Why is so difficult to block this specific website when using mobilephone's Chrome App?

Zist · Dec 13, 2018, 3:38 PM

Hi BBcan177,

After I installed pfsense, I tried different ways to stop Android Smartphone Chrome browsing a website wodeshucheng.com (which is an online trash Chinese novel website) and failed. What I tried to block wodeshucheng.com is below:

No success when using SquidGuard.
No success when using DNS Forwarder.
No success when using pfblockerng-devel without enabling TLD.
Almost successful when using pfblockerng-devel by enabling TLD. I got 1*1 pixel in the day I enabled TLD, but next day when using my Android Smartphone Chrome, I still can browse that website. What I did was I put wodeshucheng.com in TLD blacklist and I also put it in DNSBL Custom_List.

Note: It is successful to stop Android Smartphone Firefox App browsing it. But it is very difficult to stop Smartphone Chrome browsing it.

Could you please advise if there is a way to stop Smartphone Chrome App browsing wodeshucheng.com?

Thanks,

Joshua

johnpoz · Dec 13, 2018, 4:08 PM

You do understand chrome on phones like to use proxies!
https://www.zdnet.com/article/google-proxy-used-for-chromes-mobile-data-compression/
https://developer.chrome.com/multidevice/data-compression#faq

In the chrome settings on the phone you should be able to disable the Data Saving ;) feature...

Zist · Dec 13, 2018, 5:05 PM

Hi Johnpoz, when "administrator" wants to block something, they are not supposed to touch users' devices.

johnpoz · Dec 13, 2018, 5:38 PM

Didn't say you should or could, just telling you how chrome is prob getting around your blocks.

Block the proxy network if you don't want your devices to use the google proxy to circumvent your blocks.

BBcan177 · Dec 20, 2018, 1:52 PM

@zist said in Why is so difficult to block this specific website when using mobilephone's Chrome App?:

wodeshucheng.com

From pfSense open a Shell and see if you can resolve that domain:

host -t A wodeshucheng.com

With "TLD" enabled, it should also be blocking all sub-domains:

host -t A sub.wodeshucheng.com

There are also CNAMES for that domain, so would also need to block those.

If its blocking in pfSense, then something else is circumventing the DNS Resolution.

I will be adding DNSBL IPv6 blocking in the next Release, so it could also be going out via IPv6.

Zist · Dec 20, 2018, 1:52 PM

@bbcan177
Thank you very much for your reply. I will try it.

johnpoz · Dec 20, 2018, 2:34 PM

I don't see any AAAA for those.. So doubt its IPv6, but yeah there is cnames that will have to be blocked as well

;; ANSWER SECTION:
wodeshucheng.com. 573 IN CNAME wodeshucheng.com.cdn.dnsv1.com.
wodeshucheng.com.cdn.dnsv1.com. 574 IN CNAME 195813.sp.tencdns.net.
195813.sp.tencdns.net. 156 IN A 221.204.166.70

And again - android with chrome can use the proxy.. So doesnt' matter what you don't resolve locally.. The proxy resolves it for the browser... If you don't want them going their then you have to stop them talking to the proxy in the first place..

Zist · Dec 20, 2018, 3:28 PM

@johnpoz
Thanks for your looking into it.

If I want to stop chrome app talking to the proxy in the first place, I believe I should configure some relevant firewall rules on pfsense. But it requires I have to know the proxy information first, for example, I should know the proxy IPs or something else. Is there a way to know what proxies andriod chrome app is using?

As you mentioned above, there is cnames that will have to be blocked. Could you please advise what I should do on pfsense to block cnames? What I did was I put wodeshucheng.com in both TLD blacklist and DNSBL Custom_List. Is it not good enough? Do you mean I should put wodeshucheng.com.cdn.dnsv1.com and 195813.sp.tencdns.net in both TLD blacklist and DNSBL Custom_List as well?

BBcan177 · Dec 20, 2018, 4:00 PM

@zist said in Why is so difficult to block this specific website when using mobilephone's Chrome App?:

Don't add domains to the TLD Blacklist, the TLD Blacklist is to block full TLDs like "cn" or "top" etc...

You can create a new DNSBL Group and add the domains to be blocked to the customlist at the bottom, or add it to an existing DNSBL Group customlist. And yes add all those cnames also to the customlist. Then with TLD Enabled, run a Force Reload - DNSBL.

Zist · Dec 20, 2018, 4:22 PM

@bbcan177
Thank you very much for your clarification, I will try it.

Zist · Jan 4, 2019, 11:08 PM

@bbcan177

The results for command are below:
[2.4.4-RELEASE][admin@localdomain]/root: host -t A wodeshucheng.com
wodeshucheng.com has address 10.10.10.1
[2.4.4-RELEASE][admin@localdomain]/root: host -t A sub.wodeshucheng.com
sub.wodeshucheng.com has address 10.10.10.1

Here is what I did: I put the below into DNSBL Group customlist. Then with TLD Enabled, run a Force Reload - DNSBL.

wodeshucheng.com
wodeshucheng.com.cdn.dnsv1.com
195813.sp.tencdns.net
m.wodeshucheng.com
m.wodeshucheng.com.cdn.dnsv1.com
195812.dispatch.spcdntip.com

Result:
I still can browse wodeshucheng.com and its sub-domain web-pages
I cannot browse m.wodeshucheng.com anymore; which is successful blocked.

Is there another way to block wodeshucheng.com?

johnpoz · Jan 7, 2019, 3:17 PM

you are blocking it.. But then again lets say it one more time!!! Using chrome on an android device might be using PROXY!! IN that case the proxy gets asked not the local dns... You can block with dns until you turn blue - not going to stop the client from talking to the proxy and going to any website the proxy can go to..

Zist · Jan 7, 2019, 3:17 PM

@johnpoz

My question is, if chrome app on android can use its PROXY to work for wodeshucheng.com, why it doesn't work for others. Based on my test, many websites can be blocked successfully. Only wodeshucheng.com is so annoying. Why wodeshucheng.com is so special that it cannot be blocked?

johnpoz · Jan 7, 2019, 3:51 PM

because they are hitting via some IP that your not aware of?

If you do a query and get back 10.10.10.1 then that is clearly pfblocker blocking it.. You need to find what FQDN they are using to access it that your not blocking.. Or what IP they are using to access it, etc.

I would think a simple sniff of the traffic while you go to it should show you this..

Pippin · Jan 7, 2019, 5:03 PM

Maybe google's QUIC protocol ?

https://www.fastvue.co/fastvue/blog/googles-quic-protocols-security-and-reporting-implications/

BBcan177 · Jan 7, 2019, 10:50 PM

nslookup or dig from your LAN device from the cmd prompt/shell.

If the cmd/shell replies with the DNSBL VIP and you can still resolve that Domain in the browser, then you know that the Browser is using other methods to get to that IP. Also check your AV as some of them like Avast can also provide DNS over HTTPS...

noplan · Jan 10, 2019, 1:16 AM

@johnpoz said in Why is so difficult to block this specific website when using mobilephone's Chrome App?:

ot going to stop the client from talking to the proxy and going to any website the proxy can go to..

a possible work around is
to get all requests to UDP Port 53 redirected to your DNS maybe that can help

BBcan177 · Jan 10, 2019, 1:16 AM

@noplan said in Why is so difficult to block this specific website when using mobilephone's Chrome App?:

a possible work around is
to get all requests to UDP Port 53 redirected to your DNS maybe that can help

That is the issue, these requests may be going over HTTPS (DOH), and its not possible to block that easily since its not on port 53.

noplan · Jan 11, 2019, 8:31 AM

@bbcan177 said in Why is so difficult to block this specific website when using mobilephone's Chrome App?:

d its not possible to block that easily since its not on port 53.

so gettin you right
for optimal filter (pfB / DNSBL) experience it will be wise to
not redirect to port 53 (as i mentioned in the work around)

thanks for input ... makes totally sense
br from snowLand