Why no blocky block?
I've updated the pi-hole dns block list with the following wildcard(s).
(\.|^)googleusercontent\.com$
(\.|^)bc\.googleusercontent\.com$
*.googleusercontent.com
(\.|^)googleusercontent$
The goal is to block the domain pattern: .bc.googleusercontent.com
Example: 191.144.160.34.bc.googleusercontent.com
Yet this doesn't seem to be working, but it's showing as "blocking," but not really?
Digging deeper
Using the netstat local command to check browser connections when you open up Firefox you can see the output IP addresses using: sudo netstat -netp which will print out a list of connections per app with related addresses.
I then take the IP addresses and pass them through shodan to get the output domain names.
#!/bin/bash
ipList=`sudo netstat -anpt | grep ESTABLISHED | awk '{ print $5 }' | cut -d: -f1 | sort -u`
for value in $ipList
do
shodan host $value
done
Which then produces a nice printout:
34.107.243.93
Hostnames: 93.243.107.34.bc.googleusercontent.com
City: Kansas City
Country: United States
Organization: Google LLC
Updated: 2023-12-05T11:07:05.092624
Number of open ports: 2
Ports:
80/tcp
443/tcp
34.149.100.209
Hostnames: 209.100.149.34.bc.googleusercontent.com
City: Kansas City
Country: United States
Organization: Google LLC
Updated: 2023-12-07T17:21:23.928937
Number of open ports: 2
Ports:
80/tcp
443/tcp
34.160.144.191
Hostnames: 191.144.160.34.bc.googleusercontent.com;content-signature-2.cdn.mozilla.net
City: Kansas City
Country: United States
Organization: Google LLC
Updated: 2023-12-01T18:26:06.606691
Number of open ports: 2
Ports:
80/tcp
443/tcp
|-- SSL Versions: -SSLv2, -SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
Nice little helper script. Here's the problem. Whenever you load up Firefox it automagically connects to the googleusercontent stalkerware.
Verify Lookup Working?
When checking nslookup everything seems to be working correctly:
$nslookup 191.144.160.34.bc.googleusercontent.com
Server: 10.0.1.14
Address: 10.0.1.14#53
Name: 191.144.160.34.bc.googleusercontent.com
Address: 0.0.0.0
Name: 191.144.160.34.bc.googleusercontent.com
Address: ::
Which means, it's blocking, but not really? As Mozilla is able to use the raw IP address to get past domain blocking?
According to sudo pihole -d everything is running correctly. The upstream resolver is working, and ALL systems are using the pi both on the router, and I went so far as to hard code it locally as well.
Global
Protocols: LLMNR=resolve -mDNS -DNSOverTLS DNSSEC=no/unsupported
resolv.conf mode: foreign
Current DNS Server: 10.0.1.14
DNS Servers: 10.0.1.14
Link 2 (eth0)
Current Scopes: DNS LLMNR/IPv4 LLMNR/IPv6
Protocols: +DefaultRoute LLMNR=resolve -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 10.0.1.14
DNS Servers: 10.0.1.14
DNS Domain: pi-hole
Link 20 (tun0)
Current Scopes: DNS LLMNR/IPv4 LLMNR/IPv6
Protocols: +DefaultRoute LLMNR=resolve -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 10.0.1.14
DNS Servers: 10.0.1.14
DNS Domain: ~.
I know that IPV6 isn't being used locally or upstream to bypass the routing/domain rules.
$ sysctl -a 2>/dev/null | grep disable_ipv6
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.eth0.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
I.E disabled = true
Any ideas?
Nothing seems to be able to successfully block the googleusercontent.com IP addresses.
A bit stumped at what to try next.
Helpful note, I'm very new with pi-hole so my knowledge is limited.
Thank you - k3y5