I use a chrooted instance of Bind as it's a LAN only dns server, /etc/bind/named.conf includes:
include "/etc/bind/adblock.conf";
That file is generated by a script that uses a hosts file maintained on
http://someonewhocares.org/hosts/
the script is something like:
#!/bin/bash
cat /etc/bind/adblock.conf | xz -z - > /etc/bind/adblock.conf-$(date "+%Y%m%d-%H%M%S").xz
echo "" > /etc/bind/adblock.conf
curl -o - http://someonewhocares.org/hosts/ | sed -rn 's:^127\.0\.0\.1 ([^ #\t]+).*$:\1:p' > /tmp/addrs.txt
cat /tmp/addrs.txt | while read line; do
! egrep -i $line /etc/bind/whitelist.txt >/dev/null \
&& echo 'zone "'${line}'" IN { type master;notify no; file "/etc/bind/pri/adblock.zone";};' >> /etc/bind/adblock.conf
done
which can be called from cron or similar (if you do you need to reload/SIGHUP bind to reload its condiguration)
you can whitelist stuff by adding a FQDN to /etc/bind/whitelist.txt
The file /etc/bind/pri/adblock.zone contains something like:
@ 1 IN SOA localhost. root.localhost. (1000 7200 120 1209600 3600)
@ 259200 IN NS localhost.
* 259200 IN A X.X.X.X
@ 2 IN A X.X.X.X
where X.X.X.X is an IP on different (but private and not internet routable) subnet, and iptables rules
something like:
iptables -N DNSBLACKHOLE
iptables -A DNSBLACKHOLE -j LOG --log-prefix "DNSBLACKHOLE ::"
iptables -A DNSBLACKHOLE -j REJECT
iptables -A OUTPUT -p all -d X.X.X.X -j DNSBLACKHOLE
iptables -A FORWARD -p all -d X.X.X.X -j DNSBLACKHOLE
Transparent proxying is accomplished by iptables rules redirecting port 80 and 443 through SQUID which essentially performs
a MITM, you can find out how to do this here:
http://blog.davidvassallo.me/2011/03/22/squid-transparent-ss...
Edit: it's also worth mentioning I transparently redirect all DNS traffic the router sees to my own bind instance, so untrusted devices are unable to use an alternative dns server.