The pfSense Store

Author Topic: How to block in Windows10 Telemetry with pfsense  (Read 23381 times)

0 Members and 1 Guest are viewing this topic.

Offline ecfx

  • Full Member
  • ***
  • Posts: 198
  • Karma: +27/-11
    • View Profile
Re: How to block in Windows10 Telemetry with pfsense
« Reply #30 on: September 03, 2015, 11:04:33 am »
MS can do whatever they want, but they must be able to make your computer to talk with any new domains ( and they can do this only with an allowed to install update ).
If now you block the telemetry C&C servers, there is no other way your computer will know to talk with new domains until you will install that update.

This is what we have for now, if we have another better way please elaborate ( except unplug the cable, stop using MS OS... ).

Offline robi

  • Hero Member
  • *****
  • Posts: 946
  • Karma: +72/-2
    • View Profile
Re: How to block in Windows10 Telemetry with pfsense
« Reply #31 on: September 06, 2015, 02:32:23 pm »
yes it looks ok.

It's not ok as per your description, because it's a pass rule, not a block rule.

Offline robi

  • Hero Member
  • *****
  • Posts: 946
  • Karma: +72/-2
    • View Profile
Re: How to block in Windows10 Telemetry with pfsense
« Reply #32 on: September 06, 2015, 02:49:05 pm »
Quote
yes it is required because other way update destinations will be blocked from Blocked rule that have these destinations included in case you don't want to allow update.

Huh?  Windows Update domains shouldn't be included in your telemetry alias.

Which are the Windows Update domains, btw?

I found these:
Code: [Select]
windowsupdate.microsoft.com
update.microsoft.com
windowsupdate.com
download.windowsupdate.com
wustat.windows.com
ntservicepack.microsoft.com

Are there any others?

Offline Sea Monkey

  • Newbie
  • *
  • Posts: 10
  • Karma: +1/-0
    • View Profile
Re: How to block in Windows10 Telemetry with pfsense
« Reply #33 on: September 06, 2015, 05:43:28 pm »
yes it looks ok.

It's not ok as per your description, because it's a pass rule, not a block rule.

It's two rules.

Offline Harvy66

  • Hero Member
  • *****
  • Posts: 2076
  • Karma: +177/-11
    • View Profile
Re: How to block in Windows10 Telemetry with pfsense
« Reply #34 on: September 07, 2015, 11:22:23 am »
Setup a WSUS server, whitelist that to talk to Microsoft, and block all clients?

I'm torn between Linux and FreeBSD. Linux has better Steam support, but a lot of stuff is being done in FreeBSD to increase comparability. ZFS and Jails are very attractive, even on a desktop.

Offline 2chemlud

  • Sr. Member
  • ****
  • Posts: 385
  • Karma: +20/-5
    • View Profile
Re: How to block in Windows10 Telemetry with pfsense
« Reply #35 on: September 08, 2015, 10:54:44 am »
Whenever I have the choice, M$-shyt has been replaced by opensuse or PC-BSD (the later has a steeper learning curve and is not so well supported, but is free of systemd). Big plus: you can both run with KDE desktop, which made it much easier to switch between these two, and btw the handling is not sooo far away from Windows xp/7...

 
https://www.youtube.com/watch?v=TlBIa8z_Mts

I have been permanently banned from posting/PM on this forum. Sorry, no replies... ;-)

Offline 2chemlud

  • Sr. Member
  • ****
  • Posts: 385
  • Karma: +20/-5
    • View Profile
Re: How to block in Windows10 Telemetry with pfsense
« Reply #36 on: September 09, 2015, 06:57:40 am »
PS: Here

http://techne.alaya.net/?p=12499

you can find a long list of IPs and host names to block for Windows telemetry.
https://www.youtube.com/watch?v=TlBIa8z_Mts

I have been permanently banned from posting/PM on this forum. Sorry, no replies... ;-)

Offline 2chemlud

  • Sr. Member
  • ****
  • Posts: 385
  • Karma: +20/-5
    • View Profile
Re: How to block in Windows10 Telemetry with pfsense
« Reply #37 on: September 10, 2015, 02:58:48 am »
...just for the record:

I uninstalled on Win 7 pro 64/32 (various computers) the following KBs:

97 1033
290 2907
295 2664
299 0214
302 1917
302 2345
303 5583
304 4374
305 0265
306 2345
306 5987
306 8708
307 5249
307 5851
308 0149
308 3325

and in addition I set up a block rule with loggin for an alias containing all the IPs and host names listed here

http://techne.alaya.net/?p=12499

As you might expect, the firewall log is full of blocked "MS telemetry" this morning.

https://www.youtube.com/watch?v=TlBIa8z_Mts

I have been permanently banned from posting/PM on this forum. Sorry, no replies... ;-)

Offline 2chemlud

  • Sr. Member
  • ****
  • Posts: 385
  • Karma: +20/-5
    • View Profile
Re: How to block in Windows10 Telemetry with pfsense
« Reply #38 on: December 07, 2015, 08:28:32 am »
...just to add:

Had my PC-BSD 10 PC up today for updating. Really amazing, I found in the firewall logs repeated access of this computer to an IP blocked for MS Telemetry.

WHAT has PC-BSD with MS-Telemetry in common? Or is it more correctly NSA telemetry featured by Microshyte?

I'm surprised!

https://www.youtube.com/watch?v=TlBIa8z_Mts

I have been permanently banned from posting/PM on this forum. Sorry, no replies... ;-)

Offline KOM

  • Hero Member
  • *****
  • Posts: 5204
  • Karma: +646/-18
    • View Profile
Re: How to block in Windows10 Telemetry with pfsense
« Reply #39 on: December 07, 2015, 09:16:12 am »
That IP address is a-msedge.net and it takes you to Bing.

Offline 2chemlud

  • Sr. Member
  • ****
  • Posts: 385
  • Karma: +20/-5
    • View Profile
Re: How to block in Windows10 Telemetry with pfsense
« Reply #40 on: December 07, 2015, 09:34:04 am »
So basically you think it's Firefox? But I have no Bing (removed it from search options in Firefox), I use no Bing, I've never been there in my whole live... Firefox was running in PRIVATE mode all the time btw...

So: why does my OS/Browser try to contact OVER AND OVER AGAIN something I've never asked to contact? Things are not really getting better at this point...
https://www.youtube.com/watch?v=TlBIa8z_Mts

I have been permanently banned from posting/PM on this forum. Sorry, no replies... ;-)

Offline KOM

  • Hero Member
  • *****
  • Posts: 5204
  • Karma: +646/-18
    • View Profile
Re: How to block in Windows10 Telemetry with pfsense
« Reply #41 on: December 07, 2015, 10:04:44 am »
No idea.

Offline 2chemlud

  • Sr. Member
  • ****
  • Posts: 385
  • Karma: +20/-5
    • View Profile
Re: How to block in Windows10 Telemetry with pfsense
« Reply #42 on: December 07, 2015, 10:07:47 am »
...sometimes I really think about starting a 24/7 wireshark session on all networks... storage space is so cheap nowadays. How about an integration into pfSense?
https://www.youtube.com/watch?v=TlBIa8z_Mts

I have been permanently banned from posting/PM on this forum. Sorry, no replies... ;-)

Offline KOM

  • Hero Member
  • *****
  • Posts: 5204
  • Karma: +646/-18
    • View Profile
Re: How to block in Windows10 Telemetry with pfsense
« Reply #43 on: December 07, 2015, 10:38:44 am »
Quote
How about an integration into pfSense?

pfSense already has a Capture Packet function.  You want Wireshark??

Offline 2chemlud

  • Sr. Member
  • ****
  • Posts: 385
  • Karma: +20/-5
    • View Profile
Re: How to block in Windows10 Telemetry with pfsense
« Reply #44 on: December 07, 2015, 10:49:59 am »
But is 24/7 feasible on an embedded nano? Not really, I guess. Maybe I set up a Linux machine and start copying the whole internet traffic...

But overall: This story really frustrates me...
https://www.youtube.com/watch?v=TlBIa8z_Mts

I have been permanently banned from posting/PM on this forum. Sorry, no replies... ;-)