A DNS filter (Pihole) will only stop the TV from DNS resolution, and won't necessarily stop it from trying to phone home to some dodgy servers if the IP addresses of said dodgy servers are baked into the OS.
I don't fully understand why you are concerned about what the TV can access on WAN, and not about what the TV can access on LAN? Put it on its own subnet if you're worried about it sending information back about other devices on your network.
Good point about DNS filter. As for LAN vs WAN, It seems easier to secure your own lan? I don't want the TV acting as a bot net or reporting stuff to some server. So it seems like securing it to only access certain domains would be useful.
Problem is the internet isn't a bunch of domains, but IP addresses. So, google or netflix use a large set of rotating, load balanced, IP addresses for their services and they use domains (and dns resolution at the edge) to provide an IP address for the server closest to you and available at that time.
have you *heard* of Anycast my person
If your router supports it, place the TV on it's own vlan.
I think pi holes only go so far. Unless you also block outbound DNS and have IPS/IDS setup to catch and block it on other ports and via encapsulation inside https... it's just another loosing battle.
If I was a TV manufacturer I'd give absolute fuck all about the DNS address assigned to the TV by your router.... or ANY DNS server that has a RFC1918 address. I'd be writing code that would try to hit DNS on the internet that I can use, possibly on a different port than 53 or via HTTPS tunnel.. I'd also have a few DNS entries hardcoded to IP's owned by the TV manufacturer or a subsidiary or even something in Azure/AWS....aside from trying the obvious 1.1.1.1 and 8.8.8.8 and ensuring the records I need are on those servers..
If you want to create a deny all rule and then spend weeks surfing firewall logs, creating allow rules randomly and via trial and error because half the shit doesn't work on the TV and you didn't write the code so you basically are guesing and googling what it needs to talk to.... have at it. Or. Never connect the TV to the internet. Ever.
I don't fully understand why you are concerned about what the TV can access on WAN, and not about what the TV can access on LAN? Put it on its own subnet if you're worried about it sending information back about other devices on your network.
every device should only have the access it needs. On trust and untrusted. It’s prudent to make sure a chinesium Roku TV can’t phone home to its manufacturer and can only talk to Roku and Netflix.
There’s a shitton of data a TV could send back home without access to the rest of the network. I mean, many tvs now have microphones.
Disconnect the TV from your network. Get an Nvidia shield or a Chromecast for streaming.
Assuming you’re concerned about Chinese software running from your TV, this is the way.
I don't use ddWRT anymore but OpenWRT has nftables I use to block all but some IPs for select devices.
I don't even put my TV on the network though.
Just disconnect the TV and only play media from a device you trust.
Add a simple GLinet router. They are cheap, based on openWRT. As a result they are feature rich.
They will have wifi or Ethernet on board. They will also have filtering capabilities built in with their Luci firmware.
I have my Highsense TV behind Adguard home (local DNS).
Here's the list of major domains that i saw TV connecting to in the last 1 week. I haven't started blocking them yet, reviewing them for now, then I will start blocking.
mediaservices.[.]cdn-apple[.]com
nrdp-ipv6.prod.ftl[.]netflix[.]com
logs.netflix[.]com
recommend-ui-sa.vidaahub[.]com
layout-ui-sa.vidaahub[.]com
home-ui-sa.vidaahub[.]com
ota-tv.vidaahub[.]com
domain.vidaahub[.]com
device-ecom.vidaahub[.]com
pay-vidaa.vidaahub[.]com
partner.vidaahub[.]com
app-tv.vidaahub[.]com
vidaa-base-auth-sa.vidaahub[.]com
tvmodules-vidaa.vidaahub[.]com
geo-bas-sa.vidaahub[.]com
iot-voice-sa.vidaahub[.]com
hub-msg.vidaahub[.]com
params-msg-sa.vidaahub[.]com
ter-jrnl.vidaahub[.]com
cdn-0.nflximg[.]com
acr.unruly[.]co
hisense-0ba453d1.prod.partner.netflix[.]net
I don't currently have any firewall. I have ddwrt as my main router.
DD-WRT has a packet filtering firewall, statefull firewall, NAT and proxy functionality...
Limit what domains it can lookup, force it through proxy that is whitelisted to only the domains you want it to access, and block all outbound traffic for it to the internet. It won’t be perfect.
I did something similar. Took a few hours to review squid/bind logs to find what was needed.
Never connect a TV to the internet, ever. Amazon already not so secretly controls and monitors my life, so I just keep it in the fam and use a Firestick 4K Max.
All that connecting a TV to the internet will do is bring you continued disappointment, with rare upsides such as an elusive good firmware update, as most rarely improve something on the TV without fucking something else up or including a huge downside.
Why do you think they've gotten so cheap lately? They are sold at a loss because they rape your data and feed you ads.... again just like everything else.
Most people who do what you want to do have a more complicated setup with a separate SSID for IOT stuff on it's own isolated VLAN with firewall rules to specific things on the main network such as a Plex/Emby server, ect, if needed.