Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to block in Windows10 Telemetry with pfsense

    Scheduled Pinned Locked Moved Firewalling
    80 Posts 19 Posters 55.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      kripz
      last edited by

      @Caboosey:

      @2chemlud:

      Hi, any details where this list comes from?

      It appears the list comes from various people and have noticed it's also used in Spyboy Anti-Beacon program too.

      I found doing DNSBL as a quicker way to block Windows Telemetry on pfSense. I just setup my pfsense to use DNSBL, which is included in the latest package of pfblockerNG. I told my DNSBL to use as it appears to be updated often:
      https://raw.githubusercontent.com/WindowsLies/BlockWindows/master/hostslist

      Do you have a guide or basic steps on how to set it up? Never used either before. is DNSBL a preconfigured list found in pfblockerNG?

      1 Reply Last reply Reply Quote 0
      • RonpfSR
        RonpfS
        last edited by

        This is a good starting point https://forum.pfsense.org/index.php?topic=102470.0

        2.4.5-RELEASE-p1 (amd64)
        Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
        Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

        1 Reply Last reply Reply Quote 0
        • G
          garyn
          last edited by

          In topic 102470 (line above), look for reply #18 on Nov 20, 2015.  Reply #18 walks you through the setup.

          1 Reply Last reply Reply Quote 0
          • K
            kripz
            last edited by

            @garyn:

            In topic 102470 (line above), look for reply #18 on Nov 20, 2015.  Reply #18 walks you through the setup.

            @RonpfS:

            This is a good starting point https://forum.pfsense.org/index.php?topic=102470.0

            Thanks guys.

            In addition to the guide, id like to add that DNSBL is not seperate to pfBlockerNG, it must be enabled for DNSBL to be enabled. Spent 20 mins trying to figure out why DNSBL wouldnt work :D

            EDIT: Why does it take a few lookups for the IP to be blocked?

            [2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.msn.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 17580
;; flags: qr rd ra ; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; rad.msn.com.	IN	A

;; ANSWER SECTION:
rad.msn.com.	690	IN	CNAME	rad.msn.com.nsatc.net.
rad.msn.com.nsatc.net.	299	IN	A	111.221.29.189

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 472 msec
;; SERVER: 8.8.4.4
;; WHEN: Sat Jan 23 10:51:18 2016
;; MSG SIZE  rcvd: 80
[2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.msn.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 11622
;; flags: qr aa rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; rad.msn.com.	IN	A

;; ANSWER SECTION:
rad.msn.com.	60	IN	A	10.10.10.1

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 0 msec
;; SERVER: 127.0.0.1
;; WHEN: Sat Jan 23 10:51:26 2016
;; MSG SIZE  rcvd: 45
[2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.live.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 59304
;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; rad.live.com.	IN	A

;; ANSWER SECTION:
rad.live.com.	3276	IN	CNAME	rad.msn.com.
rad.msn.com.	576	IN	CNAME	rad.msn.com.nsatc.net.
rad.msn.com.nsatc.net.	299	IN	A	111.221.29.189

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 334 msec
;; SERVER: 8.8.8.8
;; WHEN: Sat Jan 23 10:51:53 2016
;; MSG SIZE  rcvd: 103
[2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.live.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 53764
;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; rad.live.com.	IN	A

;; ANSWER SECTION:
rad.live.com.	3266	IN	CNAME	rad.msn.com.
rad.msn.com.	566	IN	CNAME	rad.msn.com.nsatc.net.
rad.msn.com.nsatc.net.	299	IN	A	111.221.29.189

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 1306 msec
;; SERVER: 8.8.4.4
;; WHEN: Sat Jan 23 10:51:57 2016
;; MSG SIZE  rcvd: 103
[2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.live.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 45495
;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; rad.live.com.	IN	A

;; ANSWER SECTION:
rad.live.com.	3268	IN	CNAME	rad.msn.com.
rad.msn.com.	568	IN	CNAME	rad.msn.com.nsatc.net.
rad.msn.com.nsatc.net.	299	IN	A	111.221.29.189

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 351 msec
;; SERVER: 8.8.8.8
;; WHEN: Sat Jan 23 10:52:01 2016
;; MSG SIZE  rcvd: 103
[2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.live.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 28183
;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; rad.live.com.	IN	A

;; ANSWER SECTION:
rad.live.com.	3262	IN	CNAME	rad.msn.com.
rad.msn.com.	562	IN	CNAME	rad.msn.com.nsatc.net.
rad.msn.com.nsatc.net.	295	IN	A	111.221.29.189

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 165 msec
;; SERVER: 8.8.8.8
;; WHEN: Sat Jan 23 10:52:03 2016
;; MSG SIZE  rcvd: 103
[2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.live.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 43314
;; flags: qr aa rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; rad.live.com.	IN	A

;; ANSWER SECTION:
rad.live.com.	60	IN	A	10.10.10.1

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 0 msec
;; SERVER: 127.0.0.1
;; WHEN: Sat Jan 23 10:52:04 2016
;; MSG SIZE  rcvd: 46
            1 Reply Last reply Reply Quote 0
            • RonpfSR
              RonpfS
              last edited by

              Maybe it is the time for pfBlockerNG to rebuild the database after you made a change.

              Go to pfBlockerNG: Update, View log to see when the process is done.

              2.4.5-RELEASE-p1 (amd64)
              Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
              Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

              1 Reply Last reply Reply Quote 0
              • BBcan177B
                BBcan177 Moderator
                last edited by

                @kripz:

                EDIT: Why does it take a few lookups for the IP to be blocked?

                Looks like that domain was previously cached by Unbound…
                rad.msn.com.nsatc.net.   299 IN A 111.221.29.189

                "Experience is something you don't get until just after you need it."

                Website: http://pfBlockerNG.com
                Twitter: @BBcan177  #pfBlockerNG
                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                1 Reply Last reply Reply Quote 0
                • J
                  jc2it
                  last edited by

                  So basically you think it's Firefox? But I have no Bing (removed it from search options in Firefox), I use no Bing, I've never been there in my whole live… Firefox was running in PRIVATE mode all the time btw...

                  So: why does my OS/Browser try to contact OVER AND OVER AGAIN something I've never asked to contact? Things are not really getting better at this point...

                  2chemlud I believe various other search engines resell Bing results. Is it possible you are using one of these search engines. I am thinking of yahoo in particular, but I would bet there are others.

                  1 Reply Last reply Reply Quote 0
                  • 2
                    2chemlud Banned
                    last edited by

                    Hi jc2it!

                    See below, only search machines installed in Firefox are Startpage, Wikipedia adn Duckduckgo…

                    So which one is your suspect? :-)

                    search.png
                    search.png_thumb

                    1 Reply Last reply Reply Quote 0
                    • J
                      jc2it
                      last edited by

                      @2chemlud:

                      So which one is your suspect? :-)

                      :D Well, that is a good question.

                      1 Reply Last reply Reply Quote 0
                      • 2
                        2chemlud Banned
                        last edited by

                        …more than once I feel like this with all this techy stuff

                        scnr…

                        1 Reply Last reply Reply Quote 0
                        • M
                          mattyd
                          last edited by

                          @jc2it:

                          @2chemlud:

                          So which one is your suspect? :-)

                          :D Well, that is a good question.

                          DuckDuckGo would be my guess.  From their Wikipedia page:

                          "DuckDuckGo emphasizes getting information from the best sources rather than the most sources, generating its search results from key crowdsourced sites such as Wikipedia and from partnerships with other search engines like Yandex, Yahoo!, Bing, and Yummly."

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.