Firewall URL Filter Possibly Broken?

[daviworld]

Hi all,

I was looking into finally getting around to dumbing down my smart TV by cutting off its access to tracking & telemetry domain's. However, around the 37th domain, I could no longer add any more ip's, even though the max is listed as 64. Below are the domain's I used, with little note's next to them. I currently entered all the way up to "log-2.samsungacr.com". With no way to proceed forward. I was looking into a possible NVRAM workaround, but didn't see if "nvram set url_rulelist=variable" could enter more than 1 variable without erasing the last.

Clearly, the list of domain's is a tad bit over 64, but I don't plan on using all the domain's, mostly just allowing the app's (Netflix, Hulu, Prime), and firmware updates through.

After reaching the 37th domain name, it will simply keep saying applying, and afterward's nothing was added. If there's another way this can be done, that someone know's of I'm open to suggestion's

# samsung

device-metrics-us.amazon.com
samsungacr.com
samsungcloudsolution.com
samsungcloudsolution.net
pavv.co.kr
samsungotn.net
samsungrm.net
samsungelectronics.com
samsungadhub.com
samsungosp.com
samsungqbe.com
Coordinator-Production-28516768.us-east-1.elb.amazonaws.com (too long)
abtauthprd.samsungcloudsolution.com (too long)
acr0.samsungcloudsolution.com
ad.samsungadhub.com
amauthprd.samsungcloudsolution.com (too long)
api-hub.samsungyosemite.com
auth.samsungosp.com
az43064.vo.msecnd.net
cdn.samsungcloudsolution.com
cdn.samsungcloudsolution.net
d179kwmlpc4o47.cloudfront.net
d1jwpcr0q4pcq0.cloudfront.net
d1oxlq5h9kq8q5.cloudfront.net
d2tnx644ijgq6i.cloudfront.net
d3mjsomixevyw7.cloudfront.net
dev-multiscreen.samsung.com
fkp.samsungcloudsolution.com
fkp.samsungcloudsolution.net
game.internetat.tv
gld.samsungosp.com
gpm.samsungqbe.com
i-stream.pl
infolink.pavv.co.kr
lcprd1.samsungcloudsolution.net
log-1.samsungacr.com
log-2.samsungacr.com (37 so far)
log-3.samsungacr.com (problem domain? won't filter)
log.internetat.tv
multiscreen.samsung.com (problem domain?)
notice.samsungcloudsolution.com
noticecdn.samsungcloudsolution.com (too long)
noticefile.samsungcloudsolution.com (too long)
ns11.whois.co.kr
oempprd.samsungcloudsolution.com
oempprd.samsungcloudsolution.net
openapi.samsung.com
osb.samsungqbe.com
otnprd10.samsungcloudsolution.net
otnprd11.samsungcloudsolution.net
otnprd8.samsungcloudsolution.net
otnprd9.samsungcloudsolution.net
pipeaota.com
premium-videos.telly.com
prov.samsungcloudsolution.com
rd.samsungadhub.com
sas.samsungcloudsolution.com
sca.samsung.com
sso.internetat.tv
syncplusconfig.s3.amazonaws.com
targeted-config-test.samsungacr.com
test.samsungrm.net
time.samsungcloudsolution.com
upu.samsungelectronics.com
us-api.samsungyosemite.com
vd.emp.prd.s3.amazonaws.com
vdterms.samsungcloudsolution.com
www.samsungotn.net
www.samsungrm.net
xpu.samsungelectronics.com
acr0.samsungcloudsolution.com
d1oxlq5h9kq8q5.cloudfront.net
d179kwmlpc4o47.cloudfront.net
www.samsungrm.net
www.samsungotn.net
game.internetat.tv
ns11.whois.co.kr
infolink.pavv.co.k
rwww.samsungotn.net
premium-videos.telly.com
targeted-config-test.samsungacr.com (too long)
syncplusconfig.s3.amazonaws.com
cdn.samsungcloudsolution.com
oempprd.samsungcloudsolution.com
time.samsungcloudsolution.com (required, don't add)
lcprd1.samsungcloudsolution.net

ads.samsungads.com
configprd.samsungcloudsolution.net
log-ingestion.samsungacr.com
ypu.samsungelectronics.com
osb-apps.samsungqbe.com
osb-krsvc.samsungqbe.com
musicid.samsungcloudsolution.com
cpu.samsungelectronics.com

# Other useless connections from Smart-TV

get.geo.opera.com
xml.opera.com
itv.ard.de
cert-test.sandbox.google.com
googleads.g.doubleclick.net
hbbtv.redbutton.de
hbbtv.zdf.de
drscdn.500px.org
tv-static.scdn.co
api.nfl.com
apicache.vudu.com
tv.deezer.com
cdns-content.dzcdn.net
nbc-jite.nbcuni.com

 

[DonnyJohnny]

Hi all,

I was looking into finally getting around to dumbing down my smart TV by cutting off its access to tracking & telemetry domain's. However, around the 37th domain, I could no longer add any more ip's, even though the max is listed as 64. Below are the domain's I used, with little note's next to them. I currently entered all the way up to "log-2.samsungacr.com". With no way to proceed forward. I was looking into a possible NVRAM workaround, but didn't see if "nvram set url_rulelist=variable" could enter more than 1 variable without erasing the last.

Clearly, the list of domain's is a tad bit over 64, but I don't plan on using all the domain's, mostly just allowing the app's (Netflix, Hulu, Prime), and firmware updates through.

After reaching the 37th domain name, it will simply keep saying applying, and afterward's nothing was added. If there's another way this can be done, that someone know's of I'm open to suggestion's

# samsung

device-metrics-us.amazon.com
samsungacr.com
samsungcloudsolution.com
samsungcloudsolution.net
pavv.co.kr
samsungotn.net
samsungrm.net
samsungelectronics.com
samsungadhub.com
samsungosp.com
samsungqbe.com
Coordinator-Production-28516768.us-east-1.elb.amazonaws.com (too long)
abtauthprd.samsungcloudsolution.com (too long)
acr0.samsungcloudsolution.com
ad.samsungadhub.com
amauthprd.samsungcloudsolution.com (too long)
api-hub.samsungyosemite.com
auth.samsungosp.com
az43064.vo.msecnd.net
cdn.samsungcloudsolution.com
cdn.samsungcloudsolution.net
d179kwmlpc4o47.cloudfront.net
d1jwpcr0q4pcq0.cloudfront.net
d1oxlq5h9kq8q5.cloudfront.net
d2tnx644ijgq6i.cloudfront.net
d3mjsomixevyw7.cloudfront.net
dev-multiscreen.samsung.com
fkp.samsungcloudsolution.com
fkp.samsungcloudsolution.net
game.internetat.tv
gld.samsungosp.com
gpm.samsungqbe.com
i-stream.pl
infolink.pavv.co.kr
lcprd1.samsungcloudsolution.net
log-1.samsungacr.com
log-2.samsungacr.com (37 so far)
log-3.samsungacr.com (problem domain? won't filter)
log.internetat.tv
multiscreen.samsung.com (problem domain?)
notice.samsungcloudsolution.com
noticecdn.samsungcloudsolution.com (too long)
noticefile.samsungcloudsolution.com (too long)
ns11.whois.co.kr
oempprd.samsungcloudsolution.com
oempprd.samsungcloudsolution.net
openapi.samsung.com
osb.samsungqbe.com
otnprd10.samsungcloudsolution.net
otnprd11.samsungcloudsolution.net
otnprd8.samsungcloudsolution.net
otnprd9.samsungcloudsolution.net
pipeaota.com
premium-videos.telly.com
prov.samsungcloudsolution.com
rd.samsungadhub.com
sas.samsungcloudsolution.com
sca.samsung.com
sso.internetat.tv
syncplusconfig.s3.amazonaws.com
targeted-config-test.samsungacr.com
test.samsungrm.net
time.samsungcloudsolution.com
upu.samsungelectronics.com
us-api.samsungyosemite.com
vd.emp.prd.s3.amazonaws.com
vdterms.samsungcloudsolution.com
www.samsungotn.net
www.samsungrm.net
xpu.samsungelectronics.com
acr0.samsungcloudsolution.com
d1oxlq5h9kq8q5.cloudfront.net
d179kwmlpc4o47.cloudfront.net
www.samsungrm.net
www.samsungotn.net
game.internetat.tv
ns11.whois.co.kr
infolink.pavv.co.k
rwww.samsungotn.net
premium-videos.telly.com
targeted-config-test.samsungacr.com (too long)
syncplusconfig.s3.amazonaws.com
cdn.samsungcloudsolution.com
oempprd.samsungcloudsolution.com
time.samsungcloudsolution.com (required, don't add)
lcprd1.samsungcloudsolution.net

ads.samsungads.com
configprd.samsungcloudsolution.net
log-ingestion.samsungacr.com
ypu.samsungelectronics.com
osb-apps.samsungqbe.com
osb-krsvc.samsungqbe.com
musicid.samsungcloudsolution.com
cpu.samsungelectronics.com

# Other useless connections from Smart-TV

get.geo.opera.com
xml.opera.com
itv.ard.de
cert-test.sandbox.google.com
googleads.g.doubleclick.net
hbbtv.redbutton.de
hbbtv.zdf.de
drscdn.500px.org
tv-static.scdn.co
api.nfl.com
apicache.vudu.com
tv.deezer.com
cdns-content.dzcdn.net
nbc-jite.nbcuni.com

Check under Tools.
Likely u have reached the max cap for NVRAM usage which is 65536.

 

[ColinTaylor]

Your 37 entries consume slightly under 1000 bytes, so I'd guess that you're hitting the 1000-byte limit for that NVRAM variable.

I'd also be surprised if it actually worked given that it's not effective for HTTPS or compressed HTTP.

 

[daviworld]

Check under Tools.
Likely u have reached the max cap for NVRAM usage which is 65536.

Your 37 entries consume slightly under 1000 bytes, so I'd guess that you're hitting the 1000-byte limit for that NVRAM variable.

I'd also be surprised if it actually worked given that it's not effective for HTTPS or compressed HTTP.

I was afraid of that, guess I 'll look at offloading that to a pi-hole type of firewall then

Yeah considering, more and more tracking services are switching to HTTPS too. I didn't review the header information for the various domain's to see what method they were using, was sorta hoping for the best lol

 

[Adamm]

I was afraid of that, guess I 'll look at offloading that to a pi-hole type of firewall then

Yeah considering, more and more tracking services are switching to HTTPS too. I didn't review the header information for the various domain's to see what method they were using, was sorta hoping for the best lol

Judging by your signature you have AB-Solution installed, you can use the same functionality it has for blocking ads to block any random domain.

 

[daviworld]

Judging by your signature you have AB-Solution installed, you can use the same functionality it has for blocking ads to block any random domain.

I did see AB-Solution had domain blocking via host file, but just recently installed it yesterday and haven't had much time to play around with it yet. I'll give it a try tonight