I wouldn’t be surprised if in most cases it’s $100 in $1 out.

on individual level for basic things I found hooks pretty good, you can block tool executions easily.

I think here the question will be how to scale rules on team level.

Obviously sandboxing will be needed if we want proper gates.

I had the same problem, browser extensions weren't enough, and I wanted something system-wide. So I built Sinkzone [1], a DNS tool that blocks everything unless allowlisted. It’s open-source and works across OSs. Thought it might be helpful if you're looking beyond NextDNS.

[1] https://github.com/berbyte/sinkzone

Thank you for the idea, I've created an issue: https://github.com/berbyte/sinkzone/issues/1

<3

I'm not familiar with this project, just checked their GitHub Readme and if I understand correctly they block what you want them to block. Sinkzone does the opposite, it allows what you want to allow, and blocks everything else.

Well, you can block everything using a wildcard blocking rule (for that, go to "Filters → DNS blocklists" and add this custom rule: ||*^ ) and then you can allow the domain (and subdomains, if needed, for instance "everything.ycombinator.com"; for that, go to "Filters → Allowlist" and add this: @@||ycombinator.com^ )

Alternatively, you can do something like this: *$denyallow=example.org|example.com

Blocks everything except example.org and example.com.

Works in AdGuard Home, AdGuard DNS or any other AG product with DNS filtering capabilities: https://adguard-dns.io/kb/general/dns-filtering-syntax/

I'm planning to address the issue for phones as well in the future.

I built a DNS resolver on Proxylity[1] as a demo but it didn’t occur to me that block by default was a use case. I might have to add that.

My suggestion: Allow by ASN would be a clean (simple) way to get all of Google, etc., allowed at once.

[1] https://github.com/proxylity/examples/tree/main/dns-filter

I've used https://github.com/StevenBlack/hosts myself for a few years, I think this is a fantastic collection for hosts based blocking.

You can configure your upstream resolvers in the config, so I think Sinkzone can be placed in front of your VPN's resolver. I never tested this to be honest.

It's on my list :)