Information to block teamviewer, logmein or Anydesk on pfsense snort

[leungda]

Hi all,

I am reading most of the websites on blocking remote software like Teamviewer, etc. After trial and error, here is the information that you might want

(1) Install Snort package on pfsense (many youtube videos that you can watch)
Additional setup on top of regular configuration*
(2) go Snort Interfaces -> WAN Categories -> make sure you deselect all the "Ruleset: Snort OPENAPPID Rulesall" except "openappid-remote_access.rules"
(3) click on "openappid-remote_access.rules" and disable something you might need. In my case, I just enable teamviewer, Anydesk, logmein, realvnc and vnc-server. all up to your choice.
(4) go to "WAN Preprocs" -> "Applicated ID Detection", Click on "Enable"
(5) on the bottom, click on "save"

That's all you need.

If you want to do it on DNS, you can block anything with this domain *.router.teamviewer.com