How to block a URL ? Doesn't appear to be working

[ColinTaylor]

So it sounds like your DNS is doing what you told it to do.

https://www.snbforums.com/threads/openvpn-dns-selective-routing-questions.28191/#post-217362

I suppose it begs the question, why are you bothering to send your Harmony stuff through the VPN, why not just treat it like normal internet traffic?

 

[cw-kid]

Everything goes through the VPN apart from my cable TV box and the Wii-U.

I guess I could exclude the Harmony hubs.

 

[Pergola Fabio]

can this be done without merlin ?

 

[cw-kid]

I can no longer ping myharmony.com it resolves to 127.0.0.1

However in web browsers I can still access that webpage: www.myharmony.com

How does that work ?

 

[cw-kid]

I can no longer launch the MyHarmony desktop app it comes up with a Server Error - Cross Domain Error so its obviously blocking something.

 

[Pergola Fabio]

Thats verry stange... Another approach, we can setup firewall rules for outfoing traffic , but it needs to be on IP, so if we can obtain the list and also the mirrors...
And offcourse hope they don't change

 

[ColinTaylor]

I can no longer ping myharmony.com it resolves to 127.0.0.1

However in web browsers I can still access that webpage: www.myharmony.com

How does that work ?

Because the hosts file contains hosts, not domains. So if you want to block www.myharmony.com you'd need another entry in the hosts file for it. If you want to block entire domains you'll need to modify dnsmasq.conf.

 

[Pergola Fabio]

@ColinTaylor , can this be done without Merlin?

 

[cw-kid]

Colin OK that makes sense I think. So the entries I have added in to my host file:

127.0.0.1 svcs.myharmony.com
127.0.0.1 content.dhg.myharmony.com
127.0.0.1 logging.dhg.myharmony.com
127.0.0.1 myharmony.com
127.0.0.1 sus.dhg.myharmony.com

So the Harmony hub should now not be able to access any of them right ?

It certainly seems to have stopped the MyHarmony desktop app from launching as it complains now with an error and mentions svcs.myharmony.com

Or would it be better to look at doing this in dnsmasq.conf ?

 

[Jack Yaz]

@ColinTaylor , can this be done without Merlin?

I'd recommend asking this in the non-Merlin forum...

 

[ColinTaylor]

Or would it be better to look at doing this in dnsmasq.conf ?

I can't comment on that as I know nothing about Harmony, the app or how it works.

 

[unsynaps]

Just use IPTABLES to block the MAC address of the Harmony Hub from accessing the internet.

firewall-start

#!/bin/sh
FILENAME=`basename "$0"`

iptables=/usr/sbin/iptables

# create block chains
logger -t CustomScript:$FILENAME "Create BLK_INET chain."
$iptables -N BLK_INET

# block tv from accessing the internet
logger -t CustomScript:$FILENAME "Blocking <device> from accessing the internet."
$iptables -I BLK_INET -m mac --mac-source <INSERT MAC HERE> -j DROP

# jump BLK_INET chain
logger -t CustomScript:$FILENAME "Load BLK_INET chain."
$iptables -I FORWARD 1 -j BLK_INET
$iptables -I OUTPUT 1 -j BLK_INET

A small chunk of my firewall-start script.
I block my TV and Receiver from the internet. Both 2012 devices that really does not get updates anymore but I do use their features on the local LAN (DLNA, iTunes streaming). So just unplugging them is not an option.

The problem with blocking the Harmony Hub is you will not be able to update it. I have one. It REQUIRES the internet to make any changes. So just be aware of that.

Just replace the information inside the <> with your info.

And yes as someone already said. URL blocking now a days is kind of pointless with everything going HTTPS. At least without going to something much more advanced than a simple home router.

 

[ColinTaylor]

Just use IPTABLES to block the MAC address of the Harmony Hub from accessing the internet.

He could just use the option in the router's web interface to do that. Presumably he's having to use the convoluted hostname blocking because some sort of internet access is still required.

 

[loveleeyoungae]

As you're using Merlin fw, I think you should take a look at Diversion.

 

[Pergola Fabio]

@cw-kid, you figured something out?