eBlocker Open Source Forum - Recent Topics

eBlocker Intercepting Traffic on Disabled Devices

jimmysofat6864 — Sun, 01 Nov 2026 05:35:35 +0000

I have eBlocker disabled in the settings for my Windows PC but I have it enabled for other devices on the network. But for some reason, eBlocker is still trying to intercept traffic from my Windows PC. When this occurs, I get DNS errors, page loading errors, or I get this error message saying "ERR_ICAP_FAILURE"

Since this machine is set to exempt, eBlocker should have completely bypassed my machine and not process it but it is still trying to process requests from my PC.

This doesn't seem to be an issue for the say first few hours of operation but given maybe a day or two, certain web requests such as clicking links in gmail lead to a page that never loads followed by the eBlocker error message which should have never been displayed in the first place since it's disabled in the eBlocker device settings.

The error message I see on the device with eBlocker disabled is as follows.

ERR_ICAP_FAILURE
Q0xUX1JFUU1PRF9BQk9SVA== (CLT_REQMOD_ABORT)

Expected Behavior:

When a device is set to "Not Protected", eBlocker should immediately cease sending gratuitous ARP replies for that host, stop proxying outbound HTTP/HTTPS traffic, and allow direct Layer 2/3 routing to the actual default gateway.

Current Behavior:

Certain web links time out and fail to load. Or in my case, I was restoring an iPhone in recovery mode via iTunes/Apple Devices/3uTools and I kept getting itunes error 1109. After extensive poking around and confirming that my eBlocker was disabled, the only way for me to restore and wipe my iPhone via iTunes was to power off my eBlocker and my iPhone restored successfully and the webpages I was trying to view loaded correctly.

1748

1749

eBlockerOS 3 and 4 are not vulnerable to eMudhra CAs with weak keys

Boris — Mon, 26 Oct 2026 12:58:38 +0000

It was found that several intermediate CA certificates by the eMudhra CA used very weak private keys.

For details, see for example eMudhra Intermediate CA Compromise.

The problem is that the private keys are now public and anyone can issue server certificates with these CAs.

Although the CA certificates with weak keys were revoked, I tested whether eBlocker could be vulnerable to server certificates issued by them.

The short answer is: no, eBlockerOS 3 and 4 are not vulnerable to these CA keys.

More details below...

There could be two potential attack vectors on eBlocker:

Fake the server certificate for any domain if eBlocker is intercepting HTTPS.
Fake the certificates of eBlocker's license and update servers: my.eblocker.org, api.eblocker.org and apt.eblocker.org.

Fake any server certificate

eBlocker's certificate validator downloads certificate revokation lists (CRLs) and prevents HTTPS connections to servers with certificates signed by one of the eMudhra CAs with weak keys.

Testing: enable HTTPS and go to https://emudhra.we-have-a-problem.com.

Tests with eBlockerOS 3.2.3 and 4.0.3 were successful: server certificates issued by the revoked eMudhra CAs were not accepted by eBlocker.

Fake license and update server certificates

The license server uses eBlocker's own certificate CAs and roots. If eBlocker tries to connect to a server (my.eblocker.org or api.eblocker.org) with a fake certificate, the Java client on the eBlocker does not allow the connection:

PKIX path building failed: ...
unable to find valid certification path to requested target

What about the update server at apt.eblocker.org?

The update server also has a certificate issued by eBlocker's own CA. If the system updater apt-get connects to a fake server it throws the error:

Certificate verification failed: The certificate is NOT trusted.
The certificate issuer is unknown.
Could not handshake: Error in the certificate verification.

But: even if it would be possible to get the eBlocker to connect to a fake update server, the code signatures would not match with eBlocker's GPG code signing keys, so updates would fail anyway.

No PHP2Shell security issue on eBlocker.org

Random — Wed, 21 Oct 2026 16:31:08 +0000

Today, we have instantly patched our PHP based website to avoid the PHP2Shell high severity security bug.

Your data is safe and we were able to apply the patch in less than an our after it's release.
Thanks to @bpr and @benne for the super quick reaction. 🚀

Read more about the bug here: https://cert.europa.eu/publications/security-advisories/2026-018/

An overview of the issue from the German Bundesamt für die Sicherheit in der Informationstechnik: https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2026/261021_PHP-kritische-Schwachstelle.html

eBlockerOS is not affected by the bug as it does not use PHP.

eBlocker keeps claiming certificate is not installed when it is installed

jimmysofat6864 — Mon, 19 Oct 2026 05:43:31 +0000

For some reason I cannot get my eBlocker error message to disappear when it is on the menu bar. It keeps showing the explanation mark but when I click it, it says the certificate is not installed but I already confirmed the certificate is installed and when I go to the function tests, they all work and it says the certificate is installed. I think the accuracy of the error messages needs to be fixed so they show up correctly or if there is an error, it needs to populate the correct error message.

1747 1745 1746

Move eBlocker to Vacation Location

Hartmut — Wed, 07 Oct 2026 07:45:03 +0000

My eBlocker is working fine at my home environment.

Can I take the eBlocker to a vacation environment, fare away from my home but Germany, where also a router is available and connect eBlocker to it ?

In other words, during vacation I want to be secured by the eBlocker. At home there is the FritzBox running alone.

When coming back from vacation eBlocker will be added to home environment soon.

Are there any issues to do this - or should I follow a special routine for adding eBlocker at vacation location ?

Kind regards Hartmut

NETDEV Watchdog reset eth adapter

RJ1 — Sun, 04 Oct 2026 14:56:40 +0000

Hi,

first of all I'm not tech savy, but while testing eBlocker OS 4.03 I'm getting this error message on the VirtualBox VM (see the attached picture):

" e1000 0000:00:03.0 eth0: NET e1000 0000:00:03.0 eth0: NETDEV WATCHDOG: CPU: transmit queue 0 timed out 5632 ms e1000 0000:00:03.0 eth0: reset eth adapter"

and this keeps on repeating multiple times a day.

Now I read in the Red Hat documentation that this could be because the Linux kernel stopped receiving completed packets from my network interface card (NIC) for too long. Suggestion there is to force a driver reset using ethtool to turn off tx and rx checksum or segmentation offloading. Is this a plausible explanation? And is it possible for me to test that in eBlocker since it is a closed OS?

Any help is appreciated :-)

About my setup: Function testing is all green except for IP6 which I disabled in the router

1744

Hardware you use for running eBlockerOS > Intel NUCi7 with Intel PRO/ 1000MT Desktop NIC running as a server in network
eBlockerOS version as well as filter lists version > 4.03
eBlocker network mode (auto, individual or expert) > auto
eBlocker network settings (IP, mask, gateway) > Automatic, IP address 192.168.178.119, Networkmask 255.255.255.0, Gateway 192.168.178.1
Which devices runs DHCP server? Router/external, eBlocker or client fixed IP? > Router runs DHCP, clients have locked IP's
IPv6 disabled for client/network? Disabled in router
eBlocker DNS firewall settings > eBlocker is DNS Server, forwarding DNS requests is Default
Client network settings (IP, mask, DNS, gateway) >192.168.178.38
Whether eBlocker’s https integration is enabled for client > Yes
Client browser and OS version (i.e. FireFox 80.1 running on macOS 13.4) Win11 24H2, Edge 154.0.4258.53
Additional non default Blockers enabled? (like DuckDuckGo, Consent-Blocker, custom lists etc.) > No
HTTPS Auto Trust App enabled? > No
Exact way or a link / screenshot to reproduce the issue
If VPN or Tor is enabled for the client in eBlocker (and which VPN provider you are using) >No
Are automatic updates enabled? > Yes

Idea: Grouping of devices within the GUI of eblocker

Julius — Fri, 25 Sep 2026 17:54:40 +0000

Hi,

I just spent some time figuring out that my computer was connected to two networks—one LAN and one Wi-Fi. And I had trouble with eblocker not working correctly. Now I’ve correctly named both connections and configured both using eblocker.
While doing so, I came up with an idea for a feature: What if the GUI allowed you to logically group two devices together? For example, “My PC” with two entries—one for LAN and one for Wi-Fi. Since there are also other computers with two LAN ports, etc., this could be a helpful way to organize them (logically/GUI)