Set up ad-block at the DNS level

modules/networking.nix

@@ -33,11 +33,13 @@ in {
     allowedTCPPorts = [
       631 # Cups
       6566 # SANE
-      80
-      443
+      80 # HTTP
+      443 # HTTPS
+      53 # DNS
     ];
     allowedUDPPorts = [
       1194 # Wireguard
+      53 # DNS
     ];
     autoLoadConntrackHelpers = true;
     connectionTrackingModules = [ "sane" ];
@@ -77,5 +79,24 @@ in {
     };
   };
 
+  # DNS server with ad-block
+  services.dnsmasq = {
+    enable = true;
+    servers = [ "176.9.37.132" "116.203.147.31" ];
+    extraConfig = ''
+      domain-needed
+      bogus-priv
+      no-resolv
+
+      listen-address=127.0.0.1,192.168.1.2,10.8.0.1
+      bind-interfaces
+
+      cache-size=10000
+      local-ttl=300
+
+      conf-file=/var/lib/dnsmasq/dnsmasq.blacklist.txt
+    '';
+  };
+
 }