{ pkgs, ... }: {
  networking.firewall = {
    allowedTCPPorts = [ 53 ];
    allowedUDPPorts = [ 53 ];
  };
  services.dnsmasq = {
    enable = true;
    alwaysKeepRunning = true;
    settings = {
      addn-hosts = [
        "/etc/hosts"
        (pkgs.stevenblack-blocklist + "/hosts")
      ];
      server = [
        "1.1.1.1"
        "1.0.0.1"
        "8.8.8.8"
        "8.8.4.4"
      ];
    };
  };
}