@@ -78,9 +78,24 @@ DEFAULT_PROXY_DOMAIN=cdnvideo.com
7878# This allows: example.com, test.org and ALL their subdomains
7979ALLOWED_SNI_LIST=
8080
81+ # Block ads and trackers
82+ # (accepted values: true or false; enabled unless set to false).
83+ # A TLS handshake whose SNI is a listed domain (or a subdomain of one) is
84+ # dropped, and so is every packet addressed to an IP such a domain resolves to.
85+ ENABLE_ADS_FILTER=true
86+
87+ # Comma-separated URLs of the ad/tracker domain lists. Each one is cached in
88+ # DATA_DIR and downloaded again once the cached copy is older than three days.
89+ # Empty uses the built-in URLs.
90+ ADS_BLOCKLIST_URLS=
91+
92+ # Directory for the files the server downloads at runtime (the ad/tracker
93+ # domain lists)
94+ DATA_DIR=/etc/fptn/data
95+
8196# Block BitTorrent traffic to prevent abuse
8297# (accepted values: true or false; enabled unless set to false)
83- DISABLE_TORRENT_FILTER =true
98+ ENABLE_TORRENT_FILTER =true
8499
85100# Block the client traffic that gets this server blacklisted
86101# (accepted values: true or false; enabled unless set to false). It drops:
@@ -91,7 +106,18 @@ DISABLE_TORRENT_FILTER=true
91106# - amplification reflectors: UDP 1900, 11211
92107# NOTE: the mail part also stops desktop mail clients (Thunderbird, Outlook)
93108# of your legitimate users from sending mail through the tunnel.
94- DISABLE_SPAM_FILTER=true
109+ ENABLE_SPAM_FILTER=true
110+
111+ # Block the blacklisted domains: a TLS handshake whose SNI is a listed domain
112+ # (or a subdomain of one) is dropped, and so are the QUIC and ICMP packets
113+ # addressed to an IP such a domain resolves to
114+ # (accepted values: true or false; enabled unless set to false).
115+ ENABLE_DOMAIN_BLACKLIST_FILTER=true
116+
117+ # Comma-separated URLs of the domain lists to block. Each one is cached in
118+ # DATA_DIR/blacklist and downloaded again once the cached copy is older than
119+ # an hour. Empty uses the built-in URLs.
120+ DOMAIN_BLACKLIST_URLS=
95121
96122# Optional: path to a file with extra domains to block, one per line
97123# ('#' starts a comment). Traffic to the addresses these domains and their
@@ -143,8 +169,13 @@ ExecStart=/usr/bin/$(basename "$SERVER_BIN") \
143169 --tun-interface-name=\$ {TUN_INTERFACE_NAME} \
144170 --mtu-size=\$ {MTU_SIZE} \
145171 --userfile=\$ {USERFILE} \
146- --disable-torrent-filter=\$ {DISABLE_TORRENT_FILTER} \
147- --disable-spam-filter=\$ {DISABLE_SPAM_FILTER} \
172+ --enable-ads-filter=\$ {ENABLE_ADS_FILTER} \
173+ --ads-blocklist-urls=\$ {ADS_BLOCKLIST_URLS} \
174+ --data-dir=\$ {DATA_DIR} \
175+ --enable-torrent-filter=\$ {ENABLE_TORRENT_FILTER} \
176+ --enable-spam-filter=\$ {ENABLE_SPAM_FILTER} \
177+ --enable-domain-blacklist-filter=\$ {ENABLE_DOMAIN_BLACKLIST_FILTER} \
178+ --domain-blacklist-urls=\$ {DOMAIN_BLACKLIST_URLS} \
148179 --domain-blacklist-file=\$ {DOMAIN_BLACKLIST_FILE} \
149180 --prometheus-access-key=\$ {PROMETHEUS_SECRET_ACCESS_KEY} \
150181 --use-remote-server-auth=\$ {USE_REMOTE_SERVER_AUTH} \
0 commit comments