Question How to block tiktok at the router level? Using ASUS RT-AX88U

[iamgenius]

Hi, I want to block tiktok as I don't want the kids to use it. I followed the instructions in these two pages but it didn't work. I can still access freely. My router is ASUS RT-AX88U.

How To Block TikTok on a Router [Complete Guide] | DeviceTests

Learn how to block the TikTok app on your router and keep it from being accessed on any device in your home.

devicetests.com

Login Asus RT-AX88U Router to Block Website and Apps

Login Asus RT-AX88U to block website and apps to protect your kids and family from spamware and inappropriate internet access

wifirepeater.org

There is one more way in my router which is parental control which I didn't try but I don't want to block it for a specific device. I want to block it for all devices. Thanks.

 

[Justinus]

These filters appear to not work on encrypted traffic and most websites utilize HTTPS these days, so they would be useless to block tiktok.

You could try blocking it based on DNS, but the tiktok app may not acquire content from the main domain. You'd have to find the domains tiktok uses to deliver content and block those as well.

However, it is easy to bypass DNS blocking just by changing the device DNS to an external provider, so that's not really a bulletproof way to block it either.

Maybe someone else can chime in with a better method.

 

[iamgenius]

The two targeted kids are not tech savvy and aren't old enough with mess with DNS settings. So tell me how to do it using DNS for a specific device or the router level. Thanks.

 

[Ajay]

The two targeted kids are not tech savvy and aren't old enough with mess with DNS settings. So tell me how to do it using DNS for a specific device or the router level. Thanks.

https://signup.opendns.com/homefree/

You can block domains their. You need to put the OpenDNS app on your PC to get your internet IP (unless you have a static one). Start with blocking the main TikTok domain. If that doesn't work, you have to look at the stats to find out what other domains TikTok is using.

 

[iamgenius]

Let me get this straight. I went to their website. I can see that I can configure their dns into my router without even signing up:

https://support.opendns.com/hc/en-us/articles/228008687-ASUS-RT-AC68U

but what will that do? Where do I input the domains I want to block?

Regarding my IP, I don't have a static one but I'm using DDNS (no-ip.com).

Thanks.

 

[Ajay]

Let me get this straight. I went to their website. I can see that I can configure their dns into my router without even signing up:

https://support.opendns.com/hc/en-us/articles/228008687-ASUS-RT-AC68U

but what will that do? Where do I input the domains I want to block?

Regarding my IP, I don't have a static one but I'm using DDNS (no-ip.com).

Thanks.

You have to sign up to get access to features like blocking domains.

 

[iamgenius]

Ahaa. Okay will try that tomorrow.

 

[iamgenius]

It wouldn't let me sign up. It gives me an error. I sent an email to them.

 

[Justinus]

It may not be a feasible solution depending on your needs, but using a raspberry pi as a pihole server also can accomplish this. You basically setup a raspberry pi, install pihole, and then set your router to use it as the DNS.

You setup the pihole to use whatever external DNS servers you like, and you can add domains to be blocked (or even entire blocklists of domains, many are publicly available and maintained, especially for ad and malware blocking). I have used a pihole for 6 years now and it's been sublime. One of the features I really like is the DNS query log, where you can examine the DNS requests made to see what domains were accessed at given times, and at the click of a button block a domain (or allow a blocked domain). It has helped a lot for me to identify domains that were on giant (1 million) blocklists that prevented streaming over some streaming services, and also to identify when ads did come through what domains were requested so I could block them.

The cost and effort of getting and setting up a raspberry pi is possibly an issue, depending on your needs.

 

[iamgenius]

It may not be a feasible solution depending on your needs, but using a raspberry pi as a pihole server also can accomplish this. You basically setup a raspberry pi, install pihole, and then set your router to use it as the DNS.

You setup the pihole to use whatever external DNS servers you like, and you can add domains to be blocked (or even entire blocklists of domains, many are publicly available and maintained, especially for ad and malware blocking). I have used a pihole for 6 years now and it's been sublime. One of the features I really like is the DNS query log, where you can examine the DNS requests made to see what domains were accessed at given times, and at the click of a button block a domain (or allow a blocked domain). It has helped a lot for me to identify domains that were on giant (1 million) blocklists that prevented streaming over some streaming services, and also to identify when ads did come through what domains were requested so I could block them.

The cost and effort of getting and setting up a raspberry pi is possibly an issue, depending on your needs.

I can do it but I don't want to. I actually want a quick and easy solution with no extra stuff. I actually bought this specific router for its good parental controls as per the reviews I read.

There is one thing that I still didn't try with this router: Asuswrt-Merlin


Maybe somebody who tried it can tell me if it is capable of doing more than the original firmware when it comes to parental controls. I think it does. Anyways, something came up and it will keep me busy for few days. I'll try this opendns thing when I'm free and see how it goes. If not good, I'll investigate other options.

Thanks to you all.

 

[iamgenius]

There is an emulator for merlin for this router but I don't see how it is different when it comes to parental controls. It is the same as I can see.

http://demoui.asus.com/

 

[Justinus]

There is an emulator for merlin for this router but I don't see how it is different when it comes to parental controls. It is the same as I can see.

http://demoui.asus.com/

I use merlin on all the routers I've had and I've never seen a difference in parental control options.

 

[iamgenius]

I use merlin on all the routers I've had and I've never seen a difference in parental control options.

Are you 100% sure? How about other options in merlin that can help in this case (Blocking a domain)?

 

[iamgenius]

You have to sign up to get access to features like blocking domains.

I have been busy. Anyways, tiktok is now successfully blocked using opendns. The kids will now fight me over it. I now need to deal with that.

 

[iamgenius]

Okay....So tiktok is blocked ( You can't access any of its domains) but phones with the tiktok app already installed will still work. The tiktok app can still load videos. I thought this wouldn't be the case. I still have to do something

 

[Ajay]

Okay....So tiktok is blocked ( You can't access any of its domains) but phones with the tiktok app already installed will still work. The tiktok app can still load videos. I thought this wouldn't be the case. I still have to do something

So the app uses a different domain, or even a cloud provider. Bummer.

Edit: found this https://www.netify.ai/resources/applications/tiktok
OMG! That's allot of domains to block

 

[iamgenius]

So the app uses a different domain, or even a cloud provider. Bummer.

Edit: found this https://www.netify.ai/resources/applications/tiktok
OMG! That's allot of domains to block

Ohh. That's more domains than the ones I blocked. What I have is about 16. I'll add these and see what happens.

 

[iamgenius]

I can't block more than 25 domains using opendns. It didn't allow me. It said the maximum is 25. I wonder if blocking all of tiktok domains will truly block it from the kids devices.

 

[Ajay]

I can't block more than 25 domains using opendns. It didn't allow me. It said the maximum is 25. I wonder if blocking all of tiktok domains will truly block it from the kids devices.

Yeah, limits of the free version.

 

[iamgenius]

But I don't see an option for upgrading the account !?

 

[Ajay]

Well, sorry. The Enterprise version will be way too many $$$$s. I'm not sure what the alternatives are. I don't know if PI-Hole does domain blocking.

 

[Fallen Kell]

Anything using DD-WRT/OpenWRT or Pfsense would be able to block any number of domains. PI-Hole would also block the DNS domain names, but that wouldn't stop an APP that might have IP addresses also embedded (may do this to increase performance as the DNS lookups take time). For DD-WRT/OpenWRT and/or Pfsense, you would be blocking via firewall rules (i.e. there will one or more rule that basically says if the source or destination is one of the list, drop the packet).

Ideally you want to use Pfsense with "pfblockerng" and setup a blocklist pointing to "https://github.com/eng-salem/socialblocklists/blob/master/TikTok/tiktokblocklistWithoutRegex.txt", or any of the other lists out there that has a complete/up-to-date/maintained list of URL's used (as you can see, it is over 1000 domains, which is a LOT more than the 25 limit you have with OpenDNS). This way you simply let pfblockerng check for updated lists every couple hours and you never need to touch it again... That said, pfsense is not the easiest thing to setup and use and you typically need either a very specific router/switch that supports it, or build a physical system or a virtual machine for it and configure it as the main gateway to/from your network (i.e. between your wireless router and your modem). I run mine off an old Dell Small Form Factor 9020 that I got for about $200.

 

[iamgenius]

Well, sorry. The Enterprise version will be way too many $$$$s. I'm not sure what the alternatives are. I don't know if PI-Hole does domain blocking.

I contacted them. The VIP account is only 19.95$ /year and it can block 50 domains. It maybe worth it.

Home Internet Security | OpenDNS

OpenDNS is the easiest way to make your Internet safer, faster and more reliable. Protect your family across all devices on your home network.

www.opendns.com

As a matter of fact, the kids actually started complaining that tiktok is not working properly. I acted dumb and innocent of course. So it is working but some videos still load. This tells me if I block all domains, no videos will load.

 

[iamgenius]

Anything using DD-WRT/OpenWRT or Pfsense would be able to block any number of domains. PI-Hole would also block the DNS domain names, but that wouldn't stop an APP that might have IP addresses also embedded (may do this to increase performance as the DNS lookups take time). For DD-WRT/OpenWRT and/or Pfsense, you would be blocking via firewall rules (i.e. there will one or more rule that basically says if the source or destination is one of the list, drop the packet).

Ideally you want to use Pfsense with "pfblockerng" and setup a blocklist pointing to "https://github.com/eng-salem/socialblocklists/blob/master/TikTok/tiktokblocklistWithoutRegex.txt", or any of the other lists out there that has a complete/up-to-date/maintained list of URL's used (as you can see, it is over 1000 domains, which is a LOT more than the 25 limit you have with OpenDNS). This way you simply let pfblockerng check for updated lists every couple hours and you never need to touch it again... That said, pfsense is not the easiest thing to setup and use and you typically need either a very specific router/switch that supports it, or build a physical system or a virtual machine for it and configure it as the main gateway to/from your network (i.e. between your wireless router and your modem). I run mine off an old Dell Small Form Factor 9020 that I got for about $200.

Ohh my GOODNESS Over 1000 domains ! And I thought 50 maybe enough. This Pfsense can make a good little project in a long vacation. Can I run it in a virtual machine inside one of my physical machines that is placed after the wireless router??? Or the placement is very necessary? i.e. Can I make one machine in my LAN as my gateway to the internet? I'll have to have the VM up all the time though.

Thanks.

 

[Fallen Kell]

Ohh my GOODNESS Over 1000 domains ! And I thought 50 maybe enough. This Pfsense can make a good little project in a long vacation. Can I run it in a virtual machine inside one of my physical machines that is placed after the wireless router??? Or the placement is very necessary? i.e. Can I make one machine in my LAN as my gateway to the internet? I'll have to have the VM up all the time though.

Thanks.

Placement is pretty specific. You might be able to get away with it on a VM from a host physically connected to your wireless router, but you would need to take advantage of VLANs to do so, and also need a wireless router that supports VLAN trunk ports (i.e. a port that is associated with multiple VLANs). Not all wireless routers will give you this capability.

For this example:

Create new VLAN (make it something not in use, probably something like VLAN ID 11) on wireless router (router/software specific, so directions need to be looked up for your hardware), and assign one of the ports to that VLAN (example below assumes port 2). Setup port 3 to default untagged data to main VLAN used by the rest of the switch ports (probably VLAN ID 2, but this varies from manufacturer to manufacturer), but also allow the tagged use of VLAN 11 on port 3. Connect the following:

((INTERNET)) <--> [ISP modem] <---> [Port 2 on Wireless router]

Connect your computer running the VM to port 3. Then when you setup pfsense VM, you can specify that it uses VLANs for routing between the public (WAN) and private (LAN) networks, and specify the appropriate VLAN ID (11 for public, and 2 for the private in this example). When configuring the LAN, specify the an IP address for whatever network you are using on your wireless router's internal net (i.e. if you are using 192.168.1.1 for your wireless router, make the pfsense LAN interface be 192.168.1.2).

You will then need to chage in your wireless router and set it to be in access point mode (and not router mode), and change the default route to be 192.168.1.2 on the wireless router. You can then either let pfsense be your DHCP server or assuming your router still supports it, let it continue to be the DHCP server while acting as an access point (not all wireless routers will allow this level of fine tuning, but DD-WRT/OpenWRT firmware would let you do this).


As you can see it is a lot easier with a physical system, which is partly why I have a physical system (not that I don't have a much more complex setup on mine and am also using VLANs to perform the routing, but that is because I configured my pfsense system to be a router-on-a-stick (i.e. I only have a single physical network cable going to my system, but that said, the single cable I have connected is a QSFP+ 40Gbps link, this way I am prepped in case my ISP ever expands to 10Gbps or higher, as I would simply change the modem, configured a 10Gbps port on my main switch to be my external VLAN, and connect it to that port).