FW rule to block YT

Installing and Using OpenWrt
1

Hello all

i’m trying to setup a fw rule to block youtube all day exept from 20 to 22.

I’ve tryed the following rule but doesnt work…

Can someone give me a hint?

Whats wrong there?

Thanks in advance

config rule                                          
        option src 'lan'                             
        option dest 'wan'                            
        option name 'youtube'               
        option target 'REJECT'                       
        option start_time '22:00:00'                 
        option stop_time '20:00:00'                  
        list dest_ip '142.251.33.174'                
        list dest_ip '142.250.81.110'                
        list dest_ip '142.251.32.78'                 
        list dest_ip '142.251.41.78'                 
        list dest_ip '172.217.165.14'                
        list dest_ip '142.251.33.164'                
        option weekdays 'Sun Mon Tue Wed Thu Fri Sat'
        list proto 'tcp'                             
        list proto 'udp'
2

Try with two rules.
The first to allow that traffic from 20 h - 22 h, the second to reject that traffic

3

Also not very likely you've caught all of YT by only blocking 6 IPs.

3 Likes
4

Thanks, btw I started to setup the reject without the timelimit to test the rule and doesnt work.. so i guess its just something i cant do easily on owrt

5

.. and you have ipv4-only internet, right?
and you don't have ipv6 GUA address that clients might (and likely will) prefer in a dual-stack environment when reaching YouTube domain?

1 Like
6

Blocking youtube might involve a lot of (sub)domains which you should better resolve dynamically with nftset

1 Like
7

There is a counter for rule - is it zero? nft list ruleset

8

Good chance, when blocking YT-IPs, that other google based services will not work any more. Anyway, you might experiment using dnsmasq-ip/nft set feature. Quite some info about it on the web; not much luck, though.

9

This is NextDNS’ list of YouTube related domains for reference, to use with dnsmasq and a fw4 ipset:

2 Likes
10

^ needs https://openwrt.org/docs/guide-user/firewall/fw3_configurations/intercept_dns to be reliable.

1 Like
11

Putting the domains into /etc/hosts on the router, having IP 0.0.0.0, should suffice for this list to be effective.

12

Required, but not sufficient. Need to block QUIC, too …

13

Not really, it would not cover subdomains at all, only exact matches.

14

Yep, you are right. But CLI cmds like “echo ‘server=/googlevideo.com/’ >> /etc/dnsmasq.conf” then should do the job, finally. Has the advantage, to force NXDOMAIN, which is faster processed than 0.0.0.0 in /etc/hosts, anyway.

Or, simpler, to use “servers-file=/etc/yt_servers”, having the lines from above just in one separate file. Assuming, no servers-file already configured.

Thank you for code-inspection :slight_smile:

15

Hi there,

just as an idea:
it could be an option to install adblock in OpenWRT with Packages: adblock, luci-app-adblock

and then manifest the youtube urls that are about to be blocked, all other block list could be deleted.

After setting up adblock you could specify a cron system command (System -> Scheduled Tasks) over luci as for example

45 19 * * * service sysntpd restart    #to have the correct time set, after powerout eg
* 20 * * * service adblock stop          #stop adblock at 20:00 and as such allow YT
* 22 * * * service adblock start          #start adblock at 22:00 and as such block YT

With this you could pause adblock within the wanted time frame to allow access to YT.
2 Likes
16

I like this idea, and very close to what I need. I may try that but I would have preferred a “vanilla” way, without installing anything, to do that, that’s why I was trying with firewall rules. And still its not clear to me why i cant block a number of ips and have the rule I described work. I mean i understand its complex to track all related ips of YT but I think that should be a way with FW rules

17

Using firewall-rules is sub-optimal, performancewise. Because redundant DNS needs to be done before. Quite a few comments hinting, why your rule is not working/sufficient. For a start: How about IPv6 IPs of YT ? How about a counter, to see, whether your rule is it, or not ? And you are shure, you cover all YT-IPs ?

Looks like you do not understand quite a few of the posts, trying to help you.

For example, using a crippled-down adblock, as mentioned, results in the same solution, I gave you before. Only having a lot of overhead.

18

I’m not sure at all that i’ve covered all yt ips, btw i’m looking for a solution i’m able to setup. I know ipv6 and all others.. but i had no detailed examples i can start with

19

Looks like your philosophy is “Hardest (solution) first”. OK, in case you are familar with nft rules, for very basic testing, you can disable firewall completely, and use a script instead, called from /etc/rc.local . Which, besides minimum basic rules like masquerade ALSO contains your nft rule(s) to block the YT-IPs. Makes testing much easier. And when you are happy with it, port it to standard firewall. Good excercise, BTW :slight_smile:

20

First try to set up DNS blocking instead. Anything achievable on a home router can be easily bypassed with a random VPN/relay anyway.

  1. Create two IP sets in firewall for IPv4 and IPv6 each
  2. Create blocking rules that match the sets as well as time
  3. Configure dnsmasq to add YouTube domain results to the IP sets

You’ll probably need dnsmasq-full. dnsmasq might lag when adding an item to a set.

1 Like