Can't get pfBlockerNG to block pornhub.com

[Sergei_Shablovsky]

@JonathanLee said in Can't get pfBlockerNG to block pornhub.com:

@Sergei_Shablovsky I use proxy based blocking with certificates, the firewall can be set to inspect VPN tunnels also in advanced settings in pfSense or Snort. VPNs are not invincible by any means. Again proxy or dns blocking is not invincible also. Just depends on the amount of time it takes to get around the firewall. I think with the proxy it makes it take longer to get around it. You can make it block the ports that the VPN are using also, the free ones will always use the same ports, control access to that port…

I thinking that would be interesting for You to read https://github.com/clostra/newnode/blob/master/docs/newnode-spec.md

Just try on test iPhone/Android: connect to Your customers lan, install NewNode app, start pcap on an certain interface, and then try to connect to PH.
If pfSense able to block access, - You are win, I’m loose. If not - analyse the dump by WireShark and create additional FW rules…

NewNode VPN
https://apps.apple.com/us/app/newnode-vpn/id1473074621

NewNode
https://apps.apple.com/us/app/newnode/id1603136752

[JonathanLee]

@Sergei_Shablovsky said in Can't get pfBlockerNG to block pornhub.com:

https://github.com/clostra/newnode/blob/master/docs/newnode-spec.md

Thanks for the info, I will have to get a sandbox going to test this, I am doing classes again so I might not have time anytime soon.

[JonathanLee]

@Sergei_Shablovsky

Hello again, I got some time, I am spinning up a VM to test it.

My CAL 2 class HW done, and checked, and POLS quiz done.

Just waiting for my one approved VM copy to download per my original Apple software license. I get one VM of the software to use onto of the host software.

That software package says it stops host services so I want it in a sandbox/vm to test.

3-4 hrs for my vm to fully spin up I estimate. I am betting on AppID to spot it.

[JonathanLee]

@Sergei_Shablovsky I have attempted 2 different installs over Virtualbox Version 7.0.8_BETA4 r156879 (Qt6.3.0) on M1 processor, all crash with the development version. I am going to create an ISO and move it to my Windows 11 system and install the VM there I should be able to test this sometime tomorrow. Sorry I even tried Unbuntu with M1 virtualbox. It acts like the iMac has something using the virtualization hardware.

[JonathanLee]

@Sergei_Shablovsky All right I got my VM system spun up. I am going to test this now it is set up with proxy use and blocking is good inside VM

I just have to install the VPN to test it now

Dang they even blocked me from using apple store in the vm

I am going to have to find another way to download it... The virtual machine I want to test this on has download limitations.

Again my proxy works now so I am only one download away from using the VM for its cybersecurity test after I can delete it.

I can not test this on the native os because it has a script that disables all services on the machine if you look at the GitHub. So it has to be in a sandbox environment, however my sandbox does not allow any App Store use. So I need the .dmg file somehow...

So how can I get the APP inside the VM if I can't get to the App Store?

I am working on side loading it now

[JonathanLee]

@Sergei_Shablovsky I am going to git hub clone it

My concern is the apple store version could be different.

[JonathanLee]

@Sergei_Shablovsky Sorry but....

Netgate WON with the correct ACLs access rules. My firewall already has Newnode's VPN port blocked..

VPN connection is dead on first test Netgate stomped it out.

I got it installed and it started however will not connect because the firewall blocks access to ports it wants. It's not approved with proper Access Control Lists NewNode is not an issue, however this is dependent on someone that can configure a ACL list correctly, many home users do the default so this would work with default settings.

For now it is blocked on my VM test. I am going to spin down and delete this VM

This is a scary VPN it disables the native firewall on osX also...

[Sergei_Shablovsky]

@JonathanLee said in Can't get pfBlockerNG to block pornhub.com:

@Sergei_Shablovsky I am going to git hub clone it

My concern is the apple store version could be different.

I know from developer’s side, that GutHub and iOS/macOS versions are a little bit different.

But not too much.

[Sergei_Shablovsky]

@JonathanLee said in Can't get pfBlockerNG to block pornhub.com:

@Sergei_Shablovsky Sorry but....

Netgate WON with the correct ACLs access rules. My firewall already has Newnode's VPN port blocked..

VPN connection is dead on first test Netgate stomped it out.

I got it installed and it started however will not connect because the firewall blocks access to ports it wants. It's not approved with proper Access Control Lists NewNode is not an issue, however this is dependent on someone that can configure a ACL list correctly, many home users do the default so this would work with default settings.

Is it possible for You to test both NewNode and NewNode VPN on Your iPhone?

[JonathanLee]

@Sergei_Shablovsky The only way would be to create a virtualization instance of the iPhone, I can look into it. Can I ask why? Any iPhone can simply turn off WiFi to bypass the firewall.

[Sergei_Shablovsky]

@JonathanLee said in Can't get pfBlockerNG to block pornhub.com:

@Sergei_Shablovsky The only way would be to create a virtualization instance of the iPhone, I can look into it. Can I ask why? Any iPhone can simply turn off WiFi to bypass the firewall.

I try to understand if NewNode in VM has different behavior than NewNode app/VPN in real iOS device.

[JonathanLee]

@Sergei_Shablovsky I can't help you with that I can only test with a virtual machine. The risk is too high to test on a live machine, sorry.

[Sergei_Shablovsky]

@JonathanLee said in Can't get pfBlockerNG to block pornhub.com:

@Sergei_Shablovsky Can I ask why? Any iPhone can simply turn off WiFi to bypass the firewall.

For situation where cell signals blocked and only in-house WiFi or wire are an options.

[JonathanLee]

@Sergei_Shablovsky they have virtual phone software for Android, Palm Pre, and many others they should also have one for iPhone I just got to find an official one.

[Sergei_Shablovsky]

@JonathanLee said in Can't get pfBlockerNG to block pornhub.com:

@Sergei_Shablovsky I can't help you with that I can only test with a virtual machine. The risk is too high to test on a live machine, sorry.

Anyway THANK YOU for help and understanding!
Have a nice sunny day!

[JonathanLee]

@Sergei_Shablovsky Do you know of a way to virtualize iOS ? Palm Pre use to do this with virtual box...