I’m just curious, what if I’d use my pi-hole to block all connections from/to China on my home network. I have a good bit of automation in place, but mostly western solutions, yet still I wouldn’t be surprised if they called China. Have any of you tried this kind of experiment? Is it even possible to block? What gone down?
Geoblocking is a pretty common practice in enterprise networking.
I block all inbound connections from China and Russia via GeoIP blocking in Opnsense and no one in my household has ever complained. Considering setting it up to blocking outgoing as well, but any Chinese device I’m suspicious of is already isolated from the WAN.
What’s more suspicious than Alexa or our phones? The "bad guys’ can do jack shit with our data but the “good guys” can fuck us up.
good to know this is an innate feature of opnsense
Well, just blocking incoming connections doesn’t add much value. Besides if you also block already established connections, but then it would be easier saying blocking outgoing traffic.
I do this, the only problematic thing is the NTP request from my Philips Hue bridge.
It’s a common feature in a lot of threat management software / firewall systems. Ubiquiti and pfSense both offer it off the top of my head. I’ve used both with no noticeable issues on smart / IOT devices.
I block China and Russia on my router and haven’t noticed it one bit. I was most worried about my Tuya lights not working, but even those have been fine.
I think tuya has US data centers. I remember picking something like that when I set up the developer portal.
Why not track how many network calls to and from IP addresses you can geolocate to China you actually see before doing anything? Geolocation using IP is far from perfect
Note that GeoIP is unreliable so you may accidentally block some IPs that aren’t Chinese. Even whois is not 100% reliable given how often IPv4 addresses are traded these days.
If some Chinese-made technology really phones home, it’s more likely that they’d communicate with a US-based server that would then communicate to servers in China behind-the-scenes.
I use pfblocker ng and block the world inbound except my own region. It’s using maxmind for IP geoloc. Never had any problem with any home automation. All these home automation normally speak to website that are hosted in your region.
I do this. Generally no issues. I’m pretty sure some of the jank cheapo switches will route through the US or other proxy geo first anyway.
You can do it easily, its common practice. It’s also pretty ineffective. You ever notice how VPN’s advertise you can access content outside of your geo location? Surrpise, China can do that too!
We block all traffic that isn’t from NA and Europe in our company (for our hosted applications). We don’t have users outside that so have no reason to accept connections.
It’s just part of our general security strategy
You could also go the extra step, and only have local automations in the home :) home assistant + choosing products well enables total local smarthome stuff. Although I don’t have a robot vacuum.
All my services are self hosted too. Obviously there are limitations: I don’t have fancy voice assistants like Alexa of the likes. But on the flip side I don’t have spies in the house (well, there are… The android phones, and the windows and Mac computers…)
It don’t matter a whole lot, either they are using some cloud computing platform that is us based, or a VPN to bypass your restrictions.
Someone will always be scanning your network, looking for targets. Don’t be surprised.
I have denied all then only white listed US, US outlying areas, and Canada. I don’t do business outside those. This is at the firewall/IP level. Blocking outgoing DNS would probably only affect maybe Alibaba. TikTok for instance runs domestic servers so you have to explicitly block Bytedance.
The number of random attacks per day from China, Russia, and Singapore is hundreds. That’s what firewalls are for.