• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

How to block in Windows10 Telemetry with pfsense

Scheduled Pinned Locked Moved Firewalling
80 Posts 19 Posters 55.1k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • F
    foresthus
    last edited by Sep 2, 2015, 7:05 AM

    @KOM:

    A centralized solution would be best.  If you're going to go local, why not just use one of the many utils already out there?

    http://www.oo-software.com/en/shutup10

    http://pxc-coding.com/portfolio/donotspy10/

    Do not use that, you cannot go back without using a " restore point".

    1 Reply Last reply Reply Quote 0
    • N
      n3by
      last edited by Sep 2, 2015, 7:22 AM

      have a look here:

      https://github.com/WindowsLies/BlockWindows

      http://www.ghacks.net/2015/08/28/microsoft-intensifies-data-collection-on-windows-7-and-8-systems/

      1 Reply Last reply Reply Quote 0
      • K
        KOM
        last edited by Sep 2, 2015, 1:57 PM

        Do not use that, you cannot go back without using a "  restore point".

        ShutUp10 will prompt you to let it create one before it applies its changes.  I didn't bother as I can't see any scenario where I would need to undo that stuff.

        1 Reply Last reply Reply Quote 0
        • S
          Sea Monkey
          last edited by Sep 2, 2015, 10:41 PM

          Please forgive me.  I'm a bit of a noob.  Do these look right?

          ![allow update.PNG](/public/imported_attachments/1/allow update.PNG)
          ![allow update.PNG_thumb](/public/imported_attachments/1/allow update.PNG_thumb)
          ![block telemetry.PNG](/public/imported_attachments/1/block telemetry.PNG)
          ![block telemetry.PNG_thumb](/public/imported_attachments/1/block telemetry.PNG_thumb)

          1 Reply Last reply Reply Quote 0
          • N
            n3by
            last edited by Sep 3, 2015, 8:09 AM

            yes it looks ok.

            1 Reply Last reply Reply Quote 0
            • K
              KOM
              last edited by Sep 3, 2015, 1:34 PM

              Your pass rule isn't required unless you've really locked down your LAN.  By default, LAN has full access out to everywhere.

              1 Reply Last reply Reply Quote 0
              • N
                n3by
                last edited by Sep 3, 2015, 1:52 PM

                yes it is required because other way update destinations will be blocked from Blocked rule that have these destinations included in case you don't want to allow update.

                1 Reply Last reply Reply Quote 0
                • K
                  KOM
                  last edited by Sep 3, 2015, 2:20 PM

                  yes it is required because other way update destinations will be blocked from Blocked rule that have these destinations included in case you don't want to allow update.

                  Huh?  Windows Update domains shouldn't be included in your telemetry alias.

                  1 Reply Last reply Reply Quote 0
                  • N
                    n3by
                    last edited by Sep 3, 2015, 2:47 PM

                    some people want to block everyhing because MS can deliver an "security update" that will install telemetry and also use update hosts to get data from computer so this way is better, at least for me to have updates (allow only updates-block everything).

                    1 Reply Last reply Reply Quote 0
                    • K
                      KOM
                      last edited by Sep 3, 2015, 3:15 PM

                      I still don't see how this is a good solution.  Are you literally whitelisting every destination address you want access to and blocking everything else on the Internet?  Because MS can spin up a zillion new domains on a whim.

                      1 Reply Last reply Reply Quote 0
                      • N
                        n3by
                        last edited by Sep 3, 2015, 4:04 PM

                        MS can do whatever they want, but they must be able to make your computer to talk with any new domains ( and they can do this only with an allowed to install update ).
                        If now you block the telemetry C&C servers, there is no other way your computer will know to talk with new domains until you will install that update.

                        This is what we have for now, if we have another better way please elaborate ( except unplug the cable, stop using MS OS… ).

                        1 Reply Last reply Reply Quote 0
                        • R
                          robi
                          last edited by Sep 6, 2015, 7:32 PM

                          @n3by:

                          yes it looks ok.

                          It's not ok as per your description, because it's a pass rule, not a block rule.

                          1 Reply Last reply Reply Quote 0
                          • R
                            robi
                            last edited by Sep 6, 2015, 7:49 PM

                            @KOM:

                            yes it is required because other way update destinations will be blocked from Blocked rule that have these destinations included in case you don't want to allow update.

                            Huh?  Windows Update domains shouldn't be included in your telemetry alias.

                            Which are the Windows Update domains, btw?

                            I found these:

                            windowsupdate.microsoft.com	 
                            update.microsoft.com	 
                            windowsupdate.com	 
                            download.windowsupdate.com	 
                            wustat.windows.com	 
                            ntservicepack.microsoft.com	 
                            

                            Are there any others?

                            1 Reply Last reply Reply Quote 0
                            • S
                              Sea Monkey
                              last edited by Sep 6, 2015, 10:43 PM

                              @robi:

                              @n3by:

                              yes it looks ok.

                              It's not ok as per your description, because it's a pass rule, not a block rule.

                              It's two rules.

                              1 Reply Last reply Reply Quote 0
                              • H
                                Harvy66
                                last edited by Sep 7, 2015, 4:22 PM

                                Setup a WSUS server, whitelist that to talk to Microsoft, and block all clients?

                                I'm torn between Linux and FreeBSD. Linux has better Steam support, but a lot of stuff is being done in FreeBSD to increase comparability. ZFS and Jails are very attractive, even on a desktop.

                                1 Reply Last reply Reply Quote 0
                                • 2
                                  2chemlud Banned
                                  last edited by Sep 8, 2015, 3:54 PM

                                  Whenever I have the choice, M$-shyt has been replaced by opensuse or PC-BSD (the later has a steeper learning curve and is not so well supported, but is free of systemd). Big plus: you can both run with KDE desktop, which made it much easier to switch between these two, and btw the handling is not sooo far away from Windows xp/7…

                                  1 Reply Last reply Reply Quote 0
                                  • 2
                                    2chemlud Banned
                                    last edited by Sep 9, 2015, 11:57 AM

                                    PS: Here

                                    http://techne.alaya.net/?p=12499

                                    you can find a long list of IPs and host names to block for Windows telemetry.

                                    1 Reply Last reply Reply Quote 0
                                    • 2
                                      2chemlud Banned
                                      last edited by Sep 10, 2015, 7:58 AM

                                      …just for the record:

                                      I uninstalled on Win 7 pro 64/32 (various computers) the following KBs:

                                      97 1033
                                      290 2907
                                      295 2664
                                      299 0214
                                      302 1917
                                      302 2345
                                      303 5583
                                      304 4374
                                      305 0265
                                      306 2345
                                      306 5987
                                      306 8708
                                      307 5249
                                      307 5851
                                      308 0149
                                      308 3325

                                      and in addition I set up a block rule with loggin for an alias containing all the IPs and host names listed here

                                      http://techne.alaya.net/?p=12499

                                      As you might expect, the firewall log is full of blocked "MS telemetry" this morning.

                                      1 Reply Last reply Reply Quote 0
                                      • 2
                                        2chemlud Banned
                                        last edited by Dec 7, 2015, 2:28 PM

                                        …just to add:

                                        Had my PC-BSD 10 PC up today for updating. Really amazing, I found in the firewall logs repeated access of this computer to an IP blocked for MS Telemetry.

                                        WHAT has PC-BSD with MS-Telemetry in common? Or is it more correctly NSA telemetry featured by Microshyte?

                                        I'm surprised!

                                        ![BSD to MS 07.12.2015.JPG](/public/imported_attachments/1/BSD to MS 07.12.2015.JPG)
                                        ![BSD to MS 07.12.2015.JPG_thumb](/public/imported_attachments/1/BSD to MS 07.12.2015.JPG_thumb)

                                        1 Reply Last reply Reply Quote 0
                                        • K
                                          KOM
                                          last edited by Dec 7, 2015, 3:16 PM

                                          That IP address is a-msedge.net and it takes you to Bing.

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            [[user:consent.lead]]
                                            [[user:consent.not_received]]