Korthveil can stop advertising, tracking, and malware names for every device that uses it as its DNS server: phones, TVs, consoles and laptops, with nothing installed on them. On Security › Ad & tracker blocking you choose:

Off: nothing is filtered.
Monitor: every lookup is answered normally, and Korthveil records what would have been blocked. Use it first to see what a list catches before anyone notices a change.
Block: listed names get "does not exist", so the ad or tracker never loads.

You can exempt devices, always allow or always block sites, and turn on a per-device view that shows which devices ask for ad and tracker names.

What you need:

The DNS resolver add-in set up and serving your networks (guide Block ads, trackers, and malware for the whole network: DNS filtering, step 1). Devices must use the firewall as their DNS server, which DHCP does for them.
About ten minutes.

The screenshots come from a test firewall whose LAN is 192.168.50.0/24 and fd4b:5652:50::/64.

How it works

 phone asks for ads.example ──▶ Korthveil DNS resolver
                                  │ exempt device?  ──yes──▶ answer normally
                                  │ on a list?      ──no───▶ answer normally
                                  │ Monitor: answer normally, record the match
                                  └ Block:   answer "does not exist", record the match

Lists are downloaded by the firewall from their publishers and kept in its database. A listed name also covers its subdomains. Everything works the same for IPv4 and IPv6 devices.

Quicker: System › Wizards › DNS filtering and ad blocking sets up the resolver, the lists, Monitor mode, and DHCP in four steps. The steps below do the same by hand and explain each part.

Step 1: Start in Monitor mode

Open Security › Ad & tracker blocking.
Press Monitor. If no list is chosen yet, Korthveil adds the StevenBlack list and turns on daily updates. The change is applied at once.
Press Download lists now under Lists the first time.

Monitor mode with the counters and the live graph of lookups that would be blocked

The graph shows matching lookups per second. Would be blocked counts them since the resolver started. Let it run for a day: the Most matched names and the per-device view (step 4) show what would change.

Step 2: Choose lists

Lists are grouped by what they block. Press Add next to a suggested list, switch a list off with its checkbox, or remove it with the bin. Each suggestion shows its size and licence.

Lists by category: advertising, trackers, malware

Category	Suggested list	Good for
Advertising	StevenBlack unified hosts, OISD small	Ads with few false positives
Trackers and telemetry	EasyPrivacy (firebog)	Analytics and tracking
Malware and phishing	URLhaus malware hosts	Sites serving malware, updated often

More lists help less than you might expect, and each one adds a chance of blocking something people need. Start with one advertising list and add trackers and malware when Monitor looks clean. Lists by URL, the block answer (does not exist or 0.0.0.0), and update times are on Network › DNS resolver.

Step 3: Exceptions

Exempt devices, always allow, always block

Exempt devices and networks: choose a device from DHCP and press Exempt device, or type addresses or networks, one per line, IPv4 or IPv6. Exempt devices are not filtered at all, including Always block. They must be inside the networks the resolver serves. Give an exempt device a DHCP reservation so its address does not change.
Always allow: a site a list blocks by mistake. It also allows the site's subdomains.
Always block: a site no list has.

Press Save exceptions. If you have other unsaved changes in the console, the page saves this change with them and asks you to commit.

Step 4: See which devices ask for ads (optional)

Per-device view: a device, its matched lookups, and the names it asked for

The per-device view is off by default. When it is on, Korthveil keeps each device's address with the ad and tracker names it asked for, in the firewall's database. Turn it on with the switch on Per device. Then:

devices are named from DHCP, and an address without a name shows as Unknown device (the screenshot's test device is the firewall itself);
click a device to see the names it asked for and how often;
Exempt stops filtering that device, and Filter again undoes it;
Forget device history deletes everything kept so far. Turning the view off deletes it too.

Only blocklist matches are kept, never other lookups. If your workplace or country requires it, tell people on the network before you turn this on.

Step 5: Switch to Block

When Monitor shows only names you are happy to stop, press Block. Allow any site people need from Most matched names with Allow.

Check it works

From a device on the network:

nslookup doubleclick.net

In Block mode the answer is "Non-existent domain" (or 0.0.0.0 with the null answer). In Monitor mode you get a real address, and the name shows up under Most matched names within a minute.

Limits

Ads served from the same name as the content (some video and social sites) cannot be blocked by DNS.
Devices that use their own DNS (DNS over HTTPS in a browser, or a hard-coded server) skip the filter. On Network › DNS resolver, under Interception, tick Redirect clients' DNS (port 53) to the firewall and Block DNS over TLS and QUIC, and switch off DNS over HTTPS in managed browsers.
The counters restart when the resolver restarts. Most matched names and the per-device view are kept in the database.