Set Up System‑Wide Ad Blocking on Android with Nebulo (No Root)

Before you start

Installing Nebulo does not require root, but it does need a stable internet connection and the ability to grant the app a VPN‑style permission. Make sure your device is charged to at least 50 % or keep it plugged in, and back up any custom DNS settings you may have configured previously (e.g., in Settings > Network & internet > Private DNS). This backup can be a simple screenshot – you’ll need it if you ever want to revert.

Why DNS‑Based Ad Blocking Works

Most ads are served from a handful of well‑known domains (e.g., ads.google.com, doubleclick.net). A DNS resolver translates a domain name into an IP address before the traffic leaves your device. By pointing your DNS queries to a resolver that returns a “null” address for known ad domains, the request never reaches the ad server, and the ad never appears.

Unlike per‑app blockers that rely on accessibility services, DNS‑based blocking works for every network‑enabled app – browsers, games, streaming clients, and even system‑level webviews. The trade‑off is that it cannot block ads that are embedded directly in the app package (e.g., hard‑coded banner images). For the vast majority of users, the reduction in visible ads and data usage is worth the small chance of a few missed ads.

About Nebulo

Nebulo is a lightweight Android app that acts as a local VPN tunnel and forwards DNS queries to a resolver of your choice. It ships with a curated list of ad‑blocking DNS providers (including AdGuard DNS and NextDNS) and lets you add custom servers. Because it uses Android’s built‑in VPN API, it does not require root, and the system treats it like any other VPN – you’ll see a key icon in the status bar while it is active.

The app also offers per‑app whitelisting, IPv6 support, and a built‑in test page to verify that the blocker is functioning. All of these features make Nebulo a solid choice for a “set‑and‑forget” ad‑blocking solution.

Step 1 – Install Nebulo

When you launch Nebulo for the first time you will be greeted with a short welcome screen that explains the VPN permission. Tap Continue to proceed.

Step 2 – Grant the VPN Permission

If the key icon does not appear, go to Settings > Apps > Nebulo > Permissions and ensure the “VPN” permission is enabled. Some manufacturers (e.g., Xiaomi’s MIUI) hide this under “Special app access”.

Step 3 – Choose an Ad‑Blocking DNS Provider

Nebulo offers several pre‑configured servers. For most users the AdGuard DNS (Family protection) profile provides a good balance of ad‑blocking and privacy.

When the server is active, Nebulo will automatically start filtering DNS queries. You can verify the active server by looking at the status line at the top of the app – it should read something like “Connected to AdGuard DNS (Family)”.

Step 4 – Enable Global Ad Blocking

At this point every DNS lookup on the device is routed through the selected resolver, and any domain on the resolver’s blocklist will resolve to 0.0.0.0 (or an IPv6 equivalent). Most browsers will instantly stop loading banner ads, and many free apps will lose their ad‑pop‑ups.

Step 5 – Whitelist Apps That Need Direct DNS

Some apps – especially banking or corporate VPN clients – perform DNS pinning or rely on custom DNS servers. If you notice a “Cannot connect” error after enabling Nebulo, try whitelisting the offending app.

Whitelisting is per‑app, not per‑process, so the app will always use the system DNS (usually your carrier’s) while Nebulo stays active for everything else.

Step 6 – Verify the Blocker Is Working

The easiest way to confirm that DNS‑based blocking is active is to visit a test page that lists known ad domains. Nebulo includes a built‑in test, but you can also use external sites.

If you still see ads, double‑check that the active server is the one you added in Step 3 and that the main switch is ON. Some browsers cache DNS entries; clear the browser cache or restart the app to force a fresh lookup.

Advanced Options – Custom Blocklists and DNS‑Over‑HTTPS

Nebulo allows you to point to any DNS‑over‑TLS (DoT) or DNS‑over‑HTTPS (DoH) endpoint. If you prefer a self‑hosted resolver (e.g., Pi‑hole) or a privacy‑focused service like Quad9, you can add it manually.

Custom blocklists are plain‑text files with one domain per line. Nebulo merges them with the built‑in list, so you can add niche ad providers that the default list might miss.

Troubleshooting

1. No internet after enabling Nebulo

• Cause: Some carriers block DNS‑over‑TLS on their network.
• Fix: Switch the server protocol to DNS‑over‑HTTPS (DoH) or use a plain DNS (port 53) from a trusted provider.
• Check: In Nebulo’s server settings, toggle “Use DoH” and enter a fallback DNS such as 8.8.8.8.

2. Certain apps still show ads

• Reason: The app may use hard‑coded IP addresses or a built‑in ad SDK that bypasses DNS.
• Work‑around: Install an app‑level blocker (e.g., Blokada) for that specific app, or consider a firewall solution like NetGuard.

3. VPN key icon disappears after a reboot

• Cause: Android does not automatically restart VPN‑style apps.
• Solution: Open Nebulo and toggle the main switch back ON. To automate, enable Start on boot in Nebulo’s Settings → Advanced.

4. DNS leaks – ads appear only on Wi‑Fi

• Explanation: Some devices have a separate “Wi‑Fi only” DNS setting that overrides the VPN.
• Fix: Go to Settings > Network & internet > Wi‑Fi > Tap your network > Advanced > IP settings → Static. Ensure the DNS fields are empty or set to the same provider you use in Nebulo.

When to Disable Nebulo

While Nebulo is safe for everyday use, there are scenarios where you may want to turn it off temporarily:

• Connecting to a corporate VPN that requires its own DNS resolution.
• Using a hotspot that forces a specific DNS server (some public Wi‑Fi networks block DoT/DoH).
• Troubleshooting a network‑related issue – disabling Nebulo isolates whether the problem is DNS‑based.

To disable, simply toggle the main switch off. The key icon disappears, and your device returns to the system‑default DNS configuration.

Summary and best‑practice checklist

• Install Nebulo from a trusted source (Google Play or F‑Droid).
• Grant the VPN permission – Nebulo only intercepts DNS, not data.
• Select a reputable ad‑blocking DNS server (AdGuard Family is a good default).
• Enable the global switch and verify with the built‑in test page.
• Whitelist any app that breaks after enabling Nebulo.
• Optional: add custom blocklists or point to a self‑hosted resolver for extra control.
• Periodically revisit the server list – blocklists are updated upstream.
• Use the troubleshooting section if you lose connectivity or see DNS leaks.

By following these steps you’ll enjoy a cleaner, faster Android experience without the need to root or flash custom ROMs. Nebulo runs in the background with minimal battery impact, and because it relies on DNS rather than deep packet inspection, it respects the privacy of your actual traffic while still keeping those unwanted ads at bay.