Block applications
Block messaging, social, streaming, file-sharing or webmail applications by name, such as WhatsApp, Telegram or TikTok.
Intrusion prevention can also block applications. OPNsense ships application detection rules for 232 applications in six groups; they recognise an application by the names it uses: its DNS queries, the host of its web requests, and the server name its encrypted connections announce (TLS SNI). That works without decrypting traffic. Tested on gate42 2.0: with messaging blocked, WhatsApp Web and Telegram Web stopped working, while other sites kept loading.
| Group | For example |
|---|---|
| messaging (26) | WhatsApp, Telegram, Signal, Teams, Slack, Discord, Skype, Viber, WeChat |
| social-networking (28) | Facebook, Instagram, TikTok, X, LinkedIn, Snapchat, Reddit, Pinterest |
| media-streaming (60) | Netflix, Prime Video, Hotstar, JioCinema, Spotify, Disney+ |
| file-transfer (59) | Dropbox, Google Drive, OneDrive, Mega, iCloud, pCloud |
| mail (32) | Gmail, Outlook.com, Yahoo Mail, Zoho Mail, ProtonMail |
| adult (44) | adult sites and cam services |
Social networks and adult sites can also be blocked for a whole network by DNS, which is lighter: web filtering.
1. Switch on prevention
Application blocking needs intrusion prevention: follow steps 1 and 2 of Block attacks (IPS) first.
2. Download the application rules
- Services › Intrusion Detection › Administration › Download.
- Tick the groups you want, such as OPNsense-App-detect/messaging.
- Download & Update Rules.
On their own these rules only report: Administration › Alerts shows which devices use which applications.
3. Block them
- Services › Intrusion Detection › Policy, click +.
- Rulesets: the groups to block, such as opnsense.messaging.rules.
- Action: Alert; New action: Drop.
- Save, then Apply.
To block only some applications of a group, skip the policy: in the Rules tab search for the application's name (for example WhatsApp), select its rules, choose Drop selected, then Apply.
Limits
Applications are recognised by name, not content. An application that connects to bare IP addresses, or hides its server name (Encrypted Client Hello), can get through; a policy per application group is a strong deterrent, not a guarantee.