Sites Blocked in PFsense

Mbeaubrun · January 6, 2021, 2:28pm

Happy new year to all.

IS it possible that sites blocked in PFsense will still be accessible, if the apps are already being accessed outside the network, and the device is brought into the environment.

LTS_Tom · January 6, 2021, 2:59pm

I don’t understand the question.

Mbeaubrun · January 6, 2021, 4:06pm

Sites were blocked in PFsense eg Netflix, but is still accessible on the network through the app on the device, not accessing through the web, which there would be a rule to block url and associate ip addresses.

Since the user would have the app installed on their device they would still be able to access. How would I be able to really lock down the FW for access, regardless in they are using the app or going through the URL.

LTS_Tom · January 6, 2021, 5:07pm

Find the IP’s the app is reaching out to and block them.

Mbeaubrun · January 7, 2021, 8:40pm

This was what was done today:

installed packet capture app on my mobile
ran Netflix app
Took note of the IPs the app was reaching out to
created and alias on the firewall, for the student vlan, listed all IPs from the capture
Applied changes.

When I tested access from my mobile, I was still able to access the service. Is there something i’m missing?

Spectre · January 7, 2021, 9:42pm

Block these domains:

* netflix.com
* netflix.net
* nflxext.com
* nflximg.net
* nflxso.net
* nflxvideo.net

Mbeaubrun · January 7, 2021, 11:08pm

Would those prevent the app from functioning on devices coming into the environment? As that is my aim. Netflix is just one.

Spectre · January 8, 2021, 6:58am

Yes this will block Netflix completely.

Mbeaubrun · January 8, 2021, 4:13pm

Thank you.

Have a few more to block as well, namely:

Instagram
Snapchat
Tictok
Whatsapp
Fortnight

Is it a matter of creating an Alias then adding it to the vpn profile.

Is there a site i can go to get the domains as you did for Netflix?

Regards

Spectre · January 8, 2021, 6:22pm

Here you can find the domains for other services, like WhatsApp and TikTok.

Mbeaubrun · January 9, 2021, 4:44pm

Thanks.

Will take a look and add to the fw. Hopeful I do it correctly and not have to revisit.

Mbeaubrun · January 11, 2021, 6:11pm

Good Day,

Tried with the netflix domains, but was still able to access the app after they were added to the FW rule from my mobile. Was something done wrong?

thegenius · January 12, 2021, 5:15am

No as long as you blocked all of it’s ip address.