What is the most effective technique for blocking Youtube on OpenWrt (a Linux-based firmware) based routers?
You may be able to find an opkg that can block based on toplevel domain, but youtube has all kinds of domains. To get a blacklist, you can ssh to your openwrt router, type
tcpdump -ni br0 dst port 53 | tee log and pop open a browser only connecting to youtube. Only have one LAN/WLAN client online when you do this. The file 'log' will contain all outgoing dns requests from interface br0, in cleartext. That could work as a base for a blacklist, but you have to trim it, and be careful to remove stuff like 'update.windows.com' and similar domains.
Alternately, you may find a parental control app in the opkg repo, and do it automagically from there.
1Awesome recommendation, and you are right, it is not that simple. So far I tried adding this to hosts file on OpenWrt router:
127.0.0.1 localhost 127.0.0.1 www.youtube.com 127.0.0.1 m.youtube.com 127.0.0.1 youtube.com 127.0.0.1 youtu.be 127.0.0.1 ytimg.com 127.0.0.1 l.google.com 127.0.0.1 googlevideo.comThis now prevent laptop users to access youtube, but mobile users with youtube app still use it without any problems... I'll definitely use your advice to try to build a better list. But I like this hosts file approach, it is clean and simple. Feb 8, 2017 at 11:21
1That's some sneaky kung-fu:) I always did blacklists based on the IP of the domains (they change due to round-robin, so takes a while to get them all :/), but never thought of nulling them in /etc/hosts. You don't need to change that (at least for the laptop users), the simplest solution that works is the best solution. DNSMASQ can do the rest. Now tcpdump a mobile youtube session and let us know what you come up with 👍🏾 Feb 8, 2017 at 11:41
I captured traffic with tcpdump while IOS (iPhone) Youtube app was streaming - dl.dropboxusercontent.com/u/184632/youtube.pcap Does this help anyone to figure out what is going on? Feb 10, 2017 at 22:10
Just view DNS requests (outgoing to port 53 udp) with wireshark. It's got a filter wizard. Tcpdump's equivalent is 'tcpdump -nr file.pcap dst port 53'. Should be after the A? field. Feb 10, 2017 at 22:48
Using dnsmasq approach seams to work only for desktop clients using web browsers as youtube clients. Using dnsmasq approach fails for mobile users which have youtube apps installed on their mobile phones. It looks like mobile youtube app has hardcoded list of youtube servers and it is using them directly without even doing a dns lookup. May 1, 2017 at 7:19
One approach is to use hosts file and to put any hostnames that browsers on desktops use or apps on mobile phones to access Youtube.
Currently this is how my current OpenWrt hosts file looks like:
127.0.0.1 localhost 127.0.0.1 www.youtube.com 127.0.0.1 m.youtube.com 127.0.0.1 youtube.com 127.0.0.1 youtu.be 127.0.0.1 ytimg.com 127.0.0.1 l.google.com 127.0.0.1 googlevideo.com
This now prevent laptop users to access youtube, but mobile users with youtube app still use it without any problems...
So next step is to build up a blacklist of all domains and IPs that Youtube apps use, so this answer will be updated.
For now this approach seams clean and simple and that is why I like it.
But if apps use google dns or have internal list of Youtube IPs then this approach will fail and only way forward will be to use iptables to drop app traffic with blacklisted Youtube IP.
1Diff this list into hosts: youtube.com ytimg.com ytimg.l.google.com s.ytimg.com youtube.l.google.com googlevideo.com i.google.com Feb 8, 2017 at 12:02
2And this will not block if your user is just a little smart and use an open dns like Google
18.104.22.168– user34720Feb 10, 2017 at 15:34
@nwildner true, do you have some other suggestion what would help? But as most users are mobile phone users this would still work for 95% of users, and for my situation that is actually just fine. Feb 10, 2017 at 22:11
1You could do the same way we did on small offices of our company: Make a "NAT", for every dns query(udp/53) to be redirected to the DNS you want(this case, openwrt itself). We did this to force that, even fixed addresses on DNS of Windows clients be redirected to our internal DNS through OpenVPN ;)– user34720Feb 10, 2017 at 22:34
A fairly straightforward way to block certain sites such as Youtube is to use one of OpenWrt's adblock packages.
It is possible to use the adblock package and its associated Luci web package to block Youtube by just adding the domains e.g.
www.youtube.com m.youtube.com youtube.com youtu.be ytimg.com l.google.com googlevideo.com
to the local blacklist (Services menu-> Adblock->Advanced->Edit blacklist) and saving it,
then going back to the adblock overview and clicking refresh.
You can easily disable it by unchecking the blacklist under the Blocklist Sources and clicking refresh again,
or by just disabling the whole adblock plugin.
I'm sure that this doesn't work on mobile devices because they use hard coded IP addresses, so youtube on android and ios works even when you block/blacklist domains you suggested. Nov 25, 2019 at 11:22
The YouTube app doesn't use hard coded IP addresses as the addresses change dependent on where and when it is used - It also uses DNS for load balancing. If you run Wireshark/tcpdump you can see the DNS queries issued by the app. However, it's possible it is using some additional domains in your region which you would need to add to the blacklist.– PierzNov 25, 2019 at 22:58
Another approach would be to block the YouTube IP range, based on a similar question custom firewall rules can be generated:
config rule option name Block-YouTube-22.214.171.124/16 option src lan option family ipv4 option proto all option dest wan option dest_ip 126.96.36.199/16 option target REJECT
And so on for all IP ranges, be sure to restart the firewall service to apply the changes.
# /etc/init.d/firewall restart