3

What is the most effective technique for blocking Youtube on OpenWrt (a Linux-based firmware) based routers?

Improve this question
0

4 Answers 4

Reset to default
1

You may be able to find an opkg that can block based on toplevel domain, but youtube has all kinds of domains. To get a blacklist, you can ssh to your openwrt router, type tcpdump -ni br0 dst port 53 | tee log and pop open a browser only connecting to youtube. Only have one LAN/WLAN client online when you do this. The file 'log' will contain all outgoing dns requests from interface br0, in cleartext. That could work as a base for a blacklist, but you have to trim it, and be careful to remove stuff like 'update.windows.com' and similar domains.

Alternately, you may find a parental control app in the opkg repo, and do it automagically from there.

Improve this answer
6
  • 1
    Awesome recommendation, and you are right, it is not that simple. So far I tried adding this to hosts file on OpenWrt router: 127.0.0.1 localhost 127.0.0.1 www.youtube.com 127.0.0.1 m.youtube.com 127.0.0.1 youtube.com 127.0.0.1 youtu.be 127.0.0.1 ytimg.com 127.0.0.1 l.google.com 127.0.0.1 googlevideo.com This now prevent laptop users to access youtube, but mobile users with youtube app still use it without any problems... I'll definitely use your advice to try to build a better list. But I like this hosts file approach, it is clean and simple.
    – valentt
    Feb 8, 2017 at 11:21
  • 1
    That's some sneaky kung-fu:) I always did blacklists based on the IP of the domains (they change due to round-robin, so takes a while to get them all :/), but never thought of nulling them in /etc/hosts. You don't need to change that (at least for the laptop users), the simplest solution that works is the best solution. DNSMASQ can do the rest. Now tcpdump a mobile youtube session and let us know what you come up with 👍🏾
    – user400344
    Feb 8, 2017 at 11:41
  • I captured traffic with tcpdump while IOS (iPhone) Youtube app was streaming - dl.dropboxusercontent.com/u/184632/youtube.pcap Does this help anyone to figure out what is going on?
    – valentt
    Feb 10, 2017 at 22:10
  • Just view DNS requests (outgoing to port 53 udp) with wireshark. It's got a filter wizard. Tcpdump's equivalent is 'tcpdump -nr file.pcap dst port 53'. Should be after the A? field.
    – user400344
    Feb 10, 2017 at 22:48
  • Using dnsmasq approach seams to work only for desktop clients using web browsers as youtube clients. Using dnsmasq approach fails for mobile users which have youtube apps installed on their mobile phones. It looks like mobile youtube app has hardcoded list of youtube servers and it is using them directly without even doing a dns lookup.
    – valentt
    May 1, 2017 at 7:19
1

One approach is to use hosts file and to put any hostnames that browsers on desktops use or apps on mobile phones to access Youtube.

Currently this is how my current OpenWrt hosts file looks like:

127.0.0.1 localhost
127.0.0.1 www.youtube.com
127.0.0.1 m.youtube.com
127.0.0.1 youtube.com
127.0.0.1 youtu.be
127.0.0.1 ytimg.com
127.0.0.1 l.google.com
127.0.0.1 googlevideo.com

This now prevent laptop users to access youtube, but mobile users with youtube app still use it without any problems...

So next step is to build up a blacklist of all domains and IPs that Youtube apps use, so this answer will be updated.

For now this approach seams clean and simple and that is why I like it.

But if apps use google dns or have internal list of Youtube IPs then this approach will fail and only way forward will be to use iptables to drop app traffic with blacklisted Youtube IP.

Improve this answer
4
  • 1
    Diff this list into hosts: youtube.com ytimg.com ytimg.l.google.com s.ytimg.com youtube.l.google.com googlevideo.com i.google.com
    – user400344
    Feb 8, 2017 at 12:02
  • 2
    And this will not block if your user is just a little smart and use an open dns like Google 8.8.8.8 and 8.8.4.4
    – user34720
    Feb 10, 2017 at 15:34
  • @nwildner true, do you have some other suggestion what would help? But as most users are mobile phone users this would still work for 95% of users, and for my situation that is actually just fine.
    – valentt
    Feb 10, 2017 at 22:11
  • 1
    You could do the same way we did on small offices of our company: Make a "NAT", for every dns query(udp/53) to be redirected to the DNS you want(this case, openwrt itself). We did this to force that, even fixed addresses on DNS of Windows clients be redirected to our internal DNS through OpenVPN ;)
    – user34720
    Feb 10, 2017 at 22:34
1

A fairly straightforward way to block certain sites such as Youtube is to use one of OpenWrt's adblock packages.

luci adblock install

It is possible to use the adblock package and its associated Luci web package to block Youtube by just adding the domains e.g.

www.youtube.com
m.youtube.com
youtube.com
youtu.be
ytimg.com
l.google.com
googlevideo.com

to the local blacklist (Services menu-> Adblock->Advanced->Edit blacklist) and saving it,
then going back to the adblock overview and clicking refresh.
You can easily disable it by unchecking the blacklist under the Blocklist Sources and clicking refresh again,
or by just disabling the whole adblock plugin.

Improve this answer
2
  • I'm sure that this doesn't work on mobile devices because they use hard coded IP addresses, so youtube on android and ios works even when you block/blacklist domains you suggested.
    – valentt
    Nov 25, 2019 at 11:22
  • The YouTube app doesn't use hard coded IP addresses as the addresses change dependent on where and when it is used - It also uses DNS for load balancing. If you run Wireshark/tcpdump you can see the DNS queries issued by the app. However, it's possible it is using some additional domains in your region which you would need to add to the blacklist.
    – Pierz
    Nov 25, 2019 at 22:58
0

Another approach would be to block the YouTube IP range, based on a similar question custom firewall rules can be generated:

/etc/config/firewall

config rule
    option name     Block-YouTube-187.189.89.77/16
    option src      lan
    option family   ipv4
    option proto    all
    option dest     wan
    option dest_ip  187.189.89.77/16
    option target   REJECT

And so on for all IP ranges, be sure to restart the firewall service to apply the changes.

# /etc/init.d/firewall restart
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .