I´m running a VPN service on Debian(for a few friends) as kind of like a self learning project to gather more experience running a secure and highly available service.
At the moment OpenVPN pushes opendns servers to the clients and clients route all traffic through my server. I would like to implement some kind of Tracking-Block, like a list of know domains/IPs that are used by ad or tracking services (yes I know the list apporach is far from good) that automatically gets blocked for the user when running the VPN. So if user A would for example visit a website shadycompany.com/wedotrackingforaliving that loads various js which connects to one of the domains in my list, the traffic will not be forwared or just dropped.
Thinking about this left me with 2 valid options:
Use dnsmasq aliases on all domains to reroute all dns querys that contain a domain from the list to localhost
Simply reroute to localhost via the hosts file
So my question is, are there any limitations to either method? Like max. number of rules, performance (https://serverfault.com/a/759896 - considering stated delay for hosts file lookups as
(O(log2(n)), considering the list contains around 50000 entries atm) or security wise (bypassing dns etc.?).
Is there any best practice for such blocking that is better than the dnsmasq and host file approach?