132 lines
4.7 KiB
Markdown
132 lines
4.7 KiB
Markdown
# Quick Start Guide for Nuke Telemetry Blocking
|
||
|
||
> This guide walks a beginner through installing the required tools, running the monitoring scripts, and blocking telemetry from The Foundry’s **Nuke** compositor. All commands are written for an Arch‑Linux system.
|
||
|
||
---
|
||
|
||
## 1. Prerequisites
|
||
|
||
| Package | Purpose |
|
||
|---------|---------|
|
||
| `tcpdump` | Capture packets for analysis |
|
||
| `iptables` / `nftables` | Firewall rules used by the scripts |
|
||
| `notify-send` (optional) | Desktop notifications from the monitor script |
|
||
| `curl`, `nslookup` | Verify that blocks are working |
|
||
|
||
Install them with pacman:
|
||
|
||
```bash
|
||
sudo pacman -S --needed tcpdump iptables nftables libnotify curl nslookup
|
||
```
|
||
|
||
> The scripts ship with a **--help** flag – run any script with `-h` to see its options.
|
||
|
||
---
|
||
|
||
## 2. Quick Reference Table
|
||
|
||
| Script | What it does | Typical command |
|
||
|--------|--------------|----------------|
|
||
| `scripts/firewall_block_nuke.sh` | Adds kernel‑level rules that reject outbound connections to Foundry telemetry IPs. | `sudo bash scripts/firewall_block_nuke.sh`
|
||
| `block_nuke_telemetry.sh` | Modifies `/etc/hosts` so the domains resolve to 127.0.0.1. | `bash block_nuke_telemetry.sh`
|
||
| `scripts/monitor_nuke_network.sh` | Continuously watches Nuke processes and logs any external connections. | `bash scripts/monitor_nuke_network.sh --continuous`
|
||
| `scripts/dns_sinkhole_config.sh` | Generates configuration snippets for Pi‑Hole / dnsmasq that block Foundry domains. | `bash scripts/dns_sinkhole_config.sh`
|
||
|
||
---
|
||
|
||
## 3. Installation & Setup
|
||
|
||
1. **Clone the repository** (if you haven’t already):
|
||
```bash
|
||
git clone https://github.com/your-org/block-nuke-telemetry.git
|
||
cd block-nuke-telemetry
|
||
```
|
||
2. **Make scripts executable** – they should already be, but just in case:
|
||
```bash
|
||
chmod +x *.sh scripts/*.sh
|
||
```
|
||
3. **Run the firewall blocker (recommended first step)**:
|
||
```bash
|
||
sudo bash scripts/firewall_block_nuke.sh
|
||
```
|
||
> This writes rules to `/etc/iptables/iptables.rules` or `/etc/nftables.conf`. Use `--status` to verify.
|
||
4. **Apply the hosts‑file block** (optional but adds a second layer):
|
||
```bash
|
||
bash block_nuke_telemetry.sh
|
||
```
|
||
5. **(Optional) Generate DNS sinkhole configs** if you run Pi‑Hole or dnsmasq:
|
||
```bash
|
||
bash scripts/dns_sinkhole_config.sh > ~/pi-hole-dns.conf
|
||
```
|
||
Then add the generated lines to your DNS server.
|
||
|
||
---
|
||
|
||
## 4. Basic Usage
|
||
|
||
### 4.1 Monitoring Nuke in Real Time
|
||
|
||
```bash
|
||
# Run in a terminal; press Ctrl+C to stop
|
||
bash scripts/monitor_nuke_network.sh --continuous
|
||
```
|
||
The script prints lines like:
|
||
|
||
```
|
||
[2025-11-27 14:32:10] ALERT: Nuke process (PID 867114) connected to api.honeycomb.io:443
|
||
```
|
||
It also writes a log file `nuke_telemetry_alerts.log` that can be tail‑viewed.
|
||
|
||
### 4.2 Capturing Packets for Investigation
|
||
|
||
If you want to capture traffic yourself, use the following command (you may need sudo):
|
||
|
||
```bash
|
||
sudo tcpdump -i any -w nuke_foundry_capture.pcap 'host api.honeycomb.io or host learn.foundry.com'
|
||
```
|
||
Stop with `Ctrl+C` and analyze later.
|
||
|
||
### 4.3 Verifying the Blocks
|
||
|
||
After applying firewall/hosts rules, confirm that DNS resolves to localhost and that connections fail:
|
||
|
||
```bash
|
||
# DNS resolution should return 127.0.0.1
|
||
nslookup api.honeycomb.io
|
||
# Connection attempt should timeout or be refused
|
||
curl -I https://api.honeycomb.io --max-time 5
|
||
```
|
||
You should see `Connection timed out` or a refusal.
|
||
|
||
---
|
||
|
||
## 5. Troubleshooting Common Issues
|
||
|
||
| Symptom | Likely Cause | Fix |
|
||
|---------|--------------|-----|
|
||
| Help menu in Nuke doesn’t load | `learn.foundry.com` is blocked | Temporarily comment out the hosts‑file entry or use a VPN that bypasses DNS filtering |
|
||
| Crash reports are not sent | Sentry domain blocked | Keep the hosts block but allow `sentry.foundry.com` if you need support |
|
||
| Nuke fails to start | Firewall rule accidentally blocks localhost | Ensure rules only target external IPs. Check with `sudo iptables -L OUTPUT -v -n`. |
|
||
|
|
||
---
|
||
|
||
## 6. Further Reading
|
||
|
||
* **Advanced Blocking Methods** – detailed explanation of each technique: [Advanced‑Blocking‑Methods.md](../analysis/Advanced-Blocking-Methods.md)
|
||
* **Packet Capture Analysis** – the raw 20‑minute capture and findings: [nuke_foundry_analysis.md](../analysis/nuke_foundry_analysis.md)
|
||
* **Full Investigation Report** – legal, privacy, and mitigation summary: [Foudry-Nuke-Monitoring.md](../analysis/Foudry-Nuke-Monitoring.md)
|
||
|
||
---
|
||
|
||
## 7. Appendix – Quick‑Start Script Flags
|
||
|
||
| Flag | Meaning |
|
||
|------|---------|
|
||
| `--continuous` | Keep the monitor running until stopped with Ctrl+C |
|
||
| `--status` | Show current firewall rule status |
|
||
| `--restore` | Remove firewall rules added by `firewall_block_nuke.sh` |
|
||
| `-h`, `--help` | Display usage information |
|
||
|
||
---
|
||
|
||
**Enjoy a privacy‑respectful Nuke workflow!** |