Why is so difficult to block this specific website when using mobilephone's Chrome App?

Zist

Hi Johnpoz, when "administrator" wants to block something, they are not supposed to touch users' devices.

johnpoz

Didn't say you should or could, just telling you how chrome is prob getting around your blocks.

Block the proxy network if you don't want your devices to use the google proxy to circumvent your blocks.

BBcan177

@zist said in Why is so difficult to block this specific website when using mobilephone's Chrome App?:

wodeshucheng.com

From pfSense open a Shell and see if you can resolve that domain:

host -t A wodeshucheng.com

With "TLD" enabled, it should also be blocking all sub-domains:

host -t A sub.wodeshucheng.com

There are also CNAMES for that domain, so would also need to block those.

If its blocking in pfSense, then something else is circumventing the DNS Resolution.

I will be adding DNSBL IPv6 blocking in the next Release, so it could also be going out via IPv6.

Zist

@bbcan177
Thank you very much for your reply. I will try it.

johnpoz

I don't see any AAAA for those.. So doubt its IPv6, but yeah there is cnames that will have to be blocked as well

;; ANSWER SECTION:
wodeshucheng.com. 573 IN CNAME wodeshucheng.com.cdn.dnsv1.com.
wodeshucheng.com.cdn.dnsv1.com. 574 IN CNAME 195813.sp.tencdns.net.
195813.sp.tencdns.net. 156 IN A 221.204.166.70

And again - android with chrome can use the proxy.. So doesnt' matter what you don't resolve locally.. The proxy resolves it for the browser... If you don't want them going their then you have to stop them talking to the proxy in the first place..

Zist

@johnpoz
Thanks for your looking into it.

If I want to stop chrome app talking to the proxy in the first place, I believe I should configure some relevant firewall rules on pfsense. But it requires I have to know the proxy information first, for example, I should know the proxy IPs or something else. Is there a way to know what proxies andriod chrome app is using?

As you mentioned above, there is cnames that will have to be blocked. Could you please advise what I should do on pfsense to block cnames? What I did was I put wodeshucheng.com in both TLD blacklist and DNSBL Custom_List. Is it not good enough? Do you mean I should put wodeshucheng.com.cdn.dnsv1.com and 195813.sp.tencdns.net in both TLD blacklist and DNSBL Custom_List as well?

BBcan177

@zist said in Why is so difficult to block this specific website when using mobilephone's Chrome App?:

Don't add domains to the TLD Blacklist, the TLD Blacklist is to block full TLDs like "cn" or "top" etc...

You can create a new DNSBL Group and add the domains to be blocked to the customlist at the bottom, or add it to an existing DNSBL Group customlist. And yes add all those cnames also to the customlist. Then with TLD Enabled, run a Force Reload - DNSBL.

Zist

@bbcan177
Thank you very much for your clarification, I will try it.

Zist

@bbcan177

The results for command are below:
[2.4.4-RELEASE][admin@localdomain]/root: host -t A wodeshucheng.com
wodeshucheng.com has address 10.10.10.1
[2.4.4-RELEASE][admin@localdomain]/root: host -t A sub.wodeshucheng.com
sub.wodeshucheng.com has address 10.10.10.1

Here is what I did: I put the below into DNSBL Group customlist. Then with TLD Enabled, run a Force Reload - DNSBL.

wodeshucheng.com
wodeshucheng.com.cdn.dnsv1.com
195813.sp.tencdns.net
m.wodeshucheng.com
m.wodeshucheng.com.cdn.dnsv1.com
195812.dispatch.spcdntip.com

Result:
I still can browse wodeshucheng.com and its sub-domain web-pages
I cannot browse m.wodeshucheng.com anymore; which is successful blocked.

Is there another way to block wodeshucheng.com?

johnpoz

you are blocking it.. But then again lets say it one more time!!! Using chrome on an android device might be using PROXY!! IN that case the proxy gets asked not the local dns... You can block with dns until you turn blue - not going to stop the client from talking to the proxy and going to any website the proxy can go to..

Zist

@johnpoz

My question is, if chrome app on android can use its PROXY to work for wodeshucheng.com, why it doesn't work for others. Based on my test, many websites can be blocked successfully. Only wodeshucheng.com is so annoying. Why wodeshucheng.com is so special that it cannot be blocked?

johnpoz

because they are hitting via some IP that your not aware of?

If you do a query and get back 10.10.10.1 then that is clearly pfblocker blocking it.. You need to find what FQDN they are using to access it that your not blocking.. Or what IP they are using to access it, etc.

I would think a simple sniff of the traffic while you go to it should show you this..

Pippin

Maybe google's QUIC protocol ?

https://www.fastvue.co/fastvue/blog/googles-quic-protocols-security-and-reporting-implications/

BBcan177

nslookup or dig from your LAN device from the cmd prompt/shell.

If the cmd/shell replies with the DNSBL VIP and you can still resolve that Domain in the browser, then you know that the Browser is using other methods to get to that IP. Also check your AV as some of them like Avast can also provide DNS over HTTPS...

noplan

@johnpoz said in Why is so difficult to block this specific website when using mobilephone's Chrome App?:

ot going to stop the client from talking to the proxy and going to any website the proxy can go to..

a possible work around is
to get all requests to UDP Port 53 redirected to your DNS maybe that can help

BBcan177

@noplan said in Why is so difficult to block this specific website when using mobilephone's Chrome App?:

a possible work around is
to get all requests to UDP Port 53 redirected to your DNS maybe that can help

That is the issue, these requests may be going over HTTPS (DOH), and its not possible to block that easily since its not on port 53.

noplan

@bbcan177 said in Why is so difficult to block this specific website when using mobilephone's Chrome App?:

d its not possible to block that easily since its not on port 53.

so gettin you right
for optimal filter (pfB / DNSBL) experience it will be wise to
not redirect to port 53 (as i mentioned in the work around)

thanks for input ... makes totally sense
br from snowLand