Website blocker options, August 2022

My goal — block ALL installed browsers under Windows (Firefox, Chrome, and Edge), not just one.

As I see it, these are the available strategies:

1. Install a browser extension in each of the three browsers.
   • In my experience, this is the quickest of the available options, because the other ones tend to be rabbit holes.
   • You don't have to unblock and reblock all of them in unison — most likely, only the main browser would get blocked and reblocked on an as-needed basis, and the lesser-used browsers would stay blocked 99% of the time.
2. Install an OS-wide block.
   • C:\Windows\System32\drivers\etc\hosts is always an option. Unfortunately there are a few websites that respond to https://randomsubdomain.facebook.com (TODO — check to see if this is actually true), and the Windows hosts file does not support wildcards.
   • It's possible to install a Javascript PAC (Proxy Auto-Configuration) file on all local browsers, and then just edit the .pac file in one place.
   • Windows Defender Firewall can block IP ranges for outgoing traffic. The only problem with this is that you need to identify most of a website's IP range(s), and this isn't always easy.

Hosts file

Again, that path is C:\Windows\System32\drivers\etc\hosts

• Here's my list of blocks I currently use

In some cases, you may need to restart your browser, and maybe even logout of the service, before your hosts-file changes will work. (many browsers maintain an internal DNS cache)

Windows Defender Firewall

Go to Settings > Windows Defender Firewall > Advanced Settings > Outbound Rules > New Rule > Custom rule. Now navigate to Scope > "Which remote IP addresses does this rule apply to?", and add the IP range(s) to the list.

How to identify a site's IP ranges

• central authorities
  • lookup.icann.org [wikipedia]
  • whois.arin.net [wikipedia]
• third-party tools
  • mxtoolbox.com's "SuperTool" is really good.
  • lookupip.net
• some tools can list ALL IP ranges for a company
  • search.arin.net/rdap/
  • research.domaintools.com/research/reverse-ip-whois/

If you get information like "Class C" or "204.154.94.0/23", then you might have to plug that information into a CIDR calculator. [wikipedia #1] [wikipedia #2]

Specific services:

• Facebook — Its infrastructure is complicated as hell, and they have almost 50 different IP ranges. It's likely you only have to block a few ranges to actually hobble the service. Some suggested ranges — router-reset.com, lifewire.com