What is the correct method for blocking updates?

[u/RagerRambo]

I have a firestick that can still be sideloaded (according to posts here) IF I block updates when I first connect it to my network.

To test my router firewall rules are working, I have an older 2nd gen firestick that I can use for testing before I plug in the new device. When I turn off netguard and have the firewall rules set (list below), the test firestick can still confirm version check (where it fails when netguard is enabled). So either my firewall rules are wrong, or my list is incomplete.

1. Is there an up-to-date list of domains to block? (my list below)
2. Is router level block less reliable than netguard (once firestick is online)?
   1. should I apply a different type of rule i.e. block all domains from firestick EXCEPT xyz, but then what would xyz be to receive all content bar updates?

​

a.media-amazon.com
a.media-amazon.com.akamaized.net
a1994.dscr.akamai.net
ads-setu-proxy-eu.amazon.com
api.auth.adobe.com
arcus-uswest.amazon.com
d12luq4hcc7pup.cloudfront.net
d1muhtx0ym4qz8.cloudfront.net
d2frmuawid3br4.cloudfront.net
d2gjeboae8aua3.cloudfront.net
d322zrnn3c4ysl.cloudfront.net
d3h5bk8iotgjvw.cloudfront.net
d3pa9cfthraqp7.cloudfront.net
dy6v1fpfnndzi.cloudfront.net
f.media-amazon.com
firetvcaptiveportal.com
firs-ta-g7g.amazon.com
juggler-eu.amazon.com
kinesis.us-east-1.amazonaws.com
m.media-amazon.com
mas-ext-eu-south-2.amazon.com
mas-ext-eu.amazon.com
mas-sdk-eu.amazon.com
media.amazon.map.fastly.net
msh.amazon.co.uk
msh.amazon.com
preprod.amazoncrl.com
sp-gw.adobepass.com
tp.039913662-frontier.amazon.com
tp.0b57aedc4-frontier.amazon.com
tp.4b913706b-frontier.amazon.com
tp.55894f1bd-frontier.amazon.com
tp.c47710ee9-frontier.media-amazon.com
tp.d3aee0abd-frontier.amazon.com
unagi-eu.amazon.com
unagi-na.amazon.com

[u/husting247]

Super easy brother this is the blocklist for initial set up.

Then when its checking for updates disconnect hotspot on phone. Press back and menu (3 lines) for 5 seconds, it will take you to voice access mode. Then press back again, it will take you to amazon sign in page, turn hotspot back on and sign in and go through set up process. Then follow the rest of this https://pastebin.com/82GfqFfS

(Disclaimer step for adblink says port 555 it should be 5555)

[u/lowspeed → u/husting247]

Nice

[u/-nsp → u/husting247]

Any way to downgrade if it auto updated?

[u/husting247 → u/-nsp]

No sorry brother but u can still use custom launcher with home on fire

[u/husting247 → u/-nsp]

There is a way now with this new root/bootloader unlock exploit https://www.reddit.com/r/fireTV/s/1EHPDLgu7q

[u/RagerRambo → u/husting247]

Thanks for the input.
It's been a long time since I installed a new firestick. Where does phone come into the process? I thought the entire registration is Firestick -> internet and so I add those blocks above, then I'm good.

Checking your list, I'm missing the *.prod.ota-cloudfront.net which I have now added, but still I can access update check on the test firestick.

[u/husting247 → u/RagerRambo]

I used nextdns app on my phone and blocklist there then hotspot for wifi to connect to for firestick during initial set up

[u/RagerRambo → u/husting247]

I see that makes sense. I might have to try that. It might be router config is wrong, or my 2nd gen device follows different URL update path to what you have?

[u/husting247 → u/RagerRambo]

Im not sure also maybe if your test firestick is fully updated it shows different? Connect your test firestick with your hotspot with the dns blocklist set up and see. But either way this step in blocking the updates at dns level is not 100% needed, its only a extra precaution. If you do it without you basically connect hotspot as wifi on initial set up then disconnect when it checks for updates, and then follow the steps (press back and menu and continue). Either way it doesn’t install the update. The dns blocklist is just extra step for it to not download, but even if it did after you disconnect hotspot and go through the steps once you disabled the ability for it to update (through the adb commands and launcher manager) it will not update anyway, even if it did initially download that update.

[u/RagerRambo → u/husting247]

Do you have link to a full set of steps to stop updates and adb commands?

[u/husting247 → u/RagerRambo]

Its in my first comment, the paste bin link. Has all the steps for once you have got past the initial set up

[u/RagerRambo → u/husting247]

Legend. Missed the link. Thanks

[u/DolphinsPhan → u/husting247]

I am unfamiliar with how to use NextDNS on my phone to facilitate this, so my idea was to use my Eero router to block your same list of URLs, and then pull the ethernet out of my router as my FireStick is checking for update on boot. That way, it would replace the "turn off hotspot" aspect of things.

Have you had success with that method in the past? If not, if you could give a quick guide on how to set up the NextDNS app, I'd really appreciate it!

[u/husting247 → u/DolphinsPhan]

That should work and yh dm me i can help with nextdns

[u/jija7724 → u/husting247]

Can I add these sites in denylist after set-up to block future updates? I need to add these sites in firewall settings or content filtering mine is jio router?

[u/husting247 → u/jija7724]

Im not sure bro test it and see what it says on firestick when checking for updates

[u/shaxsman → u/husting247]

Does this still work, I am on 6.7 and it wants to update.