Why is so difficult to block this specific website when using mobilephone's Chrome App?

BBcan177

@zist said in Why is so difficult to block this specific website when using mobilephone's Chrome App?:

Don't add domains to the TLD Blacklist, the TLD Blacklist is to block full TLDs like "cn" or "top" etc...

You can create a new DNSBL Group and add the domains to be blocked to the customlist at the bottom, or add it to an existing DNSBL Group customlist. And yes add all those cnames also to the customlist. Then with TLD Enabled, run a Force Reload - DNSBL.

Zist

@bbcan177
Thank you very much for your clarification, I will try it.

Zist

@bbcan177

The results for command are below:
[2.4.4-RELEASE][admin@localdomain]/root: host -t A wodeshucheng.com
wodeshucheng.com has address 10.10.10.1
[2.4.4-RELEASE][admin@localdomain]/root: host -t A sub.wodeshucheng.com
sub.wodeshucheng.com has address 10.10.10.1

Here is what I did: I put the below into DNSBL Group customlist. Then with TLD Enabled, run a Force Reload - DNSBL.

wodeshucheng.com
wodeshucheng.com.cdn.dnsv1.com
195813.sp.tencdns.net
m.wodeshucheng.com
m.wodeshucheng.com.cdn.dnsv1.com
195812.dispatch.spcdntip.com

Result:
I still can browse wodeshucheng.com and its sub-domain web-pages
I cannot browse m.wodeshucheng.com anymore; which is successful blocked.

Is there another way to block wodeshucheng.com?

johnpoz

you are blocking it.. But then again lets say it one more time!!! Using chrome on an android device might be using PROXY!! IN that case the proxy gets asked not the local dns... You can block with dns until you turn blue - not going to stop the client from talking to the proxy and going to any website the proxy can go to..

Zist

@johnpoz

My question is, if chrome app on android can use its PROXY to work for wodeshucheng.com, why it doesn't work for others. Based on my test, many websites can be blocked successfully. Only wodeshucheng.com is so annoying. Why wodeshucheng.com is so special that it cannot be blocked?

johnpoz

because they are hitting via some IP that your not aware of?

If you do a query and get back 10.10.10.1 then that is clearly pfblocker blocking it.. You need to find what FQDN they are using to access it that your not blocking.. Or what IP they are using to access it, etc.

I would think a simple sniff of the traffic while you go to it should show you this..

Pippin

Maybe google's QUIC protocol ?

https://www.fastvue.co/fastvue/blog/googles-quic-protocols-security-and-reporting-implications/

BBcan177

nslookup or dig from your LAN device from the cmd prompt/shell.

If the cmd/shell replies with the DNSBL VIP and you can still resolve that Domain in the browser, then you know that the Browser is using other methods to get to that IP. Also check your AV as some of them like Avast can also provide DNS over HTTPS...

noplan

@johnpoz said in Why is so difficult to block this specific website when using mobilephone's Chrome App?:

ot going to stop the client from talking to the proxy and going to any website the proxy can go to..

a possible work around is
to get all requests to UDP Port 53 redirected to your DNS maybe that can help

BBcan177

@noplan said in Why is so difficult to block this specific website when using mobilephone's Chrome App?:

a possible work around is
to get all requests to UDP Port 53 redirected to your DNS maybe that can help

That is the issue, these requests may be going over HTTPS (DOH), and its not possible to block that easily since its not on port 53.

noplan

@bbcan177 said in Why is so difficult to block this specific website when using mobilephone's Chrome App?:

d its not possible to block that easily since its not on port 53.

so gettin you right
for optimal filter (pfB / DNSBL) experience it will be wise to
not redirect to port 53 (as i mentioned in the work around)

thanks for input ... makes totally sense
br from snowLand