Warning
I see many people proposing solutions for other platforms (such as Windows or macOS). I cannot verify the authenticity of those methods, and you should not copy, paste, and run code from random people on the internet without first understanding what it does. Ideally, review every line carefully and, even then, run it with caution in a sandboxed environment.
I personally experienced slowdowns and issues while using the ja-netfilter agent.
I decided to investigate how JetBrains checks license validity, because despite explicitly configuring JetBrains to work offline, it still attempts to validate licenses.
Here are my findings:
Two domains are responsible for revoking invalid licenses:
www.jetbrains.comaccount.jetbrains.com
You can block these domains either on your router or locally using the following iptables commands:
sudo iptables -I OUTPUT -p udp --dport 53 -m string --hex-string "|03|www|09|jetbrains|03|com|" --algo bm -j DROP
sudo iptables -I OUTPUT -p udp --dport 53 -m string --hex-string "|07|account|09|jetbrains|03|com|" --algo bm -j DROP
sudo ip6tables -I OUTPUT -p udp --dport 53 -m string --hex-string "|03|www|09|jetbrains|03|com|" --algo bm -j DROP
sudo ip6tables -I OUTPUT -p udp --dport 53 -m string --hex-string "|07|account|09|jetbrains|03|com|" --algo bm -j DROP
Warning
iptables will reset on reboot unless you make it persistent.
to make iptable persistent on ubuntu (after running above iptable commands):
sudo apt install iptables-persistent
sudo iptables-save | sudo tee /etc/iptables/rules.v4 > /dev/null
sudo ip6tables-save | sudo tee /etc/iptables/rules.v6 > /dev/null
Warning
please remove any unrelated rules and keep only the rules shown above. Additional rules may interfere with other software and services, such as Docker networking.
Typically, to prevent a domain from being resolved, you would use /etc/hosts and route traffic to 127.0.0.1. However, JetBrains began rejecting 127.0.0.1 as a valid license server and started sending UDP requests to well-known DNS providers, bypassing system DNS configurations. While an application is free to implement its own DNS resolution and ignore OS-level settings, it is equally valid to block such attempts. I therefore chose to drop any UDP packets containing these domains, effectively stopping their validation efforts.
The UDP requests were sent to the following providers:
8.8.8.81.1.1.11.0.0.18.8.4.49.9.9.9
I was not expecting this behavior, so I decided to completely block IntelliJ from resolving these domains on my system, regardless of the source.
For now, you can use any license key, even if it has been suspendedsince it cannot be validated with the configuration above.
Exploring and understanding copyright protection mechanisms can be an interesting technical exercise. This information is provided for educational purposes only.
Due to sanctions, I am unable to purchase JetBrains products in my country, so I do not feel I am misusing their software. If circumstances change and I am able to do so, I would definitely support their excellent products. Please align your actions with your own moral principles and justify them accordingly.
@yobra98 i would love to know how can someone have firewall rules on windows with rules on content of the packet (not source and destination) i would appreciate if you found a solution append it to this gist, thank you