in such circumstances and usually had to revert to a back up. (though that was a couple of years ago I last tried)
I couldn’t see a package for kresd and there doesn’t seem to be a command to run it?

Unbound seemed to give something:

root@TurrisOmnia:~# ubus call service list ‘{“name”: “unbound”}’
{
“unbound”: {
“instances”: {
“instance1”: {
“running”: true,
“pid”: 7807,
“command”: [
“unbound”,
“-d”
],
“term_timeout”: 5,
“respawn”: {
“threshold”: 3600,
“timeout”: 5,
“retry”: 5
},
“pidfile”: “/var/run/unbound.pid”
}
}
}
}
root@TurrisOmnia:~#

vcunat · June 17, 2020, 6:25am

Unbound is the default resolver for Turris 1.x, but you seem to have an Omnia. For Omnia and MOX the default is kresd command in package knot-resolver. So far I haven’t heard of the resolver switching itself to another one by itself.

jiberjaber · June 17, 2020, 10:06am

I think it was back in November 2016 when I moved away from Kresd to dnsmasq due to some issues with equipment at home only working with dnsmasq. I have a dim and distant feeling I may have excluded knot at some point due to it overwriting the dnsmasq and resolver settings but I can not be sure of that.
ln late 2017 perhaps, I moved to using pi-hole to serve dhcp & dns on lxc. It’s only since I have updated to TOS5 that DNS & DHCP have been back on the TO (mainly because I can’t get LXC working without an issue with Luci at the moment)

knot-resolver package is not installed on my TO, should it be?

jiberjaber · June 17, 2020, 10:10am

I’ve just noticed if I run pkgupdate I get the following:

root@TurrisOmnia:~# pkgupdate
INFO:Target Turris OS: 5.0.2
WARN:Request not satisfied to install package: knot-resolver
WARN:Package wpad is in cyclic dependency. It might fail its post-install script                                               .
WARN:Package hostapd is in cyclic dependency. It might fail its post-install scr                                               ipt.
WARN:Requested package luci-i18n-rainbow-en that is missing, ignoring as request                                               ed.
WARN:Requested package luci-i18n-sqm-en that is missing, ignoring as requested.
line not found
line not found
line not found
line not found
line not found
ERROR:
inconsistent: Requested package luci that is not available.
root@TurrisOmnia:~#

vcunat · June 17, 2020, 10:17am

Ah, from history I can see that you were among the users with devices sensitive to “unusual” name compression in DNS. That should have been “worked around” in libknot for very long time. Therefore you might prefer to go back the default choice (kresd), as that’s really the only “officially supported” choice for Omnia.

Uh, I’m no good with pkgupdate knowledge. After you get the package somehow I think it should be enough to edit /etc/config/resolver, section config resolver 'common' to contain option prefered_resolver 'kresd'. I suppose option port '0' in /etc/config/dhcp is already present if you get Unbound running. I’m not sure what other discrepancies you might have accumulated.

jiberjaber · June 17, 2020, 10:47am

Bingo!
Installed knot-resolver it showed some errors, but I decided to give it a reboot and then if nothing was working, try another install, capture the errors and post here.
After the reboot:

root@TurrisOmnia:~# ubus call service list ‘{“name”: “kresd”}’
{
“kresd”: {
“instances”: {
“instance1”: {
“running”: true,
“pid”: 11234,
“command”: [
“/usr/bin/kresd”,
“–noninteractive”,
“-c”,
“/tmp/kresd.config”,
“/tmp/kresd”,
“-a”,
“0.0.0.0#53”,
“-a”,
“::#53”
],
“term_timeout”: 5,
“respawn”: {
“threshold”: 3600,
“timeout”: 5,
“retry”: 5
}
}
}
}
}
root@TurrisOmnia:~#

So from that I assumed Kresd is working, went to ad-block and changed the backend to Kresd and it no longer shows error in the status. Tried a few websites I know usualy result in ads and popups then looked at the DNS Report,

A much higher block rate than before. Blocking isn’t as good as pi-hole at the moment but that’s probably just a case of the right blocklists being enabled.

Thanks for the help!

vcunat · June 17, 2020, 11:01am

What gets blocked should be just about the lists you use, not about the SW. Though I don’t know off the top of my head if they have the same set of blocklist types.

jiberjaber · June 18, 2020, 1:33pm

And then it broke again… update from 5.0.1 to 5.0.2 removed knot-resolver !?!
Is this intentional or something hidden in my config from the old updater.sh approach?

vcunat · June 18, 2020, 1:40pm

Something bad remained in your configuration of updater. I expect you had to do that step before to prevent knot-resolver from getting reinstalled on updates (due to being a mandatory system dependency). Maybe in the /etc/updater/conf.d/opkg-auto.lua file, but I don’t know the updater well.

jiberjaber · June 18, 2020, 2:09pm

Thanks - found it, a left over I think, it was in user.lua, " Uninstall(“knot-resolver”, { priority = 60 }) "

I’ll remove that and see how it goes next time, I’ve reinstalled knot-resolver for now and after a reboot we are back working.

jiberjaber · June 18, 2020, 2:15pm

Is there a quick way to see which blocklist is blocking a DNS request?

Facebook and twitter are both being blocked at the moment, whilst I have added the corresponding requests to the whitelist using the action button (and they are present now in the whitelist) for some reason after a refresh they are still blocked?

DIKKEHENK · June 18, 2020, 2:43pm

this is what i get when i do ubus call service list ‘{“name”: “kresd”}’

:~# ubus call service list ‘{“name”: “kresd”}’
Usage: ubus [<options>] <command> [arguments...]
Options:
 -s <socket>:           Set the unix domain socket to connect to
 -t <timeout>:          Set the timeout (in seconds) for a command to complete
 -S:                    Use simplified output (for scripts)
 -v:                    More verbose output
 -m <type>:             (for monitor): include a specific message type
                        (can be used more than once)
 -M <r|t>               (for monitor): only capture received or transmitted traffic

Commands:
 - list [<path>]                        List objects
 - call <path> <method> [<message>]     Call an object method
 - listen [<path>...]                   Listen for events
 - send <type> [<message>]              Send an event
 - wait_for <object> [<object>...]      Wait for multiple objects to appear on ubus
 - monitor                              Monitor ubus traffic

jiberjaber · June 18, 2020, 2:48pm

That’s not right, you should get something like this:

root@TurrisOmnia:/# ubus call service list ‘{“name”: “kresd”}’
{
“kresd”: {
“instances”: {
“instance1”: {
“running”: true,
“pid”: 20693,
“command”: [
“/usr/bin/kresd”,
“–noninteractive”,
“-c”,
“/tmp/kresd.config”,
“/tmp/kresd”,
“-a”,
“0.0.0.0#53”,
“-a”,
“::#53”
],
“term_timeout”: 5,
“respawn”: {
“threshold”: 3600,
“timeout”: 5,
“retry”: 5
}
}
}
}
}
root@TurrisOmnia:/#

I would suggest you type the command directly in to the terminal rather than cut and paste, If I cut and paste I get the same as you, for some reason the text gets translated to remove the ’ and " and replace them with .

DIKKEHENK · June 18, 2020, 2:52pm

Ha, yes, then i get this :

 ubus call service list '{"name":"kresd"}'
{
        "kresd": {
                "instances": {
                        "instance1": {
                                "running": true,
                                "pid": 20126,
                                "command": [
                                        "/usr/bin/kresd",
                                        "--noninteractive",
                                        "-c",
                                        "/tmp/kresd.config",
                                        "/tmp/kresd",
                                        "-a",
                                        "0.0.0.0#53",
                                        "-a",
                                        "::#53"
                                ],
                                "term_timeout": 5,
                                "respawn": {
                                        "threshold": 3600,
                                        "timeout": 5,
                                        "retry": 5
                                }
                        }
                }
        }
}

michalko58 · June 18, 2020, 5:22pm

So, just did fresh installation from medkit. But default resolver in adblock was set to dnsmasq.

Now I have changed it to kresd and will see, if the problem with irregularly inaccessible sites wil occur again.

JardaB · January 29, 2022, 5:17pm

Omnia turris TOS 5.3.4. HBS

For a long time, Adblock worked as it should. I’m now seeing ads that are demonstrably blocked.

# /etc/init.d/adblock status
::: adblock runtime information
  + adblock_status  : enabled
  + adblock_version : 4.0.7
  + blocked_domains : 28497
  + active_sources  : adaway openphish reg_cz spam404 winspy 
  + dns_backend     : kresd, /etc/kresd
  + run_utils       : /usr/bin/wget, /bin/awk
  + run_ifaces      : trigger: wan, report: br-lan
  + run_directories : base: /tmp, backup: /srv/adblock, report: /srv/adblock, jail: /tmp
  + run_flags       : backup: 1, reset: 0, flush: 0, force: 1, search: 0, report: 1, mail: 0, jail: 0
  + last_run        : reload, 0m 11s, 1028/243/685, 29.01.2022 17:42:32
  + system          : Turris Omnia, TurrisOS 5.3.4 974161d7f891cc1a76c390258db2faxxxxxxxxxx

An example is speedtest.net, with showing advertising links :
googleads.g.doubleclick.net
adclick.g.doubleclick.net

root @ Turris_JB: ~ # nslookup googleads.g.doubleclick.net
Server: 127.0.0.1
Address: 127.0.0.1 # 53

** server can't find googleads.g.doubleclick.net: NXDOMAIN
** server can't find googleads.g.doubleclick.net: NXDOMAIN
root @ Turris_JB: ~ # nslookup adclick.g.doubleclick.net
Server: 127.0.0.1
Address: 127.0.0.1 # 53

** server can't find adclick.g.doubleclick.net: NXDOMAIN
** server can't find adclick.g.doubleclick.net: NXDOMAIN
root @ Turris_JB: ~ # nslookup adclick.g.doubleclick.net localhost
Server: localhost
Address: :: 1 # 53

** server can't find adclick.g.doubleclick.net: NXDOMAIN
** server can't find adclick.g.doubleclick.net: NXDOMAIN
root @ Turris_JB: ~ # nslookup googleads.g.doubleclick.net localhost
Server: localhost
Address: :: 1 # 53

** server can't find googleads.g.doubleclick.net: NXDOMAIN
** server can't find googleads.g.doubleclick.net: NXDOMAIN
root @ Turris_JB: ~ #

I haven’t found a setup error yet and I need to push for a solution. Or is it just a problem with this website and the complicated Java code in the page?

dibdot · January 30, 2022, 5:45pm

Disable DoH in your browser (network settings)!

jklaas · January 30, 2022, 6:21pm

You can also have a record in your local DNS. I put it in /etc/kresd/custom.conf:

-- Disable Mozilla DOH browser redirection
policy.add(policy.suffix(policy.DENY, {todname('use-application-dns.net.')}))

dibdot · January 30, 2022, 7:07pm

Well, the canary domain concept is only supported by firefox and can be overruled by end users (just configure another DoH node in firefox) … block public DoH servers instead (e.g. see GitHub - dibdot/DoH-IP-blocklists: This repo contains the domain names and the IPv4/IPv6 addresses of public DoH server).

JardaB · January 30, 2022, 7:26pm

Yes, it’s better. Only some pages in Opera and Chrome (speedtest.net) do not load correctly

I have to remember that (DoH). The main thing is to remove the ad.