← Back to search

Blocking the network scanning: what actually works

Every model page on this site says the same thing about network scanning: there's no per-model settings toggle for it. That's true, but it's not very actionable on its own. This page is the actionable version — and, just as importantly, a note on what we found while researching it that we're not willing to state as fact.

Why a DNS blocklist alone can fall short

Tools like Pi-hole or AdGuard Home work by intercepting DNS lookups at your router and refusing to resolve known tracking domains. That only works if the device actually asks your resolver. A growing number of connected devices across the industry don't: some hardcode a public DNS server (like 8.8.8.8) into their firmware regardless of what your router's DHCP settings say, and some use encrypted DNS — DNS-over-HTTPS (DoH, over port 443, indistinguishable from normal web traffic) or DNS-over-TLS (DoT, over port 853) — which a domain-blocklist-based tool can't see into at all. This is a documented pattern for connected devices generally. Whether it specifically describes LG's webOS scanning traffic hasn't been confirmed by a source we're willing to cite — see the note at the bottom of this page.

A layered approach

None of these individually require trusting an unverified claim about LG specifically — they're generally good hardening for any device you don't fully trust on your network, TV or otherwise.

1. Run a DNS filter. Pi-hole or AdGuard Home on a spare Raspberry Pi, mini PC, or old laptop. Point your router's DHCP DNS setting at it.
2. Force all DNS through it. On a router running OPNsense, pfSense, or similar, add a NAT/firewall rule redirecting all outbound port 53 traffic to your filter's IP, regardless of what a device tries to use as its resolver. This is what catches a device that ignores your DHCP settings.
3. Block DoT. Deny outbound TCP/UDP port 853 from untrusted devices. DoT always uses that port, so this forces a fallback to plain DNS, which your filter can then see.
4. Block known DoH resolver IPs. You can't block port 443 outright — that breaks streaming — but you can deny it specifically to the small list of well-known public DoH resolvers (8.8.8.8, 1.1.1.1, 9.9.9.9 among them) from your TV's subnet.
5. Put it on its own VLAN. This is the one that doesn't depend on correctly anticipating how a device tries to phone home. An isolated TV can't reach your phones, laptops, or NAS even if every DNS trick above fails. Most enthusiast routers and even some consumer-grade ones support a guest network or VLAN for exactly this.

One gap in the VLAN approach worth being upfront about: it only isolates the network you control. If the TV has WiFi turned on and has ever been given credentials to a network — a saved profile, not something it discovers on its own — nothing stops it from reconnecting to that network instead of the VLAN you set up, and none of the rules above would ever see that traffic. There's no evidence LG TVs autonomously scan for and silently join unfamiliar open networks to evade local controls — that would be a much bigger claim than anything documented — but the safest version of this mitigation is simpler than defending against that anyway: give the TV a wired connection into the isolated VLAN, never give it WiFi credentials at all, and turn WiFi off in its settings. A device with no saved network has nothing to fall back to.

What none of this fixes

ACR — LG's "Live Plus" — analyzes what's on your screen and reports it over ordinary HTTPS to LG's own servers. A DNS filter can block adomain; it can't inspect what's inside an encrypted connection to a domain it has no reason to block, and it certainly can't stop a first-party connection to LG's own infrastructure. The one fix that actually addresses this is turning Live Plus off in the TV's own settings — see your model's page for the exact menu path where we've verified one.

What we're not claiming

While researching this page, a claim came up repeatedly — including in a widely-shared social media post — that LG (and Samsung) TVs specifically hardcode DNS servers and use DoH/DoT to defeat Pi-hole, with a precise detail attached: a TLS connection opening "within 11 seconds of cold boot." That exact figure turned up, worded almost identically, across several near-duplicate SEO articles with no named researcher, no linked packet capture, and no methodology — the pattern of a claim being copied around rather than independently confirmed. It also doesn't appear anywhere in the actual Gamers Nexus / Level1Techs coverage this site is built on, which documented UPnP-based network scanning, not a DNS-bypass mechanism.

So: DNS-bypass techniques like hardcoded resolvers and DoH/DoT are real and documented for connected devices as a category, which is why the mitigation steps above are worth doing regardless. Whether LG's TVs specifically use them is, as of this writing, unverified — and this site would rather tell you that than repeat a number we can't back up.