Every device on your Wi-Fi and LAN asks Korthveil for names. Korthveil looks them up privately at Quad9 over an encrypted connection (DNS over TLS), checks DNSSEC, and answers "does not exist" for ad, tracker, and malware domains from two well-known blocklists. Phones, TVs, and game consoles are covered without installing anything on them. Devices that try to use their own DNS server (for example a hard-coded 8.8.8.8) are sent to Korthveil anyway.

What you need:

• The Wi-Fi access point and DHCP set up (guide Set up Wi-Fi, NAC, IPS, and WAF), with zone WIFI, and your wired network in zone LAN. Both need a static address on the firewall (for example 192.168.2.1/24 on the Wi-Fi).
• An internet connection that allows outgoing TCP port 853 (DNS over TLS to Quad9).
• About fifteen minutes.

The screenshots come from a test firewall whose LAN zone is lan. On the GMKtec test firewall the zones are WIFI and LAN.

How it works

 phone on WIFI                Korthveil firewall                      internet
 ┌─────────────┐  DNS :53   ┌─────────────────────────────────┐  DoT :853  ┌─────────────┐
 │ asks for    │ ─────────▶ │ DNS resolver add-in              │ ─────────▶ │ Quad9       │
 │ ads.example │            │  1. on a blocklist? → NXDOMAIN   │            │ dns.quad9   │
 └─────────────┘            │  2. otherwise ask Quad9, check   │            │ .net        │
   asks 8.8.8.8 directly ─▶ │     DNSSEC, cache the answer     │            └─────────────┘
   (redirected to :53)      │ DoT (853) from WIFI → dropped    │
                            └─────────────────────────────────┘

• Blocklists are downloaded by the firewall itself and stored in its database. A blocked name also blocks its subdomains.
• Interception quietly redirects DNS (port 53) that is meant for another server back to the firewall, IPv4 and IPv6.
• Blocking DNS over TLS stops devices from using their own encrypted DNS on port 853.

Quicker: System › Wizards › DNS filtering and ad blocking does steps 1, 2, 3, 5, 6, and 7 in four screens (allow and block lists by hand, step 4, stay on the page). The steps below do the same by hand and explain each part.

Step 1: Open the DNS resolver

Go to Network › DNS resolver. The page is called DNS resolver and filtering.

If the add-in is off, the page says The DNS resolver add-in is not enabled yet. You do not need to switch it on separately: saving the settings in Step 6 turns it on in the pending changes. The switch at the top of the page (On/Off) does the same.

Step 2: Where it answers, and Quad9 over TLS

In the Resolver panel:

When you choose Forward to upstream resolvers, Upstream resolvers appears. Tick DNS over TLS and click Quad9 (DNS over TLS). It fills in all four Quad9 servers:

An empty Port means 853 with DNS over TLS. The Certificate name is checked against Quad9's certificate, so nobody in between can pretend to be Quad9. To add a server by hand, click Add upstream.

A backup provider (recommended)

If every upstream server belongs to one provider and that provider has a problem, every new lookup fails: names the firewall looked up recently still work from its cache, everything else (and more and more as the cache runs out) does not. After such a failure the resolver also waits up to 15 minutes before it tries the servers again. This happened on 2026-11-02 with Quad9 only.

Add a second provider below Quad9: click Add upstream twice and fill in:

These are Cloudflare's servers with malware blocking, like Quad9, so the protection stays the same whichever provider answers (the plain 1.1.1.1 blocks nothing). The resolver uses the fastest server that answers; when one provider fails, the other answers. Everything stays encrypted on port 853.

In a failover pair, set this on the active firewall: the standby receives it with the next sync.

Prefer not to send your lookups to any one company? Choose Full recursion (ask the authoritative servers directly) instead. Filtering works the same; the lookups are not encrypted then.

Step 3: Blocklists

In the Filtering panel, tick Block listed domains. More settings appear:

Under Blocklists, add the two lists:

1. Click StevenBlack unified hosts. The row is filled in for you.
2. Click Add list by URL and fill in the new row as below. Korthveil also offers an OISD small button (https://small.oisd.nl/domainswild2, fewer names); this guide uses the larger OISD big list.

The Format must match the file. StevenBlack is a hosts file (0.0.0.0 name). OISD's domainswild file is a domain list (*.name, one per line). Korthveil reads name, *.name, and ||name^ lines in a domain list, and each name also blocks its subdomains. Only https:// addresses are accepted. A list may have up to 1,000,000 names.

The List ID is lowercase letters, digits, and dashes. The downloaded copy is stored under it.

Below a list you see its state: not downloaded until the first download, then the number of names and when it was updated.

Licences: StevenBlack is MIT; OISD is GPL-3.0. The lists are not part of Korthveil: your firewall downloads them from their publishers.

Step 4: Allow and block by hand

Still in Filtering:

• Always allow (one domain per line): names that must never be blocked, with their subdomains. Use it for false positives, for example a shop's link-tracking domain that breaks the links in its order e-mails. An allowed name wins over every list.
• Always block (one domain per line): names to block even though no list has them.

Tick Log blocked queries. It fills Most blocked domains on the status panel. Only the blocked names are counted; the devices' addresses are not kept.

Step 5: Catch devices that ignore DHCP, and block DNS over TLS

In the Interception panel:

Secure DNS for every device (recommended)

The goal: no DNS leaves your network unencrypted, and devices that encrypt DNS themselves may keep doing so.

Remote devices: give a remote-access VPN (for example WireGuard for your phones, see WireGuard for phones) a zone of its own, such as VPN, and tick it under Serve these zones. Its devices are then treated like the LAN: their normal DNS is answered by Korthveil and leaves encrypted. A VPN tunnel to a provider (Korthveil as the client of NordVPN or IPVanish) is an internet connection: keep it in the internet zone and do not serve it.

What happens then:

• A device using normal DNS (port 53, UDP or TCP) to any server, for example 8.8.8.8 or 1.1.1.1, is answered by Korthveil, filtered, and Korthveil asks Quad9 or the backup over TLS. Nothing has to be set on the device.
• A device using its own DNS over TLS (Android Private DNS, an iOS DNS profile, some browsers) reaches its provider encrypted on port 853. Such a device goes around Korthveil's filtering and ad blocking; rules that block by address (for example a YouTube schedule, see Block YouTube or the internet for chosen devices on a schedule) still apply to it.
• Inside your network, a device's normal DNS travels unencrypted to the firewall: DHCP cannot hand out encrypted-DNS settings, and Korthveil does not answer DNS over TLS on the LAN. Everything that leaves your network is encrypted.

Watch it on the DNS resolver page, Live activity:

• DNS queries: per second, the queries answered for devices (port 53), the ones blocked, and the ones sent out encrypted (port 853) to Quad9 or the backup (the rest come from the cache).
• Encrypted DNS (port 853): the open DNS-over-TLS connections, as Devices' own encrypted DNS (devices that use DNS over TLS themselves) and Firewall to Quad9 / Cloudflare. DNS over TLS is encrypted, so Korthveil counts the connections, not the queries inside them.

Both graphs can also go on the dashboard (Layout › Add from other pages).

Check it from a computer on the network: nslookup doubleclick.net 8.8.8.8 gets Korthveil's answer (blocked: Non-existent domain), although it asked Google; that shows the redirect works.

Stricter: every device through the filter

To send every device through Korthveil's filtering, also turn Block DNS over TLS and QUIC on. A device's own DNS over TLS is then dropped, and it falls back to the network's DNS.

• A phone with Private DNS set to a fixed provider name (Android "strict" mode) loses DNS until it is set back to Automatic.
• In a failover pair, a served zone that has no port on one of the firewalls (for example a Wi-Fi zone on the firewall without a radio) gets no rules there; Korthveil 1.1.24 and later skip it by itself. On 1.1.23 and older the commit is refused (zone "WLAN" does not exist or has no interfaces).

Block DNS over TLS for WIFI only (optional). Block DNS over TLS and QUIC covers every served zone. To block it only on the Wi-Fi, leave that box off and add a firewall rule instead. Go to Firewall › Rules and click Add rule:

Click Save to pending changes, then drag the rule (the grip on the left of its row) above the rule that lets WIFI reach the internet. Rules are checked from the top. The rule matches IPv4 and IPv6.

A device that must keep its own DNS (for example a work computer). In the Interception panel, enter its address under Devices never redirected or blocked (for example 192.168.2.30; IPv6 addresses work too). Its DNS then goes to the servers it chooses: port 53 is not redirected and port 853 is not blocked. To stop ad blocking for it as well, add it under Security › Ad & tracker blocking as an exempt device; to stop the threat-intelligence feeds for it, see Security › Threat intelligence › Devices never blocked. Korthveil 1.1.34 and later.

DNS over HTTPS (DoH) uses port 443, like every web page, so no port rule can tell it apart without TLS inspection. A browser or app with its own DoH server can still get past the filter. Two things help:

• Most browsers turn their own DoH off when the network's DNS says so, or fall back to the network's DNS when their DoH server is blocked. Add the DoH servers you want to stop (for example dns.google, cloudflare-dns.com, doh.opendns.com) to Always block, and add use-application-dns.net too: Firefox then keeps using Korthveil.
• On managed computers, turn DoH off by policy (Chrome, Edge, Firefox enterprise settings).

Step 6: Save, commit, download the lists

Click Save to pending changes at the bottom of the settings. The page says Saved to pending changes … Review and commit to apply. Click Review and commit, then Commit (Safety rollback on), with a note such as DNS filtering with Quad9 over TLS. Confirm the commit (the banner at the top) so it stays.

With Download and update lists automatically on, the firewall downloads the lists within the hour. To download them now, click Download lists now in the Status panel. It shows Downloading…, then Last list update (…) with the result. Each list then shows its number of names, and Blocked shows how many names are listed in total.

Step 7: Hand out the firewall as DNS server

Devices use the resolver when DHCP tells them to.

Go to Network › DHCP server. In the panel Network on for the Wi-Fi interface (and again for the LAN interface), click Use this firewall under DNS servers for clients, and again under DNS servers (IPv6). Both fields then read firewall: Korthveil hands out its own address on that network (for example 192.168.2.1 and fd00:2::1) and keeps it right if the address changes.

A new network starts with 9.9.9.9, 1.1.1.1 and 2620:fe::fe. Replace them: with those, devices would go around the filter (interception catches them on WIFI, but not on a zone you do not intercept).

Click Save to pending changes and commit. Devices pick up the new DNS server when they renew their lease: turn the Wi-Fi off and on, or wait for the next renewal.

Check it

1. Test a name. At the bottom of the DNS page, in Test a name, type a name and click Test: - an ad server from the lists, for example doubleclick.net: Filter: blocked by the matching name and list, for example (list stevenblack); - www.example.com: not blocked, Resolver: NOERROR, DNSSEC validated, and the addresses; - choose AAAA for the same name: the IPv6 addresses; - a name on your allow list: allowed by the allow list.

2. From a phone or laptop on the Wi-Fi. Ads disappear from most apps and web pages. On a laptop: - nslookup doubleclick.net: the server is the firewall (192.168.2.1) and the answer is Non-existent domain; - nslookup doubleclick.net 8.8.8.8: also Non-existent domain. The query went to Korthveil, not Google: interception works; - nslookup -type=AAAA www.example.com fd00:2::1: an IPv6 address. The resolver answers over IPv6 too; - kdig +tls @1.1.1.1 example.com (or any DNS over TLS client): it times out or is refused: DNS over TLS is blocked.
3. Live activity. The DNS queries graph shows Queries and Blocked per second, from the resolver's own counters. Browse a news site on the phone and watch both rise.

4. Status. Queries, Answered from cache (the share answered without asking Quad9), and Blocked with the number of names listed. Most blocked domains lists the top 25 blocked names once Log blocked queries is on.

Change it later

Troubleshooting