I found an interesting summary on a wiki that Youtube "right to repair" enthusiast Louis Rossman put up. He suggested I could use a hardware firewall and pfSense as a firewall, and use pfSenseNG as an ad blocker. Or use OPNSense as a similar alternative. Seems like it would be easy to set up, but it only runs on the hardware supported by BSD. (I'm sure the developers and maintainers of BSD are super-busy and cannot support every single piece of hardware out there, so I can't fault them.)

The trick, apparently, is to "assign IP address lists from sites like I-blocklist...