# GladNoAd — Owner's Guide

*Firmware v1.14*

A DNS filter for your whole network. Every device in the house asks GladNoAd for
directions, and it quietly refuses to answer for ad, tracker and telemetry servers —
no app, no browser extension, nothing to install on your phone or TV.

---

## 1. Set it up

Ten minutes, once. You'll need the device powered on and a phone or laptop nearby.

1. **Power it on and read the screen.** A new unit starts in setup mode: the screen
   shows a QR code, the network name `GladNoAd-Setup`, and a four-digit **setup PIN**.
   The PIN changes every time setup mode starts, so use the one on screen right now.

2. **Join the `GladNoAd-Setup` network.** Scan the QR code with your phone's camera, or
   connect to the open Wi-Fi network named `GladNoAd-Setup` by hand. A setup page
   should open by itself; if it doesn't, open a browser and go to any address and
   you'll be redirected.

3. **Enter the PIN and pick your Wi-Fi.** Type the PIN from the screen, choose your
   home network from the list, and enter its password. The PIN is there so a neighbour
   can't configure your device from the driveway.

4. **Leave Network Address on _Automatic_.** Automatic is right for almost everyone.
   The device asks your router for an address, then keeps that same address every time
   it restarts — which matters, because you're about to tell your router to send DNS
   there. Only choose Manual if you need a fixed address of your own choosing.

5. **Leave Timezone on _Auto-detect_.** The device works out your timezone the first
   time it gets online. It needs the right local time because it updates itself at
   3:00 AM. You can change it later.

6. **Save & Reboot.** It restarts and joins your network. The screen now shows the
   address it settled on, something like `192.168.1.240`. Write it down — that address
   is both where you'll manage the device and what you'll give your router next.

7. **Change the admin password.** Open the address in a browser. It asks you to sign
   in: the username is `admin` and the password starts as `admin`. Go to **Advanced
   System Settings → System Settings**, type a new password into *New Admin Password*
   and click **Change Password**. The browser will ask you to sign in again with the
   new one.

> Setup mode doesn't time out. If you open it by mistake and want to leave without
> changing anything, unplug the device and plug it back in.

## 2. Point your network at it

GladNoAd can't block anything until your devices actually ask it.

**Everything at once (recommended).** In your router's settings, find the DNS server
fields — usually under LAN, DHCP or Internet — and set the primary DNS server to your
GladNoAd's address. Save, then restart your router. Every phone, laptop, TV and smart
plug in the house is now filtered, including devices you can't install anything on.

**One device at a time.** If you'd rather test first, set the DNS server manually in a
single computer's or phone's Wi-Fi settings.

> **Reserve the address in your router.** While you're in there, find the DHCP
> reservation or "static lease" list and pin GladNoAd's address to it. It shows up in
> your router's list of connected devices as **GladNoAd**. The device works hard to
> keep the same address on its own, but a reservation makes it certain — and if the
> address ever changed, your router would keep sending DNS to somewhere that isn't
> listening.

Give it a few minutes, then load a news site or open a free mobile game. The difference
is usually obvious.

## 3. The dashboard

Open the device's address in any browser on your network and sign in as `admin`. The
screen on the unit always shows you what the address is.

Some networks also let you reach it by name at `gladnoad-<serial>.local` — the serial is
printed on the unit and shown under **System Health**. It's a convenience; if the name
doesn't resolve on your network, the address always works.

The dashboard has a menu down the left side:

| Page | What it's for |
|---|---|
| **Connected Devices** | Every device on your network, with its name and protection policy. |
| **Telemetry Rules** | What *frictionless* devices are allowed to reach. |
| **Blocklist Categories** | Which kinds of domains are blocked, plus blocklist updates and backups. |
| **Advanced System Settings** | Live activity, your own block and allow lists, network settings, password, SafeSearch and health. |

Clicking the **GladNoAd** logo opens gladnoad.com in a new tab. From Advanced System
Settings, **← Back to Modern Dashboard** returns you to the main menu.

## 4. What it blocks

Open **Blocklist Categories**. Blocking is grouped into categories you can switch on
and off independently. A change takes effect immediately for every device — there's no
save button and nothing restarts. Factory settings:

| Category | Default | What it covers |
|---|---|---|
| Ads & Trackers | **ON** | The core protection. Ad networks, analytics and tracking scripts. |
| Malware & Phishing | **ON** | Known malicious and scam domains. Very low risk of breaking anything. |
| Smart-TV ACR & Ads | **ON** | Screen-content tracking and TV ads. Samsung, LG and Vizio honour your DNS; Roku often uses its own, so results there are partial. |
| Amazon Device Telemetry | **ON** | Fire TV ads and Echo background reporting. Voice commands still work. |
| IoT Device Telemetry | **ON** | Phone-home traffic from Xiaomi, Huawei, Vivo and OPPO/Realme gear. |
| Adult Content | off | Adult sites. Partial by nature — a device using its own encrypted DNS bypasses it. |
| Apple Telemetry & Ads | off | Off because iCloud Private Relay routes around it on most iPhones anyway. |
| Windows/Office Telemetry | off | Off because Microsoft retries aggressively; check Office sync still works before leaving it on. |

Each category card carries a short note about how effective it really is and what it
might break, plus how many domains it currently holds. They're written honestly — where
a category is partial, it says so.

The panel at the top of the page shows the **Blocklist version** currently loaded, when
the device **last checked** for a new one, and three buttons:

* **Allowlist** and **Blocklist** download *your own* rules as text files (see
  [Updates & backups](#9-updates--backups)). They don't download the category lists.
* **Check for updates** fetches the latest blocklists right now instead of waiting for
  tonight. It takes a minute or two; the result appears under the version when it's
  done.

> **Very occasionally a site is blocked that appears on no list.** The filter is stored
> in a compact form that trades a tiny, known error rate for fitting millions of domains
> on a small device. If a site breaks and you can't find a reason for it, that's the
> likely cause — allowlist it and move on.

## 5. Your devices

Open **Connected Devices**. It lists everything on your network that has asked
GladNoAd a question, with its IP address and protection policy.

**Names.** GladNoAd tries to put a real name on each device without any help from you:
the name a device announces when it joins the network, or the name it broadcasts for
services like AirPlay. Names arrive over hours rather than instantly, because devices
only announce themselves occasionally. Something that shows as `Device .42` today may
name itself by tomorrow — and some never do.

**To rename a device**, click its name, type a new one and press **Enter** (or **Esc** to
cancel). A name you set is never overwritten.

**Policy.** Every device starts in **Strict Mode**. Click **Change Policy** to switch it
to **Frictionless** (shown in orange), and again to switch it back. See the next section
for what frictionless means.

> Devices are recognised by their IP address. If your router hands a device a new
> address, it reappears as a new entry and its name and policy don't follow it. For
> anything you've renamed or made frictionless, add a DHCP reservation in your router
> the same way you did for GladNoAd itself.

## 6. Frictionless mode and Telemetry Rules

Some devices break when they can't phone home — a work laptop that stops syncing
Office, an iPad whose iMessages arrive late, a streaming app that refuses to load.
Rather than weaken filtering for the whole house, put just that device in
**Frictionless** mode.

A frictionless device is still filtered for ads, trackers and malware. The difference is
that the services you've enabled on the **Telemetry Rules** page are always let through
for it — even if a category or your own blocklist would otherwise block them.

| Rule | Default | Always lets through (frictionless devices only) |
|---|---|---|
| Microsoft Office & Windows Update | **ON** | `microsoft.com`, `windowsupdate.com`, `live.com`, `office.com` |
| Apple Ecosystem (iCloud / Push) | **ON** | `apple.com`, `icloud.com`, `cdn-apple.com` |
| Smart TV Trackers | off | Samsung, Netflix, Hulu, Roku, Amazon and Prime Video domains |

Each rule covers the listed domains and everything under them. The rules do nothing for
devices in Strict Mode, and turning a rule off affects every frictionless device at
once.

## 7. Advanced System Settings

This is where the day-to-day detail lives. Every section can be collapsed or expanded by
clicking its header, and the page remembers which ones you've closed. The number next to
each header is how many entries it holds.

### At a glance

Four numbers across the top: **Queries** and **Blocked** since the last restart, the
**Block Rate** as a percentage of all queries, and **Uptime**. A block rate between 10%
and 40% is normal for a household; it climbs sharply if you have smart TVs. The device
restarts itself every night (see [Updates & backups](#9-updates--backups)), so these
count from roughly 3:00 AM.

### Live activity

* **Recently Blocked** — the last 20 domains refused, newest first, each with the
  address of the device that asked and a coloured tag showing which category blocked it
  (`custom` means your own blocklist). If a site you wanted just broke, it's almost
  certainly here. Click **Unblock** to allow it permanently.
* **AI / DGA Suspects Caught** — up to 50 domains the pattern detector found suspicious:
  names with long runs of digits or consonants, which is how malware generates throwaway
  addresses. These are **flagged, not blocked** — it's a watch list. If one is
  legitimate, click **Safe (Allow)** to clear it and stop it being flagged. If one looks
  genuinely bad, find it in Recently Allowed and click **Block**.
* **Recently Allowed** — up to 2,000 recent domains that got through. Spot an ad server
  sneaking past? Click **Block**.

Every entry also has a **Research** button, which opens a web search for that domain so
you can see what it is before deciding. To act on several at once, tick their boxes (or
**select all**) and use the button at the top of the list — **Unblock Selected**,
**Allow Selected** or **Block Selected**.

These lists live in memory, so they start fresh after every restart. If something broke
yesterday, reproduce the problem and then look.

### Network Config

* **Upstream DNS** — where GladNoAd sends the questions it doesn't block. It starts as
  `1.1.1.1` (Cloudflare). You can enter any other resolver's IP address, such as
  `9.9.9.9` or `8.8.8.8`. Don't enter your router's address if your router is sending DNS
  to GladNoAd — the two would just ask each other.
* **Timezone** — used for the 3:00 AM update and the times shown in the dashboard. It's
  set automatically during setup; change it here if it's wrong or you move.

Click **Save** after changing either.

### System Settings

* **Blocklist Date** — the version of the blocklists currently loaded.
* **OTA Update** — the same as **Check for updates** on the Blocklist Categories page.
* **Enable SafeSearch** — forces Google, Bing, DuckDuckGo and YouTube into their strict,
  filtered modes for every device on the network — something a browser setting can't do
  and a child can't switch off. It's **off** until you turn it on; the button then
  reads **Disable SafeSearch**. SafeSearch stays on during guest mode.
* **Change Password** — sets a new admin password.

### Your lists

* **Custom Manual Blocklist** — every domain you've blocked. **Unblock** moves an entry
  to your allowlist.
* **Custom Manual Allowlist** — every domain you've allowed. Type a domain into the
  field and click **Add** to allow something you already know you want, or click
  **Remove** to return an entry to normal filtering.

See [Your own rules](#8-your-own-rules) for how entries are written.

### System Health and Boot / Reboot History

**System Health** shows the unit's serial number, firmware version, uptime, memory and
Wi-Fi signal strength. **Boot / Reboot History** lists every restart and why it happened;
a nightly restart every morning is normal. Entries marked in red are crashes — if you
see those repeatedly, contact support and include this list.

Two protections run constantly and need no configuration: the built-in essential
services list (next section), and **rebinding protection**, which stops a hostile website
from using your browser to reach your router or cameras.

## 8. Your own rules

Two lists you control, both of which override the categories. The allowlist always wins.

How you write an allow entry decides how much it covers:

* `.example.com` — the leading dot means **the domain and everything under it**:
  `ads.example.com`, `cdn.example.com` and so on.
* `example.com` — no dot means **exactly that name** and nothing beneath it.

Use the dotted form when a service is spread across many subdomains, and the exact form
when you want to unblock one specific host without opening up the rest. Blocked entries
always cover subdomains.

The fastest way to fix a broken site is not to type anything: find it in **Recently
Blocked** and click **Unblock**. Blocking works the same way — there's no field for
typing a domain to block, so find it in **Recently Allowed** and click **Block**.

A small set of essential services can never be blocked, whatever the lists say —
captive-portal checks, time servers, push notifications and certificate checks. Without
those, phones decide they're offline and secure connections start failing, so the device
protects them from your rules and from its own.

## 9. Updates & backups

Blocklists refresh themselves. You don't need to do anything.

Every night at around **3:00 AM** local time the device fetches the latest blocklists,
loads them, and then restarts itself once to start the day fresh. The restart takes
under a minute; DNS pauses while it happens, which at that hour nobody notices. The
Blocklist Categories page shows the version loaded and when it last checked, and **Check
for updates** is there if you'd rather not wait. A manual check doesn't restart
anything.

The device reports only its serial number, firmware version and blocklist version when it
checks in. Your queries stay on your network — the whole point of running this in your
house rather than using someone else's resolver.

Before a factory reset, or any time you've built up rules worth keeping, save your lists
as text files: **Allowlist** and **Blocklist** on the Blocklist Categories page, or
**Export Allowlist** and **Export Blocklist** in Advanced System Settings (same files).
There's no automatic backup; those buttons are it.

## 10. The buttons and screen

**Short presses** control the screen. `B1` steps through four screens:

1. **Home** — the device's address, queries, blocked count and block rate.

2. **Last blocked** — the most recent domain refused.

3. **Status** — Wi-Fi signal, blocklist size and date, uptime.

4. **Network** — address, gateway and subnet.

`B2` turns the screen off. The screen also goes dark by itself after a minute; any button
press wakes it.

**Timed holds** do everything else. The screen counts down while you hold. **Let go
early and nothing happens** — neither reset can fire by accident.

| Hold | For | Does |
|---|---|---|
| `B1` | 2 seconds | **Guest mode** — filtering off for 5 minutes |
| `B2` | 3 seconds | **Setup mode** — reopens `GladNoAd-Setup` to change Wi-Fi |
| `B1` | 10 seconds | **Reset Wi-Fi & password** — keeps your lists and device names |
| `B1` + `B2` together | 10 seconds | **Factory reset** — erases everything you configured |

**Guest mode** stops filtering entirely for five minutes — for when a guest's app refuses
to work and you'd rather not debug it at a dinner party. A yellow banner counts down on
the screen. Hold `B1` for 2 seconds again to end it early; otherwise it expires on its
own.

**Setup mode** reopens the `GladNoAd-Setup` network with a new PIN. Use it when you change
Wi-Fi networks or passwords. Your lists and device names are untouched. Filtering stops
until you finish setup, or unplug and replug the device to cancel. Leaving Network Address
on Automatic here also lets the router pick a new address, just like a reset (see the
note below).

**Reset Wi-Fi & password** clears the Wi-Fi details and puts the admin password back to
`admin`, but **keeps** your blocked and allowed domains and all your device names. Your
other settings — category choices, telemetry rules, SafeSearch, upstream DNS and
timezone — go back to factory defaults. This is the one to use if you're locked out.

**Factory reset** erases everything you configured: Wi-Fi, password, settings, custom
lists, device names and reboot history. Use it before passing the device to someone
else. The blocklists themselves stay, so it still filters out of the box.

> **Both resets also forget the device's network address.** After either one, GladNoAd
> takes whatever address your router offers when you run setup again, and that is often
> **not** the address it had before. Your router is still sending DNS to the old address,
> so until you fix it, websites may stop loading for the whole house. When setup finishes,
> check the address on the device's screen. If it changed, either put the old address back
> (a DHCP reservation in your router, or hold `B2` for 3 seconds to rerun setup and choose
> **Manual** under Network Address), or change your router's DNS setting to the new one. With a DHCP reservation in place
> this never happens: the router always hands GladNoAd the same address.

## 11. If something breaks

**A website or app stopped working.** Open **Advanced System Settings → Recently
Blocked** — it's nearly always at the top. Click **Unblock** and reload. If you're not
sure which entry caused it, turn on guest mode (hold `B1` for 2 seconds) to disable
filtering for five minutes; if the problem vanishes, it was GladNoAd, and the blocked
domain will be in that list. If it's one device that keeps having trouble with Microsoft,
Apple or a streaming app, set that device to **Frictionless** instead.

**Nothing seems to be blocked at all.** Check the Queries counter in Advanced System
Settings, or on the unit's home screen. If it isn't climbing, your devices aren't asking
GladNoAd — the DNS setting in your router hasn't taken effect, so restart the router
after changing it. Some routers also force all DNS traffic to themselves; look for a
setting named *DNS redirect*, *force DNS* or *DNS interception* and turn it off. Also
check that the categories you expect are switched on under **Blocklist Categories**.

**Ads still get through on some devices.** Look at the router's *secondary* DNS
setting. If it's set to a public resolver, many devices use it whenever they like — not
only when GladNoAd is down — and those queries aren't filtered. Browsers with "secure
DNS" or "DNS over HTTPS" turned on, and iPhones using iCloud Private Relay, also bypass
it.

**I can't reach the dashboard.** The device's address is on its screen — press a button
to wake it. If that address doesn't load, your router may have given it a different one;
a DHCP reservation prevents this permanently.

**The internet stopped working right after a reset.** The reset made GladNoAd forget its
address, and setup gave it a new one (see the note under section 10). Your router is still
sending every DNS request to the old address, where nothing answers. Read the new address
off the device's screen, then either give GladNoAd its old address back (a DHCP reservation
in your router, or hold `B2` for 3 seconds and rerun setup with Network Address set to
**Manual**), or change your router's DNS setting to the new address. Add a DHCP
reservation so it can't happen again.

**I forgot the admin password.** Hold `B1` for 10 seconds to reset Wi-Fi and password.
The password goes back to `admin` and you'll need to run setup again, but your lists and
device names survive.

**A device shows as "Device .42".** It hasn't announced a name yet. Some devices only do
so when they rejoin the network, so it can take a day, and some never do. Click the name
and rename it yourself — your name sticks permanently.

**A renamed device lost its name or policy.** Its IP address changed, so it appeared as a
new device. Reserve an address for it in your router, then rename it and set its policy
again.

**The internet stops working whenever GladNoAd restarts.** If you'd rather lose
filtering than connectivity during those moments, set your router's *secondary* DNS to a
public resolver such as `1.1.1.1`. It's a trade-off: as described above, some devices
will then skip GladNoAd part of the time even when it's running.