Blocking IP addresses?

[odan]

Blocking MS hostnames by using the "hosts" file is ok, but how to block this MS IP addresses?

2.22.61.43
2.22.61.66
157.56.106.189

[HristoKolev]

Why can't you just add them to the hosts file? What is the problem?

[W4RH4WK]

@HristoKolev because it does not work as far as I know. The hosts file is used for DNS lookup, apparently there once was a way to block IPs by adding something like 0.0.0.0 1.3.3.7 (whereby 1.3.3.7 is the IP to block) to the hosts file. I tried that in Win10 and it did not work. Maybe I am holding it wrong or we need another way to block traffic to certain IP addresses. Windows Firewall would be an option but that did not work either for me (a few years ago in Win7 regarding some UDP packages send outbound by a certain application).

Routing table would be another option.

[HristoKolev]

Yes. You are right. I had a temporary lapse in my understanding of what the hosts file does.

[HristoKolev]

BTW there are lots of ip addresses that are being pushed in the hosts file by the code and are not blocked by other means.

[odan]

The hosts file contains only the mappings of IP addresses to host names and not IP addresses to IP addresses.

The following command creates an outbound rule to block all traffic from the local computer to a IP address like "2.22.61.43"

netsh advfirewall firewall add rule name="Block MS IP Address 2.22.61.43" dir=out protocol=any remoteip="2.22.61.43" profile=any action=block

Test if it's working

ping 2.22.61.43
General error.

[lallousx86]

So, to implement this is basically a matter of going over all the host names in hosts.txt, resolve names to ip addresses and run the netsh command.

[HristoKolev]

Something like that. The thing is that when I wrote about hosts.txt having ip addresses I was talking about the addresses that the release version put in my hosts file. Apparently someone removed them after that along with duplicated hosts names. So, here are the addresses that where added by the release version:

65.55.108.23
65.39.117.230
23.218.212.69
134.170.30.202
137.116.81.24
204.79.197.200

Maybe make a ips.txt and store them there.

Also a good addition would be a to remove doubles at runtime so that the firewall rules list doesn't get too long for no reason. The same thing for the hosts.txt.

[W4RH4WK]

I now create a new Firewall rule blocking outbound traffic to the IPs. Domains are still redirected to 0.0.0.0 via the hosts file. Seems to work (for now).

[lallousx86]

Ok, I implemented it: #29

[xan2622]

Hi all.

Windows 10 is getting scarier each day.

https://www.microsoft.com/en-us/servicesagreement
Check in section Updates to the Services or Software, and Changes to These Terms.

To sum up: they reserve the right to scan your computer and send you patches and updates for pirated games or softwares..

This is why this tool (DisableWinTracking) is really needed to help users protect their private lives.
Thanks for making this tool stronger and powerful enough to block all these trackers.

[gilsamuelaraujo]

@X-A-N-A-X you miss reading, those terms only apply for Microsoft Services. Which would apply to any microsoft games i guess. Not ALL games or software. google it up, lots of in depth comments on it.

[Red5d]

@StockMaster , It's a slippery slope though. This could potentially be used in the future as an excuse for them to do more scanning and modification of things on your computer beyond just MS software/services.

[10se1ucgo]

I'm working on it

[Destroyarr]

please do not use 0.0.0.0 and 127.0.0.1 to block with hosts file as these are wrongfully representing all network interfaces and localhost in some programs that resolve them like this

use 127.0.0.0 :)

[10se1ucgo]

That makes absolutely no sense. Pretty much everywhere I've looked 0.0.0.0 was suggested. Unless you give me a good reason, my answer is no.

[Destroyarr]

Sorry.

Please do not use in hosts file blocking by
0.0.0.0 blocked.hostna.me
or
127.0.0.1 blopcked.hostna.me

There are apps that try to resolve these - 0.0.0.0 as "all IPv4 interfaces" and 127.0.0.1 as "the local host". Such an app is Process Explorer among others. The blocked hosts start appearing in the app gui where 0.0.0.0 and 127.0.0.1 are used. This interferes with the functionality and usability of such apps.

Please use 127.0.0.0 instead, which works perfectly for blocking.

The error message when an app tries to send to 127.0.0.0 is "general failure" which to the sender app is the same like "no route to host" or "can't send packet" basically. (I'm not a developer and haven't checked the actual return code).

I have tested this and it works.
It also works very fast, as the OS returns the error back to the app right away.

Thank you.

[10se1ucgo]

@networkpro done.

[10se1ucgo]

IP blocking now implemented, v2.2 will be up to download shortly.

[lallousx86]

Good work.