Why is so difficult to block this specific website when using mobilephone's Chrome App?

Zist

@johnpoz
Thanks for your looking into it.

If I want to stop chrome app talking to the proxy in the first place, I believe I should configure some relevant firewall rules on pfsense. But it requires I have to know the proxy information first, for example, I should know the proxy IPs or something else. Is there a way to know what proxies andriod chrome app is using?

As you mentioned above, there is cnames that will have to be blocked. Could you please advise what I should do on pfsense to block cnames? What I did was I put wodeshucheng.com in both TLD blacklist and DNSBL Custom_List. Is it not good enough? Do you mean I should put wodeshucheng.com.cdn.dnsv1.com and 195813.sp.tencdns.net in both TLD blacklist and DNSBL Custom_List as well?

BBcan177

@zist said in Why is so difficult to block this specific website when using mobilephone's Chrome App?:

Don't add domains to the TLD Blacklist, the TLD Blacklist is to block full TLDs like "cn" or "top" etc...

You can create a new DNSBL Group and add the domains to be blocked to the customlist at the bottom, or add it to an existing DNSBL Group customlist. And yes add all those cnames also to the customlist. Then with TLD Enabled, run a Force Reload - DNSBL.

Zist

@bbcan177
Thank you very much for your clarification, I will try it.

Zist

@bbcan177

The results for command are below:
[2.4.4-RELEASE][admin@localdomain]/root: host -t A wodeshucheng.com
wodeshucheng.com has address 10.10.10.1
[2.4.4-RELEASE][admin@localdomain]/root: host -t A sub.wodeshucheng.com
sub.wodeshucheng.com has address 10.10.10.1

Here is what I did: I put the below into DNSBL Group customlist. Then with TLD Enabled, run a Force Reload - DNSBL.

wodeshucheng.com
wodeshucheng.com.cdn.dnsv1.com
195813.sp.tencdns.net
m.wodeshucheng.com
m.wodeshucheng.com.cdn.dnsv1.com
195812.dispatch.spcdntip.com

Result:
I still can browse wodeshucheng.com and its sub-domain web-pages
I cannot browse m.wodeshucheng.com anymore; which is successful blocked.

Is there another way to block wodeshucheng.com?

johnpoz

you are blocking it.. But then again lets say it one more time!!! Using chrome on an android device might be using PROXY!! IN that case the proxy gets asked not the local dns... You can block with dns until you turn blue - not going to stop the client from talking to the proxy and going to any website the proxy can go to..

Zist

@johnpoz

My question is, if chrome app on android can use its PROXY to work for wodeshucheng.com, why it doesn't work for others. Based on my test, many websites can be blocked successfully. Only wodeshucheng.com is so annoying. Why wodeshucheng.com is so special that it cannot be blocked?

johnpoz

because they are hitting via some IP that your not aware of?

If you do a query and get back 10.10.10.1 then that is clearly pfblocker blocking it.. You need to find what FQDN they are using to access it that your not blocking.. Or what IP they are using to access it, etc.

I would think a simple sniff of the traffic while you go to it should show you this..

Pippin

Maybe google's QUIC protocol ?

https://www.fastvue.co/fastvue/blog/googles-quic-protocols-security-and-reporting-implications/

BBcan177

nslookup or dig from your LAN device from the cmd prompt/shell.

If the cmd/shell replies with the DNSBL VIP and you can still resolve that Domain in the browser, then you know that the Browser is using other methods to get to that IP. Also check your AV as some of them like Avast can also provide DNS over HTTPS...

noplan

@johnpoz said in Why is so difficult to block this specific website when using mobilephone's Chrome App?:

ot going to stop the client from talking to the proxy and going to any website the proxy can go to..

a possible work around is
to get all requests to UDP Port 53 redirected to your DNS maybe that can help

BBcan177

@noplan said in Why is so difficult to block this specific website when using mobilephone's Chrome App?:

a possible work around is
to get all requests to UDP Port 53 redirected to your DNS maybe that can help

That is the issue, these requests may be going over HTTPS (DOH), and its not possible to block that easily since its not on port 53.

noplan

@bbcan177 said in Why is so difficult to block this specific website when using mobilephone's Chrome App?:

d its not possible to block that easily since its not on port 53.

so gettin you right
for optimal filter (pfB / DNSBL) experience it will be wise to
not redirect to port 53 (as i mentioned in the work around)

thanks for input ... makes totally sense
br from snowLand