105 lines
2.6 KiB
Plaintext
105 lines
2.6 KiB
Plaintext
# protect.txt — domains that must NEVER be blocked, whatever a source says.
|
|
#
|
|
# One domain per line; "#" starts a comment. A domain here protects itself
|
|
# and its parents: if a list holds the name or a parent of it (blocking
|
|
# "microsoft.com" would block "update.microsoft.com"), the build removes
|
|
# that entry and prints it (PROTECTED in the log, "protected_removed" in
|
|
# manifest.json). Its subdomains can still be listed: protect each name
|
|
# that matters.
|
|
#
|
|
# Keep it to the infrastructure that breaks devices when blocked: search
|
|
# engines, operating system updates, time servers, captive-portal and
|
|
# connectivity checks, certificate checks, and the domains of Warda.
|
|
# Not the public encrypted DNS services: the category bypass must keep
|
|
# them (Warda reaches its upstreams by address).
|
|
|
|
# Warda: every name of the tunnel of Warda (warda-terraform-cloudflare).
|
|
# The names of the boxes (<10 letters>.warda-dns.net) are subdomains, not
|
|
# protected here: allow.txt keeps them out of every list.
|
|
warda-dns.com
|
|
www.warda-dns.com
|
|
cloud.warda-dns.com
|
|
docs.warda-dns.com
|
|
support.warda-dns.com
|
|
bimi.warda-dns.com
|
|
warda-dns.net
|
|
warda-dns.fr
|
|
warda-dns.eu
|
|
tips-of-mine.com
|
|
gitea.tips-of-mine.com
|
|
|
|
# Search engines
|
|
google.com
|
|
www.google.com
|
|
bing.com
|
|
www.bing.com
|
|
duckduckgo.com
|
|
qwant.com
|
|
www.qwant.com
|
|
www.ecosia.org
|
|
search.brave.com
|
|
|
|
# Microsoft: updates, time, connectivity check, sign-in
|
|
update.microsoft.com
|
|
windowsupdate.com
|
|
download.windowsupdate.com
|
|
ctldl.windowsupdate.com
|
|
delivery.mp.microsoft.com
|
|
time.windows.com
|
|
www.msftconnecttest.com
|
|
www.msftncsi.com
|
|
dns.msftncsi.com
|
|
login.microsoftonline.com
|
|
login.live.com
|
|
|
|
# Apple: updates, time, captive portal, sign-in, certificates
|
|
captive.apple.com
|
|
time.apple.com
|
|
time-ios.apple.com
|
|
mesu.apple.com
|
|
swscan.apple.com
|
|
swdist.apple.com
|
|
updates.cdn-apple.com
|
|
appldnld.apple.com
|
|
gs.apple.com
|
|
ocsp.apple.com
|
|
appleid.apple.com
|
|
|
|
# Google / Android: connectivity check, time, updates
|
|
connectivitycheck.gstatic.com
|
|
connectivitycheck.android.com
|
|
clients3.google.com
|
|
www.gstatic.com
|
|
time.android.com
|
|
time.google.com
|
|
android.clients.google.com
|
|
play.googleapis.com
|
|
|
|
# Linux: updates, connectivity checks
|
|
deb.debian.org
|
|
security.debian.org
|
|
archive.ubuntu.com
|
|
security.ubuntu.com
|
|
connectivity-check.ubuntu.com
|
|
nmcheck.gnome.org
|
|
detectportal.firefox.com
|
|
network-test.debian.org
|
|
dl.fedoraproject.org
|
|
mirrors.fedoraproject.org
|
|
|
|
# Time servers (NTP)
|
|
pool.ntp.org
|
|
0.pool.ntp.org
|
|
1.pool.ntp.org
|
|
2.pool.ntp.org
|
|
3.pool.ntp.org
|
|
fr.pool.ntp.org
|
|
time.cloudflare.com
|
|
|
|
# Certificate checks (OCSP, revocation)
|
|
ocsp.digicert.com
|
|
crl3.digicert.com
|
|
ocsp.pki.goog
|
|
ocsp.sectigo.com
|
|
ocsp.globalsign.com
|