I’m just curious, what if I’d use my pi-hole to block all connections from/to China on my home network. I have a good bit of automation in place, but mostly western solutions, yet still I wouldn’t be surprised if they called China. Have any of you tried this kind of experiment? Is it even possible to block? What gone down?
Geoblocking is a pretty common practice in enterprise networking.
I block all inbound connections from China and Russia via GeoIP blocking in Opnsense and no one in my household has ever complained. Considering setting it up to blocking outgoing as well, but any Chinese device I’m suspicious of is already isolated from the WAN.
Well, just blocking incoming connections doesn’t add much value. Besides if you also block already established connections, but then it would be easier saying blocking outgoing traffic.
good to know this is an innate feature of opnsense
What’s more suspicious than Alexa or our phones? The "bad guys’ can do jack shit with our data but the “good guys” can fuck us up.
It’s a common feature in a lot of threat management software / firewall systems. Ubiquiti and pfSense both offer it off the top of my head. I’ve used both with no noticeable issues on smart / IOT devices.
I do this, the only problematic thing is the NTP request from my Philips Hue bridge.
This is only going to do so much. If a connection is trully malicious, it’ll probably route through a domestic or EU IP (azure, digital ocean, linode, aws, hetzner, etc)
That said it would be interesting to monitor and see who all your devices are talking too
Why not track how many network calls to and from IP addresses you can geolocate to China you actually see before doing anything? Geolocation using IP is far from perfect
I block a handful of countries I just have no business interacting with. In and out. Doesn’t cause any problems. But you know Microsoft and Amazon aren’t checking ID before letting anyone put a server in one of their DCs? TikTok is all hosted on US servers but that doesn’t mean there isn’t a back door or a copy job sending the data off shore. So I go the extra distance to block a huge list of domestic and safe country international domains that I don’t want traffic going to or from.
Just put it on a seperate network, with no internet connection. Use a server as a passthrough, so you have control. Stay away from anythibg cloud based. Pretty easy stuff honestly.
I hadn’t thought of your concept. Thank you. I’ll go research it now
I block China and Russia on my router and haven’t noticed it one bit. I was most worried about my Tuya lights not working, but even those have been fine.
I think tuya has US data centers. I remember picking something like that when I set up the developer portal.
Note that GeoIP is unreliable so you may accidentally block some IPs that aren’t Chinese. Even whois is not 100% reliable given how often IPv4 addresses are traded these days.
If some Chinese-made technology really phones home, it’s more likely that they’d communicate with a US-based server that would then communicate to servers in China behind-the-scenes.
I use pfblocker ng and block the world inbound except my own region. It’s using maxmind for IP geoloc. Never had any problem with any home automation. All these home automation normally speak to website that are hosted in your region.
I do this. Generally no issues. I’m pretty sure some of the jank cheapo switches will route through the US or other proxy geo first anyway.
You can do it easily, its common practice. It’s also pretty ineffective. You ever notice how VPN’s advertise you can access content outside of your geo location? Surrpise, China can do that too!
We block all traffic that isn’t from NA and Europe in our company (for our hosted applications). We don’t have users outside that so have no reason to accept connections.
It’s just part of our general security strategy