3

I usually block Safari sites via Terminal on my Mac with sudo nano /etc/hosts command adding websites like 127.0.0.1 www.site.com.

That works for like 99% of the pages, but right now I am trying to block Youtube (and several other sites). I added so much already, but it simply doesn't work; www1/ww1, etc. reboot, empty cache, etc. (All this usually isn't necessary for other sites, but I did it anyway multiple times)

I read many questions about this already, some of them have the same problem, but the answers aren't working e.g.: Some sites not blocked, /etc/hosts

It appears like some sites differ from others, but not sure how to solve this.

0

3 Answers 3

1

I've had success recently using the blocklist functionality of LuLu, working to block some 'non-productive' websites in Safari and Firefox in addition to it's other anti-phone-home capability.

However it won't, as the developer notes, work with Chrome.

Due to limitations of macOS, blocking via host name is only applicable to (as Apple notes) "Network.framework or NSURLSession connections".

As such, for browsers (such as Chrome), that do not leverage these frameworks, only ip address based blocking is supported.

...as Safari and Firefox leverage such frameworks, they are not subject to this limitation.

... but as I restrict my use of Google products as much as I can, that is no particular hardship for me.

0

The macOS resolver seems to do IPv4 and IPv6 address lookups separately, and putting an IPv4 address in /etc/hosts doesn't keep it from looking for an IPv6 address in the public DNS. For sites that have IPv6 addresses (like youtube.com), that means it can find the real site despite the hosts entry.

To fully block a website, you need to add both an IPv4 and and IPv6 address for it (on separate lines) in /etc/hosts, like this:

127.0.0.1 www.site.com
::1 www.site.com
1
  • Some applications ( mostly Google ones ) shunt the traditionnal DNS scheme and implement direct DNS over HTTPS ( = 443 / tcp ) straight toward 8.8.4.4, 8.8.8.8, 2001:4860:4860::8844, 2001:4860:4860::8888 .
    – dan
    Commented Feb 21 at 17:55
0

For your receipe to work, you will have to block 3 DNS protocols:

  • IPv4 ( 53 / UDP ),
  • IPv6 ( 53 / UDP ),
  • DoH ( DNS over HTTPS = 443 / TCP )

As an example, imagine you want to block www.facebook.com whichever of the 3 methods your browser or any other application is using to get an IP address.

Then you will have to give its web servers an IPv4 and IPv6 loopback address and the same for the Google DNS servers over DoH:

127.0.0.1      www.facebook.com
::1            www.facebook.com
127.0.0.1      dns.google
::1            dns.google

If you need to block some other DoH DNS servers, you can find their names on this Github page: List of public DoH servers.

A more appropriate method to block these servers is to use paquet filter ( which is the paquet filtering embedded within macOS ) with either Murus or Lulu.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .