Whilst this may seem very vague (answer), it is intended to be viewed by others with different ISP (Internet Service Providers), and their equipment.
Depending on how you want to broach the subject (in terms of complexity) would determine how you implement this. My first suggestion is the use of OpenWRT, which may or may not be supported on your device. From here we can use the Netfilter options readily available.
Note: This method will require some knowledge of IP Tables and the CLI. For example, the following lines added will allow DNS requests incoming on a specific TCP Port:
root@openwrt:~# iptables -A INPUT -j ACCEPT -p tcp --dport 53 #------------------- accept incoming packets on tcp port 53 (DNS)
DD-WRT is a "fork" of OpenWRT and it is recommended to be implemented for users not as "Tech-Savy" as others. The following are examples of how you could achieve this:
For the sake of clarity, here are related links outlining DD-WRT vs. OpenWRT (they are different firmwares):
It is my recommendation, you should install a secondary router onto your LAN, and edit this; not the ISP stock-provided unit.
Now that OpenWRT and DD-WRT are highlighted, we can move onto other options available to you should you not want this.
Network-wide ad blocking via your own Linux hardware
My recommendation might incur a requirement to operate a Raspberry Pi (and
SSH to it). Essentially you make your router use the
Pi's IP Address as the DNS query, and from there you can block/poison DNS requests - commonly coined 'DNS Spoofing'.
You can read up on this Reddit Post about blocking sites (this one relates to adult content), and even look at this tool for editing your block list.