How AdHole works

Before connecting to a site, every device asks for its address. AdHole answers those questions for this computer, and for each device whose DNS you set to this computer’s address, once, in its network settings. AdHole doesn’t change your devices’ settings for you.

Each name gets one of four answers

• An ad or tracking domain gets a null address: the device doesn’t find the server and gives up at once.
• A name that only exists at home, like your router’s admin page or a printer, goes to your router. AdHole finds your router’s address on its own.
• Firefox’s automatic encrypted DNS is turned off: it would otherwise bypass the filter.
• Everything else goes to Cloudflare over an encrypted connection, with Quad9 as a backup. As long as they answer in time, your internet provider doesn’t see the names of the sites you open; Cloudflare does. You can change resolver.

The lists: AdHole relies on well-known public filter lists (AdGuard, HaGeZi), downloaded from where their authors publish them and refreshed once a day. Each list can be switched off in one click, and one line in the dashboard blocks or allows a site.

AdHole only answers devices on your local network: it never becomes an open resolver on the internet.

Devices pointed at this computer lose internet access when it’s off or asleep. On Windows, its network must be set to Private for them to reach it.

When the encrypted resolvers go down, or take more than three seconds, AdHole asks Cloudflare in the clear, the last resolver in the default list, and if that fails too, your router, still in the clear, for as long as that lasts: your internet provider sees those names again. It’s a stopgap: a name resolved in the clear beats a computer with no internet. Filtering carries on all the same, and AdHole goes back to encrypted the moment a resolver answers.

On the computer where it’s installed, AdHole goes further: your browsers go through it, so it can look inside web pages. It blocks ad requests inside pages, hides the ad slots, gets the YouTube player an ad-free response, and clicks “reject all” on cookie banners that offer it.

Browsers find it through a small configuration script: if AdHole doesn’t answer, they go direct.

It works in Chrome, Edge and Brave as they are. Firefox needs one setting. On Windows, page and YouTube filtering applies to the account AdHole was installed from; the DNS filter covers the whole computer.

It can pick the wrong button: on a few sites it clicks “Accept”, or a refusal that leads to a payment page. Pop-ups that demand your consent without a free way to refuse are removed only if you turn that on in the settings. Content reserved for subscribers is never unlocked.

On an Android phone or TV box, the DNS filter runs inside an app, on the device. Same three lists and same resolvers as the computer version, read through an index built for a phone’s memory and compared with the computer’s engine on 5,000 names — but nothing on the network to set up, and no computer to leave on.

To receive the system’s questions, the app declares itself to Android as a local VPN. All of the phone’s traffic now goes through it, on the device: the tunnel still leads nowhere outside the phone, no server of ours sits behind it, your IP address isn’t hidden, and none of your traffic passes through the publisher.

The page filter runs there too, for browsers alone. The app makes a root certificate on the phone; you install it yourself in Android’s settings and turn cleaning on, for the browsers you leave ticked. It then hides ad slots, removes YouTube’s video ads and refuses cookie banners, with the same engine as the computer and lists chosen for the phone. Until the certificate is installed, nothing is opened and no browser ever shows a certificate error.

Where it stops: Android doesn’t let one app read another app’s encrypted traffic, so nothing inside an app that isn’t a browser is touched. Firefox asks for one setting of its own. Browsers are kept off HTTP/3 while pages are cleaned, so a page may load a little differently. Page cleaning needs Android 10, the name filter Android 8.0. And uninstalling the app leaves the certificate in Android’s store: you take it out by hand.

To read an HTTPS page, AdHole needs a certificate your browsers trust. It creates one on your computer when you install it, and the Android app creates one on the phone, which you install yourself. Its private key never leaves the device that made it, and on a computer only administrators can read it: the publisher has no copy.

There is a risk: anyone who copied that key could read your traffic. Never copy the “ca” folder in AdHole’s data. On a computer, uninstalling removes the certificate; on Android it stays in the system store until you take it out by hand, in Android’s security settings, under Encryption & credentials → User credentials (labels vary by manufacturer).

AdHole never looks inside certain sites: payment services, the main French banks and insurers, French tax and health services, encrypted messaging, game stores. This list is not complete, and it is built around French services: banks, insurers and health sites outside France are not in it. Add your bank, your health insurer or your employer in the settings before your next sensitive login.

On Linux, sudo ./adhole setup -no-proxy installs the DNS filter alone, with no certificate: pages and YouTube are then not filtered, until the next update, which installs the certificate. On Windows, the installer always installs the certificate; you can turn the page filter off afterwards.

YouTube’s ads come from the same servers as its videos. Nothing on the network can tell them apart, so a DNS filter, AdHole’s or any other, lets them through.

In the browser, the player asks YouTube what to play. AdHole changes that request so the answer schedules no ad, and removes the ads from video lists: in this computer’s browsers, and in those of an Android phone whose certificate is installed, videos start without ads. It also usually avoids the waiting screen YouTube shows when it can’t play an ad.

On a TV, a console or the YouTube app on a phone, AdHole doesn’t remove YouTube ads.

Google is testing ads stitched into the video itself. If that becomes the norm, no blocker will be able to remove them this way, AdHole included.

• Web pages: your browsers go through AdHole, and go direct if it doesn’t answer. Crash, restart, update or stop: pages still open, just unfiltered while AdHole is away.
• Site names: your router stays listed behind AdHole. If AdHole stops answering, the router answers; and if AdHole can no longer answer, it hands DNS back to your router before stopping.
• The service restarts on its own: after 1 s on Windows, 5 s on Linux.

What can still happen: a download or a video call running at the moment of a crash is cut, and resumes when you restart it. During an update, filtering pauses while it installs (the terms of use allow for about thirty seconds).

Updates install between 3 and 5 a.m. local time. If the computer is off then, an update that has been waiting more than seven days installs at the next opportunity.

An update is installed only if it comes from an HTTPS address and its SHA-256 checksum exactly matches the published one. Otherwise, nothing is installed.

An update that comes with new terms of use doesn’t install on its own: the dashboard shows “Read the new terms of use” and “Accept the new terms and install”. Until you accept, your version keeps working. Prefer to decide every time? Turn off automatic installation and AdHole will just let you know.

Everything AdHole sees of your browsing is processed on your computer, in memory. The dashboard keeps the last 1,000 requests; they vanish when the service stops. No browsing history is written to disk: only the technical log may note a domain name there, when an error occurs.

Nothing about your browsing is sent to the publisher. An anonymous statistic goes out at each start and then once a day, with the version check: a random number replaced every month, the version, the system, and the number of requests blocked since the previous check — a plain number, with no domain name and no date, which feeds the total shown on this site. It’s on by default; one switch in the settings turns it off and deletes the number.