Block trackers and ads at DNS level
A filtering resolver is, underneath, a list of names. When the address being looked up is on the list, the answer does not come. Everything else is deciding which list each device in the house should use.
How a blocklist works
The resolver compares the queried name against known lists of ad and tracking domains. On a match it returns a null address, such as 0.0.0.0, or reports that the name does not exist. Either way the browser has nowhere to go and the request to the advertiser never leaves your network.
The advantage over blocking in the browser shows up in data use and speed: nothing is downloaded only to be hidden afterwards. The cost is that blocking now depends on lists kept by third parties, who have to maintain them and get them wrong all the time.
One profile per device beats a single rule
A house is rarely a single environment. A work laptop needs little filtering; a child's tablet needs a much stricter rule; a smart television would only need the minimum to work. One profile per device lets each one have its own.
A resolver installed on the router reaches everything connected to the network, but treats it all the same. To have separate profiles, the resolver needs to know who asked, which works with separate address ranges or with client identification over encrypted connections. That separation is what a paid service would build on.
Why the ads do not all disappear
Part of the advertising lives on third-party domains and does disappear with filtering. The other part is served from the same address as the site you are reading, and there is no name to block. The result is a page with no ad bar but with a gap left where it used to be.
Another reason is domain rotation: tracking services change address often, and the list always arrives a little late. There are also apps that use fixed addresses or carry their own resolution, ignoring what the device is configured to do. No list solves that on its own.