How to block in Windows10 Telemetry with pfsense

RonpfS · Jan 21, 2016, 5:06 PM

This is a good starting point https://forum.pfsense.org/index.php?topic=102470.0

garyn · Jan 22, 2016, 7:12 PM

In topic 102470 (line above), look for reply #18 on Nov 20, 2015. Reply #18 walks you through the setup.

kripz · Jan 22, 2016, 11:53 PM

@garyn:

In topic 102470 (line above), look for reply #18 on Nov 20, 2015. Reply #18 walks you through the setup.

@RonpfS:

This is a good starting point https://forum.pfsense.org/index.php?topic=102470.0

Thanks guys.

In addition to the guide, id like to add that DNSBL is not seperate to pfBlockerNG, it must be enabled for DNSBL to be enabled. Spent 20 mins trying to figure out why DNSBL wouldnt work :D

EDIT: Why does it take a few lookups for the IP to be blocked?

[2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.msn.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 17580
;; flags: qr rd ra ; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; rad.msn.com.	IN	A

;; ANSWER SECTION:
rad.msn.com.	690	IN	CNAME	rad.msn.com.nsatc.net.
rad.msn.com.nsatc.net.	299	IN	A	111.221.29.189

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 472 msec
;; SERVER: 8.8.4.4
;; WHEN: Sat Jan 23 10:51:18 2016
;; MSG SIZE  rcvd: 80
[2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.msn.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 11622
;; flags: qr aa rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; rad.msn.com.	IN	A

;; ANSWER SECTION:
rad.msn.com.	60	IN	A	10.10.10.1

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 0 msec
;; SERVER: 127.0.0.1
;; WHEN: Sat Jan 23 10:51:26 2016
;; MSG SIZE  rcvd: 45
[2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.live.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 59304
;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; rad.live.com.	IN	A

;; ANSWER SECTION:
rad.live.com.	3276	IN	CNAME	rad.msn.com.
rad.msn.com.	576	IN	CNAME	rad.msn.com.nsatc.net.
rad.msn.com.nsatc.net.	299	IN	A	111.221.29.189

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 334 msec
;; SERVER: 8.8.8.8
;; WHEN: Sat Jan 23 10:51:53 2016
;; MSG SIZE  rcvd: 103
[2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.live.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 53764
;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; rad.live.com.	IN	A

;; ANSWER SECTION:
rad.live.com.	3266	IN	CNAME	rad.msn.com.
rad.msn.com.	566	IN	CNAME	rad.msn.com.nsatc.net.
rad.msn.com.nsatc.net.	299	IN	A	111.221.29.189

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 1306 msec
;; SERVER: 8.8.4.4
;; WHEN: Sat Jan 23 10:51:57 2016
;; MSG SIZE  rcvd: 103
[2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.live.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 45495
;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; rad.live.com.	IN	A

;; ANSWER SECTION:
rad.live.com.	3268	IN	CNAME	rad.msn.com.
rad.msn.com.	568	IN	CNAME	rad.msn.com.nsatc.net.
rad.msn.com.nsatc.net.	299	IN	A	111.221.29.189

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 351 msec
;; SERVER: 8.8.8.8
;; WHEN: Sat Jan 23 10:52:01 2016
;; MSG SIZE  rcvd: 103
[2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.live.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 28183
;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; rad.live.com.	IN	A

;; ANSWER SECTION:
rad.live.com.	3262	IN	CNAME	rad.msn.com.
rad.msn.com.	562	IN	CNAME	rad.msn.com.nsatc.net.
rad.msn.com.nsatc.net.	295	IN	A	111.221.29.189

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 165 msec
;; SERVER: 8.8.8.8
;; WHEN: Sat Jan 23 10:52:03 2016
;; MSG SIZE  rcvd: 103
[2.2.6-RELEASE][root@pfSense.local.lan]/root: drill rad.live.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 43314
;; flags: qr aa rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; rad.live.com.	IN	A

;; ANSWER SECTION:
rad.live.com.	60	IN	A	10.10.10.1

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 0 msec
;; SERVER: 127.0.0.1
;; WHEN: Sat Jan 23 10:52:04 2016
;; MSG SIZE  rcvd: 46

RonpfS · Jan 23, 2016, 1:12 AM

Maybe it is the time for pfBlockerNG to rebuild the database after you made a change.

Go to pfBlockerNG: Update, View log to see when the process is done.

BBcan177 · Jan 23, 2016, 1:36 AM

@kripz:

EDIT: Why does it take a few lookups for the IP to be blocked?

Looks like that domain was previously cached by Unbound…
rad.msn.com.nsatc.net. 299 IN A 111.221.29.189

jc2it · Jan 26, 2016, 7:01 PM

So basically you think it's Firefox? But I have no Bing (removed it from search options in Firefox), I use no Bing, I've never been there in my whole live… Firefox was running in PRIVATE mode all the time btw...

So: why does my OS/Browser try to contact OVER AND OVER AGAIN something I've never asked to contact? Things are not really getting better at this point...

2chemlud I believe various other search engines resell Bing results. Is it possible you are using one of these search engines. I am thinking of yahoo in particular, but I would bet there are others.

2chemlud · Jan 27, 2016, 7:02 AM

Hi jc2it!

See below, only search machines installed in Firefox are Startpage, Wikipedia adn Duckduckgo…

So which one is your suspect? :-)

jc2it · Jan 27, 2016, 10:25 PM

@2chemlud:

So which one is your suspect? :-)

:D Well, that is a good question.

2chemlud · Jan 28, 2016, 9:04 AM

…more than once I feel like this with all this techy stuff

scnr…

mattyd · Jun 7, 2016, 10:29 PM

@jc2it:

@2chemlud:

So which one is your suspect? :-)

:D Well, that is a good question.

DuckDuckGo would be my guess. From their Wikipedia page:

"DuckDuckGo emphasizes getting information from the best sources rather than the most sources, generating its search results from key crowdsourced sites such as Wikipedia and from partnerships with other search engines like Yandex, Yahoo!, Bing, and Yummly."