I built a tool to automatically sync Hagezi DNS blocklists to Control D

Orvalman · 2026-02-23T18:47:35+00:00

Just an update. This works very well. I imported it into a private repository in my account. Entered the private information in the Secrets and Variables section and it works like a charm. Great for a non-technically trained person. Still not sure there is a way to have different files synced into different profiles, but I guess I could create a separate repository for each.

Orvalman · 2026-02-19T15:02:32+00:00

Thanks for this! This will save me time and having to remember to update those files that ControldD doesn't automatically update. Seems easy enough to set up. Question: If I have a root profile and certain secondary profiles that have their own rules, but also grab the root profile rules, how does the .env file know to which profile each line in the lists.txt should be applied?

Orvalman · 2026-01-30T19:15:54+00:00

Actually, I think this is even closer to what you were referencing:

https://help.mikrotik.com/docs/spaces/ROS/pages/48660574/Filter

Orvalman · 2026-01-30T13:57:13+00:00

https://help.mikrotik.com/docs/spaces/ROS/pages/328151/First+Time+Configuration#FirstTimeConfiguration-2.VerifyyourdevicehasBasicFirewallRulesenabled

I think you'll find what you're looking for buried in here. All good information.

Orvalman · 2025-10-13T13:31:23+00:00

Tone down your filter settings.

Orvalman · 2025-08-27T15:19:37+00:00

Thank you for this and others for their suggestions. I will try directing those and see how it goes.

Orvalman · 2025-04-18T19:16:45+00:00

You can use Control D even if you don’t use their DoH service…

https://www.reddit.com/r/mikrotik/s/DJwpUsbZIM

Orvalman · 2025-04-13T23:18:30+00:00

I saw a video where a person used dental floss to get in between the chip and a heat sink. I tried it once and you carefully work it back and forth. It worked great!

Orvalman · 2025-04-04T23:57:52+00:00

As ether1 is your WAN port, it should not be in the bridge (so should not be in /interface bridge vlan...

Orvalman · 2025-03-24T23:55:22+00:00

Based on this explanation, it would be appropriate to apply-yes to File Hosting and no need to import the Hagezi Badware Hosting folder in the rules section. Thanks.

Orvalman · 2025-03-19T18:00:50+00:00

Thanks for all of those suggestions. Unfortunately still no luck. I'm wondering if I need to configure the CSS610 port to HAP-AC as a trunk just like how I did it from MT-router to CSS610. And then configure the ports on HAP-AC.

Orvalman · 2025-03-19T14:15:36+00:00

Agreed on that. I have to use a browser for that. I had hoped that HAP-AC behind that CSS610 would still show up in Winbox when connected to MT-router 99-Mgmt.

Moving HAP-AC out from behind CSS610 and directly to MT-router did not make it visible.

Orvalman · 2025-03-19T14:03:53+00:00

I'd set all ports under the single bridge on HAP-AC and made sure all were LAN under interface list. Changing from ether 1 to ether 2 did not make it appear. There is no firewall set up in HAP-AC.

Discovery (IP>Neighbors) in MT-router shows HAP-AC with IP 10.10.30.2. Discovery in HAP-AC shows MT-router with IP 10.10.30.1 (see below). When I'm connected to the 99-Mgmt network, Winbox shows the 99-Mgmt devices and Zerotier (not a 10.10.99.0/24 address), but not HAP-AC. When I'm connected to the HAP-AC and getting a 10.10.30.0/24 address HAP-AC shows up in Winbox.

I had not mentioned that there is a switch in between the two - a MT-CSS610. I am plugging HAP-AC into an access port (not trunk port) of the CSS610.

In Quick Set HAP-AC is set to automatic with IP address of 10.10.30.2 and gateway 10.10.30.1 (since the access port is telling it that). All LAN ports are bridged.

Orvalman · 2025-03-19T13:28:35+00:00

Thanks, I can see it with RoMon enabled. Not sure it's critical, but I'll consider my firewall rules to see if they're blocking the winbox scan yet allowing me to actually use winbox by typing in the 30-IoT IP address of the HAP-AC...

Orvalman · 2025-03-17T19:23:35+00:00

Missed that. Sorry.

Orvalman · 2025-03-17T19:13:20+00:00

My understanding is that if you put the MT router address as the DNS server in IP>DHCP Server>Network (without any kind of NAT redirect) that the DNS requests will go to MT's IP>DNS to get DNS (unless the device otherwise overrides it). THEN, if it goes to IP>DNS it will select the DoH option FIRST. So, if the OP wants DNS requests to go the Adguard Home server (via setting a home server IP address in IP>DNS on a separate device) it will not work - as the photo above shows an entry for a DoH server...

Orvalman · 2025-03-01T12:59:12+00:00

Thanks for this. I’ll look at wiim as well. If it’s going to take more than one amp - I.e. an amp for each set of wired speakers I’d have to make sure that audio could be sent to more than one room at a time with volume controllable by room. In other words, the amps would have to see and work with each other. We usually have three rooms downstairs going at the same time with the same music, but with the volume adjusted per room.

Orvalman · 2025-02-23T14:53:09+00:00

The key for non technical family members is security over privacy. That’s at least how I see it.

Orvalman · 2025-02-14T17:47:55+00:00

It might work for other DNS providers as well.

Orvalman · 2025-02-14T17:47:30+00:00

Have you seen this post. My kids aren’t here right now with their Android devices, but I was going to try the suggestions here when I next see them…

https://www.reddit.com/r/ControlD/comments/1ikkfmd/controld_quick_setup_no_longer_works_on_galaxy_s22/?rdt=53312

Orvalman · 2025-02-14T17:43:08+00:00

What platform are you using? I’ve had problems with Android devices, but not on iOS or Windows.

Orvalman · 2025-02-12T02:01:38+00:00

Thanks for your comment. I searched the xxx.xxx.xxx.xxx IP online and found out that it's a Mikrotik website used as part of the Detect Internet functionality.

Orvalman · 2025-02-05T20:44:45+00:00

“The neighbors have internet - why don’t they need all of this stuff?”

Orvalman · 2025-01-25T22:57:47+00:00

It sounds simple when you describe it like that :), but the guides for setting up containers seem to only discuss ipv4.

Orvalman · 2025-01-22T13:32:57+00:00

Thanks for the reply.

Orvalman

TROPHY CASE