I’m just curious, what if I’d use my pi-hole to block all connections from/to China on my home network. I have a good bit of automation in place, but mostly western solutions, yet still I wouldn’t be surprised if they called China. Have any of you tried this kind of experiment? Is it even possible to block? What gone down?
Geoblocking is a pretty common practice in enterprise networking.
I block all inbound connections from China and Russia via GeoIP blocking in Opnsense and no one in my household has ever complained. Considering setting it up to blocking outgoing as well, but any Chinese device I’m suspicious of is already isolated from the WAN.
What’s more suspicious than Alexa or our phones? The "bad guys’ can do jack shit with our data but the “good guys” can fuck us up.
good to know this is an innate feature of opnsense
Well, just blocking incoming connections doesn’t add much value. Besides if you also block already established connections, but then it would be easier saying blocking outgoing traffic.
I do this, the only problematic thing is the NTP request from my Philips Hue bridge.
It’s a common feature in a lot of threat management software / firewall systems. Ubiquiti and pfSense both offer it off the top of my head. I’ve used both with no noticeable issues on smart / IOT devices.
Just put it on a seperate network, with no internet connection. Use a server as a passthrough, so you have control. Stay away from anythibg cloud based. Pretty easy stuff honestly.
I hadn’t thought of your concept. Thank you. I’ll go research it now
I block almost all Eastern Europe, Russia, the stans, almost all of Africa, Indonesia, China, North Korea and more. No problem. Unifi router allows users to just block by clicking the map.
China would start using vpn.
Why not track how many network calls to and from IP addresses you can geolocate to China you actually see before doing anything? Geolocation using IP is far from perfect
I block a handful of countries I just have no business interacting with. In and out. Doesn’t cause any problems. But you know Microsoft and Amazon aren’t checking ID before letting anyone put a server in one of their DCs? TikTok is all hosted on US servers but that doesn’t mean there isn’t a back door or a copy job sending the data off shore. So I go the extra distance to block a huge list of domestic and safe country international domains that I don’t want traffic going to or from.
I block China and Russia on my router and haven’t noticed it one bit. I was most worried about my Tuya lights not working, but even those have been fine.
I think tuya has US data centers. I remember picking something like that when I set up the developer portal.
I use pfblocker ng and block the world inbound except my own region. It’s using maxmind for IP geoloc. Never had any problem with any home automation. All these home automation normally speak to website that are hosted in your region.
I do this. Generally no issues. I’m pretty sure some of the jank cheapo switches will route through the US or other proxy geo first anyway.
You can do it easily, its common practice. It’s also pretty ineffective. You ever notice how VPN’s advertise you can access content outside of your geo location? Surrpise, China can do that too!
We block all traffic that isn’t from NA and Europe in our company (for our hosted applications). We don’t have users outside that so have no reason to accept connections.
It’s just part of our general security strategy