nextdns VS asuswrt-merlin.ng

I've tried hosted Pi-Hole and AdGuard Home. They are good as long as I'm around to fix stuffs. Then I tested something which can be global (home) and also for individual devices -- Control-D, NextDNS, and Adguard DNS. All of them works pretty well. If I really have to choose, then it would be in the order of NextDNS > Control-D > AdGuard DNS. Affiliated with none, and have decided to subscribe to all three to further test them for this year.

https://controld.com

https://nextdns.io

https://adguard-dns.io

Okay but NextDNS' own homepage says it "blocks ads and trackers on websites and in apps" - https://nextdns.io

I first used Safari on Windows around 2006. Put me off forever.

You just need Firefox and the extensions that mean ads are never seen.

That said, take a look at https://nextdns.io

just run snort and get nextdns.io account and use those DNS servers to control your DNS.

I'm using NextDNS which can be integrated into TailScale MagicDNS. It works seamlessly. You may need to pay if you have a high usage rate. I pay for the Pro version but that's less than $30 CAD a year. I did have in house Raspberry PI and Pi-Hole DNS but it was a lot of work.

pretty much to the same effect of a pihole, yet you can get up and running in minutes. You can then configure wherever you please: your browser, your laptop, your phone, or even your router.

[0]: https://nextdns.io

Check out NextDNS. You can set recreation time and block things like YouTube and Instagram at all times of the day except during your recreation time. Mine for instance is between 6pm and 9pm. At all other times, I can have it blocked. They market this feature to parents, which I think is short sighted because it’s great for productivity and works much more effectively at the network level compared to blocking apps which, at least on iOS, are limited in their capabilities.

Update: So I can see in https://github.com/nextdns/nextdns/wiki that the nextdns CLI I set up in opnsense is DOH, but I swear this wouldn’t work the first time I installed it, hence why I set up DOT. So confused now lol!

I think you need VPN director from Asuswrt Merlin https://github.com/RMerl/asuswrt-merlin.ng/wiki/VPN-Director

Not an answer, but I have the AC5300 and like it. And if you're not aware, there's open source firmware for a lot of the Asus routers here. I use it and once again seems fine. Disclaimer, I'm not a power user, so probably can't answer anything more specific about VPN setup on the router itself, but from my understanding it is possible.

However, I am struggling with how to route the site-to-site client's WAN traffic through its own OVPN client connection. If I set up a rule routing all client subnet traffic through the OVPN connection, then the Wireguard rule never gets processed, because all OVPN rules are processed before any Wireguard rules.

Many (all?) of the ASUS routers supported by the Merlin firmware https://www.asuswrt-merlin.net/ have OpenVPN built-in. If you have an ISP-provide modem/router, you may be able to put it in transparent bridge mode.

However, it looks like only the older model is on sale. Go for the Asus and do research if you want Merlin or not.

Here's the official website. It has a list of supported routers: https://www.asuswrt-merlin.net/

If you are somewhat good with computers, get an Asus router with a broadcom chipset that can run Merlin WRT. They are rock solid and feature packed (you can even adjust the wireless power level, since you're having wifi issues). There's a list of supported routers here: https://github.com/RMerl/asuswrt-merlin.ng/wiki/Supported-Devices

Asus may be terrible in other parts of the company, but they're good in the wifi router department because they cooperate with their users to produce a better product: https://www.asuswrt-merlin.net/