Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to block in Windows10 Telemetry with pfsense

    Scheduled Pinned Locked Moved Firewalling
    80 Posts 19 Posters 55.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • RonpfSR
      RonpfS
      last edited by

      This is a good starting point https://forum.pfsense.org/index.php?topic=102470.0

      2.4.5-RELEASE-p1 (amd64)
      Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
      Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

      1 Reply Last reply Reply Quote 0
      • G
        garyn
        last edited by

        In topic 102470 (line above), look for reply #18 on Nov 20, 2015.  Reply #18 walks you through the setup.

        1 Reply Last reply Reply Quote 0
        • K
          kripz
          last edited by

          @garyn:

          In topic 102470 (line above), look for reply #18 on Nov 20, 2015.  Reply #18 walks you through the setup.

          @RonpfS:

          This is a good starting point https://forum.pfsense.org/index.php?topic=102470.0

          Thanks guys.

          In addition to the guide, id like to add that DNSBL is not seperate to pfBlockerNG, it must be enabled for DNSBL to be enabled. Spent 20 mins trying to figure out why DNSBL wouldnt work :D

          EDIT: Why does it take a few lookups for the IP to be blocked?

          [2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.msn.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 17580
;; flags: qr rd ra ; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; rad.msn.com.	IN	A

;; ANSWER SECTION:
rad.msn.com.	690	IN	CNAME	rad.msn.com.nsatc.net.
rad.msn.com.nsatc.net.	299	IN	A	111.221.29.189

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 472 msec
;; SERVER: 8.8.4.4
;; WHEN: Sat Jan 23 10:51:18 2016
;; MSG SIZE  rcvd: 80
[2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.msn.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 11622
;; flags: qr aa rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; rad.msn.com.	IN	A

;; ANSWER SECTION:
rad.msn.com.	60	IN	A	10.10.10.1

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 0 msec
;; SERVER: 127.0.0.1
;; WHEN: Sat Jan 23 10:51:26 2016
;; MSG SIZE  rcvd: 45
[2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.live.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 59304
;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; rad.live.com.	IN	A

;; ANSWER SECTION:
rad.live.com.	3276	IN	CNAME	rad.msn.com.
rad.msn.com.	576	IN	CNAME	rad.msn.com.nsatc.net.
rad.msn.com.nsatc.net.	299	IN	A	111.221.29.189

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 334 msec
;; SERVER: 8.8.8.8
;; WHEN: Sat Jan 23 10:51:53 2016
;; MSG SIZE  rcvd: 103
[2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.live.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 53764
;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; rad.live.com.	IN	A

;; ANSWER SECTION:
rad.live.com.	3266	IN	CNAME	rad.msn.com.
rad.msn.com.	566	IN	CNAME	rad.msn.com.nsatc.net.
rad.msn.com.nsatc.net.	299	IN	A	111.221.29.189

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 1306 msec
;; SERVER: 8.8.4.4
;; WHEN: Sat Jan 23 10:51:57 2016
;; MSG SIZE  rcvd: 103
[2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.live.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 45495
;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; rad.live.com.	IN	A

;; ANSWER SECTION:
rad.live.com.	3268	IN	CNAME	rad.msn.com.
rad.msn.com.	568	IN	CNAME	rad.msn.com.nsatc.net.
rad.msn.com.nsatc.net.	299	IN	A	111.221.29.189

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 351 msec
;; SERVER: 8.8.8.8
;; WHEN: Sat Jan 23 10:52:01 2016
;; MSG SIZE  rcvd: 103
[2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.live.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 28183
;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; rad.live.com.	IN	A

;; ANSWER SECTION:
rad.live.com.	3262	IN	CNAME	rad.msn.com.
rad.msn.com.	562	IN	CNAME	rad.msn.com.nsatc.net.
rad.msn.com.nsatc.net.	295	IN	A	111.221.29.189

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 165 msec
;; SERVER: 8.8.8.8
;; WHEN: Sat Jan 23 10:52:03 2016
;; MSG SIZE  rcvd: 103
[2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.live.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 43314
;; flags: qr aa rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; rad.live.com.	IN	A

;; ANSWER SECTION:
rad.live.com.	60	IN	A	10.10.10.1

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 0 msec
;; SERVER: 127.0.0.1
;; WHEN: Sat Jan 23 10:52:04 2016
;; MSG SIZE  rcvd: 46
          1 Reply Last reply Reply Quote 0
          • RonpfSR
            RonpfS
            last edited by

            Maybe it is the time for pfBlockerNG to rebuild the database after you made a change.

            Go to pfBlockerNG: Update, View log to see when the process is done.

            2.4.5-RELEASE-p1 (amd64)
            Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
            Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

            1 Reply Last reply Reply Quote 0
            • BBcan177B
              BBcan177 Moderator
              last edited by

              @kripz:

              EDIT: Why does it take a few lookups for the IP to be blocked?

              Looks like that domain was previously cached by Unbound…
              rad.msn.com.nsatc.net.   299 IN A 111.221.29.189

              "Experience is something you don't get until just after you need it."

              Website: http://pfBlockerNG.com
              Twitter: @BBcan177  #pfBlockerNG
              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

              1 Reply Last reply Reply Quote 0
              • J
                jc2it
                last edited by

                So basically you think it's Firefox? But I have no Bing (removed it from search options in Firefox), I use no Bing, I've never been there in my whole live… Firefox was running in PRIVATE mode all the time btw...

                So: why does my OS/Browser try to contact OVER AND OVER AGAIN something I've never asked to contact? Things are not really getting better at this point...

                2chemlud I believe various other search engines resell Bing results. Is it possible you are using one of these search engines. I am thinking of yahoo in particular, but I would bet there are others.

                1 Reply Last reply Reply Quote 0
                • 2
                  2chemlud Banned
                  last edited by

                  Hi jc2it!

                  See below, only search machines installed in Firefox are Startpage, Wikipedia adn Duckduckgo…

                  So which one is your suspect? :-)

                  search.png
                  search.png_thumb

                  1 Reply Last reply Reply Quote 0
                  • J
                    jc2it
                    last edited by

                    @2chemlud:

                    So which one is your suspect? :-)

                    :D Well, that is a good question.

                    1 Reply Last reply Reply Quote 0
                    • 2
                      2chemlud Banned
                      last edited by

                      …more than once I feel like this with all this techy stuff

                      scnr…

                      1 Reply Last reply Reply Quote 0
                      • M
                        mattyd
                        last edited by

                        @jc2it:

                        @2chemlud:

                        So which one is your suspect? :-)

                        :D Well, that is a good question.

                        DuckDuckGo would be my guess.  From their Wikipedia page:

                        "DuckDuckGo emphasizes getting information from the best sources rather than the most sources, generating its search results from key crowdsourced sites such as Wikipedia and from partnerships with other search engines like Yandex, Yahoo!, Bing, and Yummly."

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.