Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    How to block in Windows10 Telemetry with pfsense

    Firewalling
    19
    80
    38058
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • 2
      2chemlud Banned last edited by

      PS: Here

      http://techne.alaya.net/?p=12499

      you can find a long list of IPs and host names to block for Windows telemetry.

      1 Reply Last reply Reply Quote 0
      • 2
        2chemlud Banned last edited by

        …just for the record:

        I uninstalled on Win 7 pro 64/32 (various computers) the following KBs:

        97 1033
        290 2907
        295 2664
        299 0214
        302 1917
        302 2345
        303 5583
        304 4374
        305 0265
        306 2345
        306 5987
        306 8708
        307 5249
        307 5851
        308 0149
        308 3325

        and in addition I set up a block rule with loggin for an alias containing all the IPs and host names listed here

        http://techne.alaya.net/?p=12499

        As you might expect, the firewall log is full of blocked "MS telemetry" this morning.

        1 Reply Last reply Reply Quote 0
        • 2
          2chemlud Banned last edited by

          …just to add:

          Had my PC-BSD 10 PC up today for updating. Really amazing, I found in the firewall logs repeated access of this computer to an IP blocked for MS Telemetry.

          WHAT has PC-BSD with MS-Telemetry in common? Or is it more correctly NSA telemetry featured by Microshyte?

          I'm surprised!

          ![BSD to MS 07.12.2015.JPG](/public/imported_attachments/1/BSD to MS 07.12.2015.JPG)
          ![BSD to MS 07.12.2015.JPG_thumb](/public/imported_attachments/1/BSD to MS 07.12.2015.JPG_thumb)

          1 Reply Last reply Reply Quote 0
          • KOM
            KOM last edited by

            That IP address is a-msedge.net and it takes you to Bing.

            1 Reply Last reply Reply Quote 0
            • 2
              2chemlud Banned last edited by

              So basically you think it's Firefox? But I have no Bing (removed it from search options in Firefox), I use no Bing, I've never been there in my whole live… Firefox was running in PRIVATE mode all the time btw...

              So: why does my OS/Browser try to contact OVER AND OVER AGAIN something I've never asked to contact? Things are not really getting better at this point...

              1 Reply Last reply Reply Quote 0
              • KOM
                KOM last edited by

                No idea.

                1 Reply Last reply Reply Quote 0
                • 2
                  2chemlud Banned last edited by

                  …sometimes I really think about starting a 24/7 wireshark session on all networks... storage space is so cheap nowadays. How about an integration into pfSense?

                  1 Reply Last reply Reply Quote 0
                  • KOM
                    KOM last edited by

                    How about an integration into pfSense?

                    pfSense already has a Capture Packet function.  You want Wireshark??

                    1 Reply Last reply Reply Quote 0
                    • 2
                      2chemlud Banned last edited by

                      But is 24/7 feasible on an embedded nano? Not really, I guess. Maybe I set up a Linux machine and start copying the whole internet traffic…

                      But overall: This story really frustrates me...

                      1 Reply Last reply Reply Quote 0
                      • C
                        cmb last edited by

                        Wireshark is just a GUI to pcap data, you wouldn't run that on the firewall given it has no X and will never have X. You can feed Wireshark over SSH, or run tcpdump on the firewall dumping to disk if you have plenty of disk space.

                        It's extremely unlikely PCBSD is communicating with anything to do with Microsoft. Whatever telemetry blocking list you have is way over-blocking I expect. It also seems to block critical portions of Windows update, which is likely the bulk of the attempts you're seeing.

                        1 Reply Last reply Reply Quote 0
                        • D
                          doktornotor Banned last edited by

                          @cmb:

                          Whatever telemetry blocking list you have is way over-blocking I expect. It also seems to block critical portions of Windows update, which is likely the bulk of the attempts you're seeing.

                          Yes. Things like HPHosts that block this without thinking break Windows updates.

                          1 Reply Last reply Reply Quote 0
                          • 2
                            2chemlud Banned last edited by

                            Nope, Windows update just works fine on the Win-machines in the network, no problem at all.

                            But please, it's the local IP of my PC-BSD 10 running on an old Dell Precision 670, no question about that. No Windows involved. No software other than Firefox was running a the time of the blockings in the firewall log. And the log is FULL of these blocks.

                            I REALLY have no idea what is going on here…

                            1 Reply Last reply Reply Quote 0
                            • KOM
                              KOM last edited by

                              And you're sure that this PC-BSD box isn't running a browser that is trying to talk to Bing, for whatever reason?  Otherwise, I really can't see a *BSD distro needing to talk to Microsoft for anything.

                              1 Reply Last reply Reply Quote 0
                              • 2
                                2chemlud Banned last edited by

                                What could make Firefox with No-script in private mode make talk to Bing, except using Bing, is this the question? Honestly, I don't know!

                                1 Reply Last reply Reply Quote 0
                                • KOM
                                  KOM last edited by

                                  Perhaps it's a beacon or something on some page you were on that it talking to Bing?  Some other plugin you're running?  I have no idea either, just wild guesses.

                                  1 Reply Last reply Reply Quote 0
                                  • 2
                                    2chemlud Banned last edited by

                                    … no further plugins, except Cipherfox... ;-)

                                    1 Reply Last reply Reply Quote 0
                                    • 2
                                      2chemlud Banned last edited by

                                      …btw, I did it in the past, with 2 bridged network adapters catch whole internet traffic with wireshark. Is it better to do it on the WAN or on the LAN interface of the pfSense?

                                      On the WAN side the local IP the traffic is comming from should gone, right?

                                      1 Reply Last reply Reply Quote 0
                                      • C
                                        cmb last edited by

                                        Full of blocks to where? What IP(s)? PCBSD runs from a CDN, which might also host any number of other completely unrelated things. Doubt if Microsoft is among those as I believe they use akamai, but knowing list maintainers' penchant for over-blocking, it wouldn't be surprising if they blocked an entire CDN.

                                        1 Reply Last reply Reply Quote 0
                                        • 2
                                          2chemlud Banned last edited by

                                          The specific IP in the post above, same IP again and again.

                                          1 Reply Last reply Reply Quote 0
                                          • S
                                            sodasam last edited by

                                            :-\Hi,

                                            I tried to follow these instructions but pfsense is not allowing me to save these hosts as an alias or under any other type. Here is a snapshot of what I am doing https://imgur.com/XpW9uI8

                                            I would also like to block incoming tor exit nodes and I dont see any easy way to add the hundreds of IP's, does anyone know how that can be done on the command line?

                                            Can you kindly tell me the correct way to do this or how I can do it on the command line?

                                            Thanks!

                                            1 Reply Last reply Reply Quote 0
                                            • KOM
                                              KOM last edited by

                                              The name of the alias may only consist of the characters "a-z, A-Z, 0-9 and _"

                                              You can embed images directly here.  No need to link to Imgur.

                                              1 Reply Last reply Reply Quote 0
                                              • S
                                                sodasam last edited by

                                                @KOM:

                                                The name of the alias may only consist of the characters "a-z, A-Z, 0-9 and _"

                                                Ok fine but how do I add all these urls?

                                                1 Reply Last reply Reply Quote 0
                                                • KOM
                                                  KOM last edited by

                                                  Make an URL alias.

                                                  1 Reply Last reply Reply Quote 0
                                                  • S
                                                    sodasam last edited by

                                                    @KOM:

                                                    Make an URL alias.

                                                    That provides the same error and this:

                                                    The following input errors were detected:

                                                    The alias name must be less than 32 characters long, may not consist of only numbers, and may only contain the following characters a-z, A-Z, 0-9, _.
                                                    You must provide a valid URL. Could not fetch usable data from 'vortex.data.microsoft.com'.

                                                    1 Reply Last reply Reply Quote 0
                                                    • KOM
                                                      KOM last edited by

                                                      Well, considering I have no idea what you've done, all I can say is that it works fine for me and others.  Perhaps if you posted some actual useful information about your configuration, we might be able to help you.

                                                      An URL Alias is just an URL that points to a file on a web server, and pfSense will load that alias with the content of the text file.

                                                      1 Reply Last reply Reply Quote 0
                                                      • S
                                                        sodasam last edited by

                                                        @sodasam:

                                                        @KOM:

                                                        Make an URL alias.

                                                        That provides the same error and this:

                                                        The following input errors were detected:

                                                        The alias name must be less than 32 characters long, may not consist of only numbers, and may only contain the following characters a-z, A-Z, 0-9, _.
                                                        You must provide a valid URL. Could not fetch usable data from 'vortex.data.microsoft.com'.

                                                        Sorry here is another example:

                                                        https://imgur.com/2R0sYVW

                                                        I did some searching for where pfsense stores those files on the server but have not been able to find it, any idea?

                                                        1 Reply Last reply Reply Quote 0
                                                        • 2
                                                          2chemlud Banned last edited by

                                                          Don't. Use. SPACE. In. The. Name!

                                                          (Block MS Telemetry = wrong, Block_MS_Telemetry = correct) :-D

                                                          1 Reply Last reply Reply Quote 0
                                                          • S
                                                            sodasam last edited by

                                                            @2chemlud:

                                                            Don't. Use. SPACE. In. The. Name!

                                                            (Block MS Telemetry = wrong, Block_MS_Telemetry = correct) :-D

                                                            Ahh. That helped thanks. I changed the type to hosts and it works now, cheers!

                                                            1 Reply Last reply Reply Quote 0
                                                            • S
                                                              sodasam last edited by

                                                              Is there a way to block more than 5000 hosts in a single alias or rule? Intending to block inbound tor exit nodes and I think the list is 7000 IP's. Maybe on the command line alias file?

                                                              Thanks!

                                                              1 Reply Last reply Reply Quote 0
                                                              • 2
                                                                2chemlud Banned last edited by

                                                                Tried Snort (on LAN interface) ? Afaik if blocks contacts to TOR servers (have seen it in my Snort alerts), no idea how up-to-date the list of servers is…

                                                                btw., how about a new thread, this all here is miles OT.... ;-)

                                                                1 Reply Last reply Reply Quote 0
                                                                • L
                                                                  LEPM last edited by

                                                                  to block telemetry in a single PC use DWS_lite
                                                                  Open source,code on github.

                                                                  https://www.virustotal.com/en/file/bf600fc1517f65f15f4e174087759973837cfe99e419f2c52f6d248dee6eb72f/analysis/1449685802/

                                                                  https://github.com/Nummer/Destroy-Windows-10-Spying/blob/master/DWS

                                                                  string[] ipAddr =
                                                                              {
                                                                                  "111.221.29.177",
                                                                                  "111.221.29.253",
                                                                                  "131.253.40.37",
                                                                                  "134.170.30.202",
                                                                                  "134.170.115.60",
                                                                                  "134.170.165.248",
                                                                                  "134.170.165.253",
                                                                                  "134.170.185.70",
                                                                                  "137.116.81.24",
                                                                                  "137.117.235.16",
                                                                                  "157.55.129.21",
                                                                                  "157.55.133.204",
                                                                                  "157.56.121.89",
                                                                                  "157.56.91.77",
                                                                                  "168.63.108.233",
                                                                                  "191.232.139.254",
                                                                                  "191.232.80.58",
                                                                                  "191.232.80.62",
                                                                                  "191.237.208.126",
                                                                                  //"204.79.197.200", // BING.COM
                                                                                  "207.46.101.29",
                                                                                  "207.46.114.58",
                                                                                  "207.46.223.94",
                                                                                  "207.68.166.254",
                                                                                  "212.30.134.204",
                                                                                  "212.30.134.205",
                                                                                  "23.102.21.4",
                                                                                  "23.99.10.11",
                                                                                  "23.218.212.69",
                                                                                  "64.4.54.22",
                                                                                  "64.4.54.32",
                                                                                  "64.4.6.100",
                                                                                  "65.39.117.230",
                                                                                  "65.52.100.11",
                                                                                  "65.52.100.7",
                                                                                  "65.52.100.9",
                                                                                  "65.52.100.91",
                                                                                  "65.52.100.92",
                                                                                  "65.52.100.93",
                                                                                  "65.52.100.94",
                                                                                  "65.52.108.29",
                                                                                  "65.55.108.23",
                                                                                  "65.55.138.114",
                                                                                  "65.55.138.126",
                                                                                  "65.55.138.186",
                                                                                  "65.55.252.63",
                                                                                  "65.55.252.71",
                                                                                  "65.55.252.92",
                                                                                  "65.55.252.93",
                                                                                  "65.55.29.238",
                                                                                  "65.55.39.10",
                                                                                  "191.232.139.2",
                                                                                  "64.4.23.0-64.4.23.255",
                                                                                  "111.221.64.0-111.221.127.255", // singapure
                                                                                  "157.55.235.0-157.55.235.255",
                                                                                  "157.55.56.0-157.55.56.255",
                                                                                  "157.55.52.0-157.55.52.255",
                                                                                  "157.55.130.0-157.55.130.255",
                                                                                  "65.55.223.0-65.55.223.255",
                                                                                  "213.199.179.0-213.199.179.255", // Ireland
                                                                                  "195.138.255.0-195.138.255.255",
                                                                                  "23.223.20.82", // cache.datamart.windows.com
                                                                                  "77.67.29.176", // NEW TH2 Spy IP
                                                                                  "157.56.124.87", // NEW TH2 Spy IP
                                                                                  "157.55.236.0-157.55.236.255", // NEW TH2 SPY IP
                                                                                  "104.96.147.3",
                                                                                  "23.57.107.27",
                                                                                  "23.57.107.163",
                                                                                  "23.57.101.163",
                                                                                  "2.22.61.43",
                                                                                  "2.22.61.66",
                                                                                  "65.39.117.230",
                                                                                  "23.218.212.69",
                                                                                  "134.170.30.202",
                                                                                  "137.116.81.24",
                                                                                  "157.56.106.189",
                                                                                  "204.79.197.200",
                                                                                  "65.52.108.33"
                                                                              };
                                                                  
                                                                  string[] hostsdomains =
                                                                                  {
                                                                                      "statsfe2.update.microsoft.com.akadns.net",
                                                                                      "fe2.update.microsoft.com.akadns.net",
                                                                                      "s0.2mdn.net",
                                                                                      "survey.watson.microsoft.com",
                                                                                      "view.atdmt.com",
                                                                                      "watson.microsoft.com",
                                                                                      "watson.ppe.telemetry.microsoft.com",
                                                                                      "vortex.data.microsoft.com",
                                                                                      "vortex-win.data.microsoft.com",
                                                                                      "telecommand.telemetry.microsoft.com",
                                                                                      "telecommand.telemetry.microsoft.com.nsatc.net",
                                                                                      "oca.telemetry.microsoft.com",
                                                                                      "sqm.telemetry.microsoft.com",
                                                                                      "sqm.telemetry.microsoft.com.nsatc.net",
                                                                                      "watson.telemetry.microsoft.com",
                                                                                      "watson.telemetry.microsoft.com.nsatc.net",
                                                                                      "redir.metaservices.microsoft.com",
                                                                                      "choice.microsoft.com",
                                                                                      "choice.microsoft.com.nsatc.net",
                                                                                      "wes.df.telemetry.microsoft.com",
                                                                                      "services.wes.df.telemetry.microsoft.com",
                                                                                      "sqm.df.telemetry.microsoft.com",
                                                                                      "telemetry.microsoft.com",
                                                                                      "telemetry.appex.bing.net",
                                                                                      "telemetry.urs.microsoft.com",
                                                                                      "telemetry.appex.bing.net:443",
                                                                                      "settings-sandbox.data.microsoft.com",
                                                                                      "watson.live.com",
                                                                                      "statsfe2.ws.microsoft.com",
                                                                                      "corpext.msitadfs.glbdns2.microsoft.com",
                                                                                      "compatexchange.cloudapp.net",
                                                                                      "a-0001.a-msedge.net",
                                                                                      "sls.update.microsoft.com.akadns.net",
                                                                                      "diagnostics.support.microsoft.com",
                                                                                      "corp.sts.microsoft.com",
                                                                                      "statsfe1.ws.microsoft.com",
                                                                                      "feedback.windows.com",
                                                                                      "feedback.microsoft-hohm.com",
                                                                                      "feedback.search.microsoft.com",
                                                                                      "rad.msn.com",
                                                                                      "preview.msn.com",
                                                                                      "ad.doubleclick.net",
                                                                                      "ads.msn.com",
                                                                                      "ads1.msads.net",
                                                                                      "ads1.msn.com",
                                                                                      "a.ads1.msn.com",
                                                                                      "a.ads2.msn.com",
                                                                                      "adnexus.net",
                                                                                      "adnxs.com",
                                                                                      "az361816.vo.msecnd.net",
                                                                                      "az512334.vo.msecnd.net",
                                                                                      "ssw.live.com",
                                                                                      "ca.telemetry.microsoft.com",
                                                                                      "i1.services.social.microsoft.com",
                                                                                      "i1.services.social.microsoft.com.nsatc.net",
                                                                                      "df.telemetry.microsoft.com",
                                                                                      "reports.wes.df.telemetry.microsoft.com",
                                                                                      "cs1.wpc.v0cdn.net",
                                                                                      "vortex-sandbox.data.microsoft.com",
                                                                                      "oca.telemetry.microsoft.com.nsatc.net",
                                                                                      "pre.footprintpredict.com",
                                                                                      "spynet2.microsoft.com",
                                                                                      "spynetalt.microsoft.com",
                                                                                      "fe3.delivery.dsp.mp.microsoft.com.nsatc.net",
                                                                                      "cache.datamart.windows.com",
                                                                                      "db3wns2011111.wns.windows.com", // NEW TH2 spy hosts
                                                                                      //"deploy.static.akamaitechnologies.com",
                                                                                      //"akamaitechnologies.com"
                                                                                      "settings-win.data.microsoft.com",
                                                                                      "v10.vortex-win.data.microsoft.com",
                                                                                      "win10.ipv6.microsoft.com",
                                                                                      "ca.telemetry.microsoft.com",
                                                                                      "i1.services.social.microsoft.com.nsatc.net"
                                                                                  };
                                                                  

                                                                  Windows Update is not blocked !!!

                                                                  1 Reply Last reply Reply Quote 0
                                                                  • 2
                                                                    2chemlud Banned last edited by

                                                                    Hi, any details where this list comes from?

                                                                    1 Reply Last reply Reply Quote 0
                                                                    • C
                                                                      Caboosey last edited by

                                                                      @2chemlud:

                                                                      Hi, any details where this list comes from?

                                                                      It appears the list comes from various people and have noticed it's also used in Spyboy Anti-Beacon program too.

                                                                      I found doing DNSBL as a quicker way to block Windows Telemetry on pfSense. I just setup my pfsense to use DNSBL, which is included in the latest package of pfblockerNG. I told my DNSBL to use as it appears to be updated often:
                                                                      https://raw.githubusercontent.com/WindowsLies/BlockWindows/master/hostslist

                                                                      1 Reply Last reply Reply Quote 0
                                                                      • K
                                                                        kripz last edited by

                                                                        @Caboosey:

                                                                        @2chemlud:

                                                                        Hi, any details where this list comes from?

                                                                        It appears the list comes from various people and have noticed it's also used in Spyboy Anti-Beacon program too.

                                                                        I found doing DNSBL as a quicker way to block Windows Telemetry on pfSense. I just setup my pfsense to use DNSBL, which is included in the latest package of pfblockerNG. I told my DNSBL to use as it appears to be updated often:
                                                                        https://raw.githubusercontent.com/WindowsLies/BlockWindows/master/hostslist

                                                                        Do you have a guide or basic steps on how to set it up? Never used either before. is DNSBL a preconfigured list found in pfblockerNG?

                                                                        1 Reply Last reply Reply Quote 0
                                                                        • RonpfS
                                                                          RonpfS last edited by

                                                                          This is a good starting point https://forum.pfsense.org/index.php?topic=102470.0

                                                                          1 Reply Last reply Reply Quote 0
                                                                          • G
                                                                            garyn last edited by

                                                                            In topic 102470 (line above), look for reply #18 on Nov 20, 2015.  Reply #18 walks you through the setup.

                                                                            1 Reply Last reply Reply Quote 0
                                                                            • K
                                                                              kripz last edited by

                                                                              @garyn:

                                                                              In topic 102470 (line above), look for reply #18 on Nov 20, 2015.  Reply #18 walks you through the setup.

                                                                              @RonpfS:

                                                                              This is a good starting point https://forum.pfsense.org/index.php?topic=102470.0

                                                                              Thanks guys.

                                                                              In addition to the guide, id like to add that DNSBL is not seperate to pfBlockerNG, it must be enabled for DNSBL to be enabled. Spent 20 mins trying to figure out why DNSBL wouldnt work :D

                                                                              EDIT: Why does it take a few lookups for the IP to be blocked?

                                                                              [2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.msn.com
                                                                              ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 17580
                                                                              ;; flags: qr rd ra ; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0 
                                                                              ;; QUESTION SECTION:
                                                                              ;; rad.msn.com.	IN	A
                                                                              
                                                                              ;; ANSWER SECTION:
                                                                              rad.msn.com.	690	IN	CNAME	rad.msn.com.nsatc.net.
                                                                              rad.msn.com.nsatc.net.	299	IN	A	111.221.29.189
                                                                              
                                                                              ;; AUTHORITY SECTION:
                                                                              
                                                                              ;; ADDITIONAL SECTION:
                                                                              
                                                                              ;; Query time: 472 msec
                                                                              ;; SERVER: 8.8.4.4
                                                                              ;; WHEN: Sat Jan 23 10:51:18 2016
                                                                              ;; MSG SIZE  rcvd: 80
                                                                              [2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.msn.com
                                                                              ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 11622
                                                                              ;; flags: qr aa rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 
                                                                              ;; QUESTION SECTION:
                                                                              ;; rad.msn.com.	IN	A
                                                                              
                                                                              ;; ANSWER SECTION:
                                                                              rad.msn.com.	60	IN	A	10.10.10.1
                                                                              
                                                                              ;; AUTHORITY SECTION:
                                                                              
                                                                              ;; ADDITIONAL SECTION:
                                                                              
                                                                              ;; Query time: 0 msec
                                                                              ;; SERVER: 127.0.0.1
                                                                              ;; WHEN: Sat Jan 23 10:51:26 2016
                                                                              ;; MSG SIZE  rcvd: 45
                                                                              [2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.live.com
                                                                              ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 59304
                                                                              ;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 
                                                                              ;; QUESTION SECTION:
                                                                              ;; rad.live.com.	IN	A
                                                                              
                                                                              ;; ANSWER SECTION:
                                                                              rad.live.com.	3276	IN	CNAME	rad.msn.com.
                                                                              rad.msn.com.	576	IN	CNAME	rad.msn.com.nsatc.net.
                                                                              rad.msn.com.nsatc.net.	299	IN	A	111.221.29.189
                                                                              
                                                                              ;; AUTHORITY SECTION:
                                                                              
                                                                              ;; ADDITIONAL SECTION:
                                                                              
                                                                              ;; Query time: 334 msec
                                                                              ;; SERVER: 8.8.8.8
                                                                              ;; WHEN: Sat Jan 23 10:51:53 2016
                                                                              ;; MSG SIZE  rcvd: 103
                                                                              [2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.live.com
                                                                              ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 53764
                                                                              ;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 
                                                                              ;; QUESTION SECTION:
                                                                              ;; rad.live.com.	IN	A
                                                                              
                                                                              ;; ANSWER SECTION:
                                                                              rad.live.com.	3266	IN	CNAME	rad.msn.com.
                                                                              rad.msn.com.	566	IN	CNAME	rad.msn.com.nsatc.net.
                                                                              rad.msn.com.nsatc.net.	299	IN	A	111.221.29.189
                                                                              
                                                                              ;; AUTHORITY SECTION:
                                                                              
                                                                              ;; ADDITIONAL SECTION:
                                                                              
                                                                              ;; Query time: 1306 msec
                                                                              ;; SERVER: 8.8.4.4
                                                                              ;; WHEN: Sat Jan 23 10:51:57 2016
                                                                              ;; MSG SIZE  rcvd: 103
                                                                              [2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.live.com
                                                                              ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 45495
                                                                              ;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 
                                                                              ;; QUESTION SECTION:
                                                                              ;; rad.live.com.	IN	A
                                                                              
                                                                              ;; ANSWER SECTION:
                                                                              rad.live.com.	3268	IN	CNAME	rad.msn.com.
                                                                              rad.msn.com.	568	IN	CNAME	rad.msn.com.nsatc.net.
                                                                              rad.msn.com.nsatc.net.	299	IN	A	111.221.29.189
                                                                              
                                                                              ;; AUTHORITY SECTION:
                                                                              
                                                                              ;; ADDITIONAL SECTION:
                                                                              
                                                                              ;; Query time: 351 msec
                                                                              ;; SERVER: 8.8.8.8
                                                                              ;; WHEN: Sat Jan 23 10:52:01 2016
                                                                              ;; MSG SIZE  rcvd: 103
                                                                              [2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.live.com
                                                                              ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 28183
                                                                              ;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 
                                                                              ;; QUESTION SECTION:
                                                                              ;; rad.live.com.	IN	A
                                                                              
                                                                              ;; ANSWER SECTION:
                                                                              rad.live.com.	3262	IN	CNAME	rad.msn.com.
                                                                              rad.msn.com.	562	IN	CNAME	rad.msn.com.nsatc.net.
                                                                              rad.msn.com.nsatc.net.	295	IN	A	111.221.29.189
                                                                              
                                                                              ;; AUTHORITY SECTION:
                                                                              
                                                                              ;; ADDITIONAL SECTION:
                                                                              
                                                                              ;; Query time: 165 msec
                                                                              ;; SERVER: 8.8.8.8
                                                                              ;; WHEN: Sat Jan 23 10:52:03 2016
                                                                              ;; MSG SIZE  rcvd: 103
                                                                              [2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.live.com
                                                                              ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 43314
                                                                              ;; flags: qr aa rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 
                                                                              ;; QUESTION SECTION:
                                                                              ;; rad.live.com.	IN	A
                                                                              
                                                                              ;; ANSWER SECTION:
                                                                              rad.live.com.	60	IN	A	10.10.10.1
                                                                              
                                                                              ;; AUTHORITY SECTION:
                                                                              
                                                                              ;; ADDITIONAL SECTION:
                                                                              
                                                                              ;; Query time: 0 msec
                                                                              ;; SERVER: 127.0.0.1
                                                                              ;; WHEN: Sat Jan 23 10:52:04 2016
                                                                              ;; MSG SIZE  rcvd: 46
                                                                              
                                                                              
                                                                              1 Reply Last reply Reply Quote 0
                                                                              • RonpfS
                                                                                RonpfS last edited by

                                                                                Maybe it is the time for pfBlockerNG to rebuild the database after you made a change.

                                                                                Go to pfBlockerNG: Update, View log to see when the process is done.

                                                                                1 Reply Last reply Reply Quote 0
                                                                                • BBcan177
                                                                                  BBcan177 Moderator last edited by

                                                                                  @kripz:

                                                                                  EDIT: Why does it take a few lookups for the IP to be blocked?

                                                                                  Looks like that domain was previously cached by Unbound…
                                                                                  rad.msn.com.nsatc.net.   299 IN A 111.221.29.189

                                                                                  1 Reply Last reply Reply Quote 0
                                                                                  • J
                                                                                    jc2it last edited by

                                                                                    So basically you think it's Firefox? But I have no Bing (removed it from search options in Firefox), I use no Bing, I've never been there in my whole live… Firefox was running in PRIVATE mode all the time btw...

                                                                                    So: why does my OS/Browser try to contact OVER AND OVER AGAIN something I've never asked to contact? Things are not really getting better at this point...

                                                                                    2chemlud I believe various other search engines resell Bing results. Is it possible you are using one of these search engines. I am thinking of yahoo in particular, but I would bet there are others.

                                                                                    1 Reply Last reply Reply Quote 0
                                                                                    • First post
                                                                                      Last post

                                                                                    Products

                                                                                    • Platform Overview
                                                                                    • TNSR
                                                                                    • pfSense Plus
                                                                                    • Appliances

                                                                                    Services

                                                                                    • Training
                                                                                    • Professional Services

                                                                                    Support

                                                                                    • Subscription Plans
                                                                                    • Contact Support
                                                                                    • Product Lifecycle
                                                                                    • Documentation

                                                                                    News

                                                                                    • Media Coverage
                                                                                    • Press
                                                                                    • Events

                                                                                    Resources

                                                                                    • Blog
                                                                                    • FAQ
                                                                                    • Find a Partner
                                                                                    • Resource Library
                                                                                    • Security Information

                                                                                    Company

                                                                                    • About Us
                                                                                    • Careers
                                                                                    • Partners
                                                                                    • Contact Us
                                                                                    • Legal
                                                                                    Our Mission

                                                                                    We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

                                                                                    Subscribe to our Newsletter

                                                                                    Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

                                                                                    © 2021 Rubicon Communications, LLC | Privacy Policy