Posted: Tue Dec 31, 2019 23:58 Post subject: Blocking Samsung 'smart' TV from calling home
Greetings
I would like to use dd-wrt on my Netgear R7800 to block my Samsung TV from accessing various web addresses, while allowing it to access others, but I don't know even the terms I would search to get help climbing the learning curve on this.
eg., blacklist any url containing samsung. While all other devices on the network will not be restricted. Is this possible, or am I asking the wrong question maybe?
Any info or assistance on where I could start will be much appreciated!
Most likely should leave it so it can update itself and whatever apps it uses.
However, you can put it on its own network isolated from your main net.
That's how mine is. I also have my TV wired rather than wireless so I have 1 port on router in VLAN isolated net.
Easy if it is wireless but NOT too hard to VLAN either.
Most likely should leave it so it can update itself and whatever apps it uses.
However, you can put it on its own network isolated from your main net.
That's how mine is. I also have my TV wired rather than wireless so I have 1 port on router in VLAN isolated net.
Easy if it is wireless but NOT too hard to VLAN either.
Joined: 04 Aug 2018 Posts: 1447 Location: Appalachian mountains, USA
Posted: Thu Jan 02, 2020 21:04 Post subject:
Alozaros wrote:
add this line in Firewall script, to stop your
tv, to access WAN side/Internet, it will be available on a Local LAN only..
iptables -I FORWARD -i br0 -o $(nvram get wan_iface) -p tcp -s 192.168.1.100 -j DROP
replace 192.168.1.100 with your TV IP...
you could fabricate various rules using iptables
Maybe I'm missing something, but isn't that also going to keep the TV from accessing all of the desired streaming sources? Basically it won't let the TV use TCP on the internet at all, correct? And it's not like you can just override this iptables rule with another more specific one to allow those streaming services, since there may be many IP addresses involved for each. Same problem for blocking specific Samsung sites. Which ones?
I'd love to hear of a solid solution to this problem. I just gave up here, other than of course diving into the TV settings to turn off "sharing" or Smart Interactivity or whatever. Never sign up for anything in the modern world with "smart" in its name! _________________ 2x Netgear XR500 and 3x Linksys WRT1900ACSv2 on 53544: VLANs, VAPs, NAS, station mode, OpenVPN client (AirVPN), wireguard server (AirVPN port forward) and clients (AzireVPN, AirVPN, private), 3 DNSCrypt providers via VPN.
Joined: 08 May 2018 Posts: 14216 Location: Texas, USA
Posted: Thu Jan 02, 2020 21:55 Post subject:
Streaming, software updates, pretty much everything network-related. Which isn't always a good idea if one wants to stay current on software patches. The alternate method of updating software (firmware) is usually via USB stick. The problem with that is, if the TV is mounted on a wall and you didn't insert a USB extension cable to facilitate this, you're in for some fun. If you want to block specific destinations otherwise, well, that could get really complicated as you may wind up running out of nvram space. Ideally, you can separate your TVs on a separate VLAN and then do whatever you wish with security in mind. Or, never allow them to be network aware at all and then just update via USB. I miss the days of regular ol' antenna or cable TV without all this nonsense. _________________ "Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT Pogo - A minimal level of ability is expected and needed... DD-WRT Releases 2023 (PolitePol)
DD-WRT Releases 2023 (RSS Everything)
----------------------
Linux User #377467 counter.li.org / linuxcounter.net
My use for this will be to block specific servers. My TV is a few years old and I only use it online for Netflix, aside from that I get over-the-air TV and use an HTPC setup on a separate device for most everything. I don't use or want to use any of the other online apps on the TV. If the device protests that it needs an update, I can always unblock things for the moment.
With the Parental Controls of my previous router, a TP-Link Archer A7, I could see in the log the servers the TV accesses online, and could collect keywords to block them. Worked pretty well, but this new router is better, and I also want to have some fun configuring and learning network stuff.
I haven't done anything with it yet, but I thought using iptables and or VLAN might allow me to let certain servers be accessed, and others not... is that not right?
Joined: 14 Dec 2015 Posts: 774 Location: 127.0.0.1
Posted: Fri Jan 03, 2020 5:08 Post subject:
kernel-panic69 wrote:
I miss the days of regular ol' antenna or cable TV without all this nonsense.
My best friend used to work at Geek Squad up til a year ago, I said why doesn't best buy have good dumb TV's? He said why would anyone want that? So, I came out rambling with a lot of reasons, and he said oh wow I never thought about it like that. I said if I want to make my TV smart, I do it on my terms not theirs!
Then he said that still make those? I said yeah, and they aren't half bad LOL!! _________________ Tutorial for flashing WRT series WRT Installation,Upgrade & Basic Setup–Cliff Notes
r52242: WRT3200ACM, WRT1200ACv1 & 1 Velop in bridge mode(IoT subnet), r52242 WRT1900ACv1 AP
Velop:2 WHW0101, RE6500, RE9000(AP)
Spectrum - 1000/50
SysLog Watcher 5, New security Onion box coming soon, Fingboxes, PiHoles, NEMS, Cacti, rpisurv
Joined: 16 Nov 2015 Posts: 6436 Location: UK, London, just across the river..
Posted: Fri Jan 03, 2020 7:44 Post subject:
yep using this line will cut off any internet to this TV
there are more elegant ways to block those sites and permit only those you'd need...
I dont think parental controls, keyword-based are working along DD-WRT...usually those block only http sites...
your best bit is a isolated VLAN or managed switch..
as the problem is not all those sites/services on the WAN side, but more likely to isolate the smart TV from connecting to other devices on the LAN side...
on DDWRT iptables rules are working only WAN to LAN and opposite, sadly iptables rule are not affecting LAN to LAN communication... _________________ Atheros
TP-Link WR740Nv1 ---DD-WRT 55630 WAP
TP-Link WR1043NDv2 -DD-WRT 55723 Gateway/DoT,Forced DNS,Ad-Block,Firewall,x4VLAN,VPN
TP-Link WR1043NDv2 -Gargoyle OS 1.15.x AP,DNS,QoS,Quotas
Qualcomm-Atheros
Netgear XR500 --DD-WRT 55779 Gateway/DoH,Forced DNS,AP Isolation,4VLAN,Ad-Block,Firewall,Vanilla
Netgear R7800 --DD-WRT 55819 Gateway/DoT,AD-Block,Forced DNS,AP&Net Isolation,x3VLAN,Firewall,Vanilla
Netgear R9000 --DD-WRT 55779 Gateway/DoT,AD-Block,AP Isolation,Firewall,Forced DNS,x2VLAN,Vanilla
Broadcom
Netgear R7000 --DD-WRT 55460 Gateway/SmartDNS/DoH,AD-Block,Firewall,Forced DNS,x3VLAN,VPN
NOT USING 5Ghz ANYWHERE
------------------------------------------------------
Stubby DNS over TLS I DNSCrypt v2 by mac913
[...]the problem is not all those sites/services on the WAN side, but more likely to isolate the smart TV from connecting to other devices on the LAN side...
on DDWRT iptables rules are working only WAN to LAN and opposite, sadly iptables rule are not affecting LAN to LAN communication...
What type of device on the LAN would it connect to? I had not thought of this.
Joined: 16 Nov 2015 Posts: 6436 Location: UK, London, just across the river..
Posted: Sat Jan 04, 2020 7:46 Post subject:
well.... as they claim to improve connectivity those smart devices sometimes try to connect to devices sitting on LAN side like PC, Phones, Tablets and so on...sometimes those smart devices could be compromised and tapping on the LAN sniffing other communications...
That's y i said its good to isolate all those smart devices on a managed switch and VLAN on the router side...
I personally never trust anything that has IoT or called 'smart' _________________ Atheros
TP-Link WR740Nv1 ---DD-WRT 55630 WAP
TP-Link WR1043NDv2 -DD-WRT 55723 Gateway/DoT,Forced DNS,Ad-Block,Firewall,x4VLAN,VPN
TP-Link WR1043NDv2 -Gargoyle OS 1.15.x AP,DNS,QoS,Quotas
Qualcomm-Atheros
Netgear XR500 --DD-WRT 55779 Gateway/DoH,Forced DNS,AP Isolation,4VLAN,Ad-Block,Firewall,Vanilla
Netgear R7800 --DD-WRT 55819 Gateway/DoT,AD-Block,Forced DNS,AP&Net Isolation,x3VLAN,Firewall,Vanilla
Netgear R9000 --DD-WRT 55779 Gateway/DoT,AD-Block,AP Isolation,Firewall,Forced DNS,x2VLAN,Vanilla
Broadcom
Netgear R7000 --DD-WRT 55460 Gateway/SmartDNS/DoH,AD-Block,Firewall,Forced DNS,x3VLAN,VPN
NOT USING 5Ghz ANYWHERE
------------------------------------------------------
Stubby DNS over TLS I DNSCrypt v2 by mac913
add this line in Firewall script, to stop your
tv, to access WAN side/Internet, it will be available on a Local LAN only..
iptables -I FORWARD -i br0 -o $(nvram get wan_iface) -p tcp -s 192.168.1.100 -j DROP
replace 192.168.1.100 with your TV IP...
you could fabricate various rules using iptables
Maybe I'm missing something, but isn't that also going to keep the TV from accessing all of the desired streaming sources? Basically it won't let the TV use TCP on the internet at all, correct? And it's not like you can just override this iptables rule with another more specific one to allow those streaming services, since there may be many IP addresses involved for each. Same problem for blocking specific Samsung sites. Which ones?
I'd love to hear of a solid solution to this problem. I just gave up here, other than of course diving into the TV settings to turn off "sharing" or Smart Interactivity or whatever. Never sign up for anything in the modern world with "smart" in its name!
This is exactly what I was also thinking. If you use that line code to block your TV from accessing those particular sites, but in reality it is going to block all the streaming sites altogether. So then what will be the use of a Smart TV? If you can't really access your desired streaming services and also updates then what is the point of having a Smart TV?
There should be a way around this.
This is exactly what I've been looking for an answer too. I know people like to use the smart features of a so called smart TV but most CPUs in TVs lack proper media decoding capabilities, are laggy as hell when it comes to Android, and not to mention the privacy implications of having it connected to the internet at all (see camera, microphone spying, monitoring content watched..etc). Get a proper media player like Nvidia Shield or something people. They get updated constantly.
Alozaros wrote:
add this line in Firewall script, to stop your
tv, to access WAN side/Internet, it will be available on a Local LAN only..
iptables -I FORWARD -i br0 -o $(nvram get wan_iface) -p tcp -s 192.168.1.100 -j DROP
replace 192.168.1.100 with your TV IP...
you could fabricate various rules using iptables
Thank you for this. I'm assuming if I setup some sort of DLNA media server, TV would be able to access that?
Joined: 08 May 2018 Posts: 14216 Location: Texas, USA
Posted: Sun Jan 19, 2020 18:56 Post subject:
Samsung firmware updates are constant, as well. I don't know about TVs with cameras or microphones, but you could spend a lot of time blocking all but essential firmware update traffic to and from the TV and it probably wouldn't matter. _________________ "Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT Pogo - A minimal level of ability is expected and needed... DD-WRT Releases 2023 (PolitePol)
DD-WRT Releases 2023 (RSS Everything)
----------------------
Linux User #377467 counter.li.org / linuxcounter.net
