RouterOS v7 防火牆封鎖清單（臺灣廣告與追蹤為主）

 /ip firewall filter

### Google 廣告與追蹤系統
add chain=forward protocol=tcp tls-host="googleads.g.doubleclick.net" action=drop comment="Google Ads"
add chain=forward protocol=tcp tls-host="pagead2.googlesyndication.com" action=drop comment="Google Syndication"
add chain=forward protocol=tcp tls-host="tpc.googlesyndication.com" action=drop
add chain=forward protocol=tcp tls-host="partner.googleadservices.com" action=drop
add chain=forward protocol=tcp tls-host="ad.doubleclick.net" action=drop

### Facebook / Instagram 廣告系統
add chain=forward protocol=tcp tls-host="ads.facebook.com" action=drop comment="Facebook Ads"
add chain=forward protocol=tcp tls-host="connect.facebook.net" action=drop
add chain=forward protocol=tcp tls-host="graph.facebook.com" action=drop
add chain=forward protocol=tcp tls-host="ads.instagram.com" action=drop comment="Instagram Ads"

### 蝦皮 Shopee 廣告與追蹤
add chain=forward protocol=tcp tls-host="cv.shopee.tw" action=drop comment="Shopee tracking"
add chain=forward protocol=tcp tls-host="tracking.shopee.tw" action=drop
add chain=forward protocol=tcp tls-host="deo.shopeemobile.com" action=drop

### Mobile01 廣告平台
add chain=forward protocol=tcp tls-host="adimg.mobile01.com" action=drop comment="Mobile01 Ads"
add chain=forward protocol=tcp tls-host="ad.mobile01.com" action=drop

### Dcard 廣告服務
add chain=forward protocol=tcp tls-host="ad.dcard.tw" action=drop comment="Dcard Ads"
add chain=forward protocol=tcp tls-host="static-ad.dcard.tw" action=drop

### Appier 台灣常見 AI 廣告平台
add chain=forward protocol=tcp tls-host="jscdn.appier.net" action=drop comment="Appier Ads"
add chain=forward protocol=tcp tls-host="tracker.apx.appier.net" action=drop

### Taboola / Outbrain / Adnxs 國際平台（但常用在台灣網站）
add chain=forward protocol=tcp tls-host="trc.taboola.com" action=drop
add chain=forward protocol=tcp tls-host="log.outbrain.com" action=drop
add chain=forward protocol=tcp tls-host="ib.adnxs.com" action=drop

### Yahoo 廣告相關（新聞頁面常見）
add chain=forward protocol=tcp tls-host="ad.doubleclick.net" action=drop
add chain=forward protocol=tcp tls-host="gemini.yahoo.com" action=drop
add chain=forward protocol=tcp tls-host="analytics.yahoo.com" action=drop

### Line 廣告與追蹤
add chain=forward protocol=tcp tls-host="ads.line.me" action=drop comment="Line Ads"
add chain=forward protocol=tcp tls-host="ad.line-scdn.net" action=drop
add chain=forward protocol=tcp tls-host="obs.line-scdn.net" action=drop

### 通用廣告與行為分析服務（建議封鎖）
add chain=forward protocol=tcp tls-host="www.googletagmanager.com" action=drop
add chain=forward protocol=tcp tls-host="www.google-analytics.com" action=drop
add chain=forward protocol=tcp tls-host="ssl.google-analytics.com" action=drop
add chain=forward protocol=tcp tls-host="cdn.segment.com" action=drop
add chain=forward protocol=tcp tls-host="static.hotjar.com" action=drop
add chain=forward protocol=tcp tls-host="script.hotjar.com" action=drop

routeros x86 建議

 

 

 

Queue Tree 實作建議

/ip firewall mangle
add chain=forward protocol=udp dst-port=853 action=mark-packet new-packet-mark=doq
add chain=forward protocol=tcp dst-port=853 action=mark-packet new-packet-mark=dot
add chain=forward protocol=udp dst-port=53 action=mark-packet new-packet-mark=udp53
add chain=forward protocol=tcp dst-port=443 action=mark-packet new-packet-mark=https

/queue tree
add name=Q1-DoQ parent=ether1 packet-mark=doq priority=1
add name=Q2-DoT parent=ether1 packet-mark=dot priority=2
add name=Q3-DNS53 parent=ether1 packet-mark=udp53 priority=3
add name=Q4-HTTPS parent=ether1 packet-mark=https priority=4
 
 
 
 
有心沒有得
 
設定小封包優先 是現在2025 不建議的做法，會造成封包不連續性，反而變慢，或是出問題
 
使用
quic dns 查詢，做為adguardhome or windows 的adguardhome 是最好的做法，在臺灣也是。
dns quic port 是udp 853
 
 
 
目前https 含dns 的封包無法被分離. 使用adguardhome 
 
 
 
 
可能有用 
/ip firewall mangle

# ICMP 回應（最高）
add chain=prerouting protocol=icmp action=set-priority new-priority=7 comment="ICMP 高優先"
add chain=prerouting protocol=icmp action=change-dscp new-dscp=48

# DNS / DoQ
add chain=prerouting protocol=udp dst-port=53,853 packet-size=0-200 action=set-priority new-priority=6 comment="DNS/DoQ 優先"
add chain=prerouting protocol=udp dst-port=53,853 packet-size=0-200 action=change-dscp new-dscp=46

# DoT
add chain=prerouting protocol=tcp dst-port=853,8853 packet-size=0-300 action=set-priority new-priority=6 comment="DoT 優先"
add chain=prerouting protocol=tcp dst-port=853,8853 packet-size=0-300 action=change-dscp new-dscp=46

# TCP SYN（連線建立加速）
add chain=prerouting protocol=tcp tcp-flags=syn action=set-priority new-priority=6 comment="TCP SYN 優先"
add chain=prerouting protocol=tcp tcp-flags=syn action=change-dscp new-dscp=46

# TCP ACK（傳輸穩定）
add chain=prerouting protocol=tcp tcp-flags=ack packet-size=40-100 action=set-priority new-priority=5 comment="TCP ACK 優先"
add chain=prerouting protocol=tcp tcp-flags=ack packet-size=40-100 action=change-dscp new-dscp=40


and
 

 /ip firewall mangle
add chain=prerouting protocol=udp dst-port=53,853 action=set-priority new-priority=6
add chain=prerouting protocol=udp dst-port=53,853 action=change-dscp new-dscp=from-priority-to-high-3-bits

add chain=prerouting protocol=tcp dst-port=853,8853 action=set-priority new-priority=6
add chain=prerouting protocol=tcp dst-port=853,8853 action=change-dscp new-dscp=from-priority-to-high-3-bits

只要要有 

 packet-size=0-300

小封包 都建議拿掉 

routeros adguardhome 無法安裝

 

https://forum.mikrotik.com/viewtopic.php?t=193727

Fxxx

 adguard/adguardhome:latest

找這問題，差一點重裝routeros 花5hr 

 

近日不行使用，要使用 

adguard/adguardhome:v0.108.0-b.25

 

安裝在usb 記得format ext4 . 

format fat32 不能使用

 

 

https://www.77bx.com/185.html 

https://fossilispc.github.io/posts/adguardhome_ros7.4/adgrard-home-ros-7.4/
https://www.youtube.com/watch?v=_jCKaHl3XM0

https://www.youtube.com/watch?v=kuHanWZ8Qic

https://forum.mikrotik.com/viewtopic.php?t=193727

目前可以設定重新開機，自己重load

在選項   Start On Boot

2. usb format 重開機會跳disk ，7.8之後不會了，直接找到file name 為 usb1 開頭

 

3.

ext4 無法backup . 

所以 adguard home in Container 還是無法backup 出來 或是倒入

20230309

routeros 安裝 adguardhome