Open-source alternatives to Smartdns

This project is a serverless DNS resolver and DNS over HTTPS gateway that translates domain names into IP addresses. It functions as an edge computing DNS filter designed to encrypt queries, prevent tampering, and improve user privacy on browsers and mobile devices. The system distinguishes itself by operating as an edge DNS traffic monitor that logs and analyzes request patterns in real time. It utilizes curated blocklists at the network edge to block malicious domains and trackers. The software provides capabilities for private DNS filtering, network traffic monitoring, and the management

dnscrypt-proxy is an anonymizing DNS proxy and encrypted DNS resolver. It acts as a local DNS forwarder that secures internet lookups by wrapping standard DNS queries in encrypted tunnels using the DNSCrypt and DNS-over-HTTPS protocols to prevent eavesdropping and tampering. The project provides network privacy protection by routing DNS requests through anonymized relays to obfuscate the client's original IP address. It further distinguishes itself through traffic management capabilities, such as mapping specific domains to designated resolvers and distributing queries across multiple servers

AdguardFilters is a collection of curated adblock filter lists, content blocking rulesets, and DNS blocklists. Its primary purpose is to provide the rules necessary to identify and remove advertisements, tracking scripts, and intrusive elements across web browsers and applications. The project includes specialized rules for cosmetic filtering to hide layout gaps and a malware domain database to block phishing and spyware destinations. It provides distinct filtering sets for different regions and purposes, such as social media blocking. The repository covers broad capability areas including m

Blocky is a stateless DNS proxy that functions as a network-wide ad-blocker and content filter. It operates as a single binary or Docker container with no database or persistent state, accepting DNS queries over UDP, TCP, HTTPS, TLS, QUIC, and HTTP/3 through a unified plugin-based query pipeline. The core of the system is a client-group policy engine that assigns devices to named groups and applies per-group blocklists, allowlists, and upstream resolvers, with all configuration changes applied through hot-reloading without requiring a restart. The project distinguishes itself through its modu

Gluetun is a Docker VPN client gateway that routes network traffic from other containers through secure WireGuard or OpenVPN tunnels. It serves as a network gateway to mask origin IP addresses and provides a firewall kill switch that blocks all outbound traffic unless it is destined for the active VPN server. The project supports multiple commercial VPN providers and can maintain several simultaneous connections using custom configuration files. It includes an integrated proxy server stack hosting SOCKS5, HTTP, and Shadowsocks servers to tunnel TCP and UDP traffic. Security is managed throug

This project provides a collection of domain blocklists designed to prevent network requests from reaching specific destinations. These lists function as databases of problematic and corporate web addresses that can be imported into content filters, network security tools, and system-level hosts files. The lists focus on blocking known malicious domains and corporate web services to control network access. These curated sets are organized to filter harmful websites and company-owned domains across local devices or networks. The project manages these entries through flat-file storage and stat

NextDNS is a network DNS client and proxy that functions as a local resolver, forwarder, and DNS-over-HTTPS proxy. Its primary purpose is to route local name resolution requests to external providers using encrypted HTTPS traffic to improve privacy and bypass network restrictions. The service distinguishes itself by embedding client identity metadata—collected via mDNS or DHCP—into outgoing queries, allowing for per-device tracking and the application of unique filtering profiles. It features advanced routing logic, including split-horizon DNS for balancing public and private resolution, doma

AdRules is a collection of ad-blocking rule sets and DNS filter lists designed to identify and block malicious domains, trackers, and PCDN services. It functions as a DNS sinkhole filter and a malware domain blocklist used by DNS servers and network proxies to stop advertisements and harmful content from loading. The project provides regional network optimization, utilizing rule sets tailored to specific geographic regions, languages, and mobile device conditions to target local advertising networks. The system covers DNS traffic filtering and malware domain blocking through suffix-based dom

AdAway is an Android network firewall and DNS traffic filter that functions as a local VPN ad blocker. It intercepts network requests to prevent advertisements and tracking domains from reaching the device by filtering traffic against host lists. The project features a host file manager capable of importing and converting blocklists from external third-party providers. It includes a system for managing both blocked and allowed domains, allowing for the creation of custom rules to permit specific trusted sites or block individual domains. The tool provides granular traffic control through app

This project is a comprehensive repository of curated domain blocklists designed for network-wide DNS filtering. It functions as a DNS sinkhole feed, providing the necessary data to intercept and block unwanted network requests at the resolution layer before they reach their destination. By returning null or loopback addresses for identified domains, it prevents connections to malicious infrastructure, advertising servers, and tracking endpoints across all devices on a network. The repository distinguishes itself through a tiered categorization logic that allows users to select protection lev

BPB-Worker-Panel is a control panel designed for deploying and managing VLESS and Trojan proxies hosted on Cloudflare Workers. It functions as a proxy subscription generator and a manager for secure DNS over HTTPS servers and WireGuard configuration provisioning. The project distinguishes itself through network traffic obfuscation capabilities, utilizing packet fragmentation and SNI spoofing to evade detection. It provides specialized administration for Cloudflare Warp and Warp Pro connections, including the ability to optimize endpoints and export WireGuard configurations. The system covers

This project is an ad-blocking filter list and DNS blocklist collection designed to prevent advertisement and tracking servers from loading content across devices. It functions as a network-layer ad filter by providing a curated set of domain patterns and URLs that network components use to block known advertising and big data statistics domains. The collection focuses on privacy-focused domain filtering to stop the unauthorized collection of personal information and user tracking. It identifies and blocks domains associated with telemetry, analytics, and log collection to prevent the upload

mosdns is a DNS forwarding server and traffic filter that routes DNS queries to multiple upstream providers. It functions as a rule-based DNS router and a proxy for DNS-over-HTTPS and DNS-over-TLS to ensure secure DNS resolution. The system utilizes a pipeline-based request processing model and rule-based query routing to direct specific domain queries to different upstream servers. It implements pluggable transport layers and forwarding protocols, including HTTPS, TLS, and QUIC, to encrypt traffic and prevent eavesdropping. The project includes capabilities for upstream load balancing to di

This project provides a system-wide content filtering utility that controls network traffic by redirecting domain resolution requests to local null addresses. By mapping unwanted hostnames to these addresses at the operating system level, it effectively blocks connections to advertising, tracking, and malicious domains across all applications on a machine. The core of the system is a data-driven build pipeline that aggregates multiple curated source lists into a single, unified configuration file. This process is highly customizable, allowing users to employ declarative filtering logic throug

This project provides a containerized DNS sinkhole and network-wide traffic filtering solution. It functions as a central network resolver that intercepts domain queries, allowing users to block advertisements, trackers, and malicious domains by returning null responses to connected devices. The platform distinguishes itself through its integrated DHCP server and comprehensive management capabilities, which allow for automated IP address allocation and granular control over network traffic. It supports complex filtering through regular expression matching, hierarchical rule prioritization, an

Surge is a network traffic routing and configuration system designed to categorize and steer network requests using curated rule sets, domain lists, and IP databases. It provides the data structures and filtering logic necessary to manage how application traffic is directed across proxies, direct connections, or regional gateways. The project distinguishes itself through granular traffic identification and steering. It identifies network requests by matching them against system process names, user-agent strings, and geographic IP ranges to apply specific routing policies. This allows for the

Tenta DNS is a recursive and authoritative domain name server implementation written in Go. It provides secure network resolution services by translating human-readable domain names into machine addresses while enforcing cryptographic standards to ensure data privacy and authenticity. The software distinguishes itself through a focus on secure transport and integrity verification. It utilizes encrypted tunnels for upstream communication to prevent eavesdropping and incorporates a validation engine to verify digital signatures on resource records. To manage global traffic, the system supports

This project is an OpenWrt proxy client and network traffic orchestrator designed to tunnel internet traffic through remote proxy nodes. It functions as a system for managing proxy subscriptions, preventing DNS leaks, and directing traffic flow via an automatic failover gateway. The software distinguishes itself through a subscription manager that imports and synchronizes remote server lists via URLs and QR codes. It features device-specific access controls that allow the application of unique proxy rules, domain whitelists, and time-based schedules to individual network devices. The capabil

Hickory-DNS is a DNS implementation written in Rust that provides a full suite of DNS capabilities: a client library for querying and constructing DNS messages, a recursive resolver with caching, an authoritative DNS server, and support for DNSSEC validation and signing. It can operate as a DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH) client, and includes a multicast DNS (mDNS) implementation for local network discovery without a central server. The project differentiates itself through its integrated DNSSEC pipeline, which validates signatures by chaining from a root trust anchor and can auto

This project is a comprehensive security hardening and privacy management guide for macOS. It provides a set of instructions and checklists for reducing the system attack surface through manual configuration, policy enforcement, and a layered defense strategy. The guide emphasizes a system auditing framework, using binary analysis, system logs, and packet inspection to verify that security controls and application sandboxing are functioning as intended. It offers tool-agnostic recommendations, defining security goals while allowing users to select their own third-party software for implementa

dnsmasq-china-list is a configuration generator and a set of DNS filter and routing lists. It converts curated domain lists into configuration files for dnsmasq to optimize regional name resolution and direct specific domain requests to regional servers. The project focuses on reducing latency and avoiding DNS hijacking for users in China by routing traffic through regional servers and directing requests to the nearest content delivery network nodes. It also provides rules to block malicious domains and advertisements by returning failure responses to prevent network injection. The system ma

AdGuardHome is a network-wide software solution that provides centralized control over domain name resolution, content filtering, and local network management. It functions as a recursive DNS server and DHCP address server, intercepting network traffic to enforce security policies and block unwanted content across all connected devices. By acting as a central gateway, it ensures that every device on a home or office network benefits from consistent protection and private, authenticated name resolution. The software distinguishes itself through granular client management and robust security fe

MasterDnsVPN is a DNS tunneling VPN and network censorship bypass tool that encapsulates network traffic within DNS queries to circumvent restrictive firewalls. It functions as a secure tunneling protocol and SOCKS5 proxy server, allowing local application traffic to be routed through a secure tunnel to a remote destination. The project distinguishes itself through a DNS resolver load balancer that distributes traffic across multiple resolvers based on latency and packet loss scoring. It further secures and masks traffic using symmetric payload encryption—supporting ChaCha20, AES-GCM, and XOR

dnsguide is a software implementation of the DNS protocol designed to handle queries and responses between clients and nameservers. It functions as a recursive DNS server and network service tool for managing the resolution of domain names within local or wide area networks. The project provides a framework for building a custom DNS server, incorporating recursive resolution logic and stub resolver integration to translate hostnames into IP addresses. It is designed for implementing the DNS protocol from scratch to facilitate network protocol learning and custom name resolution. The implemen

Portmaster is a host-based network firewall and privacy tool that monitors and controls all system network traffic. It operates by intercepting data packets at the operating system level, allowing it to observe and manage every connection made by local software in real time. The software distinguishes itself through process-aware connection mapping, which correlates active network sockets with specific local applications to provide visibility into data transfers. It utilizes a user-space policy engine to enforce granular security rules, enabling users to restrict internet access, block specif

ip2region is an offline IP geolocation library and framework designed to resolve IPv4 and IPv6 addresses to city-level regional information using local binary data files. It functions as a binary IP database compiler and a cross-language search client, allowing for regional lookups without relying on external APIs. The project distinguishes itself through a specialized binary format that supports high-performance query optimization. It employs adjacent-segment IP merging and deduplicated region storage to minimize the database footprint, while utilizing memory-mapped file caching and vector-i

wool_scripts is a collection of HTTP proxy rule sets, network traffic filters, and automation scripts designed for mobile applications. It functions as an application proxy router to reroute specific traffic and AI model requests through proxy servers to change IP addresses. The project provides a system for intercepting network requests to remove embedded advertisements from mobile applications and mini-programs. It also includes filters to suppress operating system update notifications and automatic software downloads by blocking requests to update servers. Beyond traffic filtering, the re