Is there a way to block access to some domains only when not using a VPN?

Question

What I want is to block some websites when I forget to hide my IP with a VPN. so these websites need to be blocked with my own IP but accessible with a VPN.

my router has parental controls and it gives me exactly this but only when I'm at home. if I take my laptop somewhere I can still forget to use a VPN and access those websites. that's why I prefer a software approach if there is one. also, I want these domains to be blocked in my entire PC, so a browser-only approach wouldn't work for me.

is there an app or something that does this? I'm also willing to develop one if there isn't so it would be great if I could get some suggestions on how this might be achievable. for example, is local virtual DNS a thing? like could I make a DNS that runs on my own pc and acts as a middleman and handles these blocked websites and then delegates everything else to a normal DNS?

Answer 1

Yes, local DNS is a thing – though not so much for Windows 10; you'd have better options available if you had it running on Linux or BSD. (There is nothing really "virtual" about it, it's the same kind of software as would be used by many ISPs and works on the same principles.)

Various DNS resolvers support overriding certain queries (including Unbound and Dnsmasq) or at least blocking them outright (BIND 9 using its "RPZ" feature). For example, in unbound.conf:

server:
    # Block queries outright
    local-zone: "example.com." refuse
    # Override with a fake IP address
    local-zone: "example.net." redirect
    local-data: "example.net. A 192.168.0.1"

It seems that dnscrypt-proxy runs on Windows and has support for blocking specific domains.

(For Windows there is also MaraDNS Deadwood, but I'm not sure whether it has anything similar.)

---

There is another mechanism which runs before DNS – the "/etc/hosts" file, which also exists on Windows at %SystemRoot%\System32\Drivers\etc\hosts. It does not require any new services, and is indeed often used for blocking websites.

Run a text editor with Administrator rights, open the 'hosts' file, and add lines which redirect these domain names to some nonexistent IP address:

240.0.0.0   example.com www.example.com
240.0.0.0   example.org
240.0.0.0   mail.example.org

The hosts file has one disadvantage that it cannot match arbitrary subdomains – so you cannot block "*.example.com", although you can individually block "example.com" and "www.example.com".