pfBlockerNG blocking access to android bank app

Herman

@RonpfS I am starting also to believe that it is IP related. But still I do not see anything that is blocked regarding the banking app.

tabnul

I found that there are various tracking services used by the rabobank app.
After allowing the below services everything started working...

But no way i keep these allow rules for just 1 app. I will send feedback to the rabobank regarding their app. No way a banking app should be so intrusive and at least this tracking should never block functionality.
Its a bug imo.

tags.tiqcdn.com # rabo
www.tags.tiqcdn.com # rabo
tags.tiqcdn.com.edgekey.net # CNAME for (tags.tiqcdn.com)
e8091.a.akamaiedge.net # CNAME for (tags.tiqcdn.com)
sdk.split.io # rabo
www.sdk.split.io # rabo
f2.shared.global.fastly.net # CNAME for (sdk.split.io)
events.split.io # rabo
www.events.split.io # rabo
events-aws-prod-elb.split.io # CNAME for (events.split.io)
events-prod-1-1033355748.us-east-1.elb.amazonaws.com # CNAME for (events.split.io)
w.usabilla.com # rabo
www.w.usabilla.com # rabo
app-measurement.com # rabo
www.app-measurement.com # rabo
google-analytics.com # rabo
www.google-analytics.com # rabo
www-google-analytics.l.google.com # CNAME for (google-analytics.com)

tabnul

In fact, i found that the only truly blocking are the ones from google....
Thats the last one i want in my allow list .....

google-analytics.com # rabo
www.google-analytics.com # rabo
www-google-analytics.l.google.com # CNAME for (google-analytics.com)

tabnul

Last reply from my side.
I fixed it by changing the DNS Virtual IP to 127.0.0.1.
Whitelist is empty again, ads are still blocked.

This obviously breaks the functionality where a user is informed that something was blocked by the network administrator , but for home usage this is fine and this is how most home adblockers work anyway.

Probably its an implementation issue in the rabobank bankieren app. But this solution is fine for me.
In fact , routing dns requests to localhosts instead of a 'remote' service is faster at the end (probably unnoticeable , but anyway ;) )

Herman

Hi @tabnul,

You are my HERO! Also want to thank you for replying to my post. Many many thanks.

Any explanation why routing DNS to 127.0.0.1 instead of 10.10.10.1? Look also forward to how you figured this out…

Again, you are the King

Regards,
Herman

tabnul

@Herman
I dont know why this fix solves it but apparently the app expects a valid api response from google analytics whenever it gets a non 4** response code. When routing to 127.0.0.1 it receives a 404 , apparently thats fine.

Probably it will break again when you run a webserver on your local machine listening on port 80 this way.
It was just a wild guess from my side.

IMO this still is a bug in the App, and/or the google SDK they used for setting up the logic.

Herman

@tabnul

Thanks a lot for your explanation. Anyway it works.

Is there a possibility that no blocking results are shown at the alerts after the change to 127.0.0.1? It keeps showing 0. Even after updating and reloading. Any Thoughts?

Herman

tabnul

@Herman

You are right, this seems to mess up the stats... thats a shame.
Apparently stats are collected by http requests on the virtual ip.

tabnul

what might be the case here is that the issue is caused by an invalid SSL certificate on the virtual IP adress. In fact i would expect that.
(i mean the original issue)

tabnul

probably it is the issue.
you can fix it by handling the google ad services differently. they wont get logged then, but everything else will.
See;
https://forum.netgate.com/topic/111095/dnsbl-certificate-errors/46
and
https://forum.netgate.com/topic/133055/dnsbl-modify-default-bloked-webpage/30

Herman

@tabnul
Again many thanks for your input.

I have read the articles. When I am right I have to null route the google domains? Right? I must admit that I am not a deep dive nerd when it comes to routing.

Would you like to explain how I have to configure this regarding the banking app?

Thanks in advance,
Herman

Herman

@tabnul

Tried to figure it out by myself with the websites you provided. Unfortunately I do not get it working. So if someone would like to help I appreciate this…

Regards Herman

noenes

Hello,
I just whitelist these URL's. Now de Rabobank App is working again

.app-measurement.com # RabobankAPP
.sdk.split.io # RabobankAPP2
.f2.shared.global.fastly.net # CNAME for (sdk.split.io)
.events.split.io # RabobankAPP3
.events-prod-1-1033355748.us-east-1.elb.amazonaws.com # CNAME for (events.split.io)
.tags.tiqcdn.com # RabobankAPP4
.tags.tiqcdn.com.edgekey.net # CNAME for (tags.tiqcdn.com)
.e8091.a.akamaiedge.net # CNAME for (tags.tiqcdn.com)

Maybe only the last 3 url's is enough. That i didn't test.