Stop an LG TV phoning home — with Pi-hole and any router

In September 2026 an investigation into LG’s webOS reported TVs that keep voice transcripts, enumerate every device on the home network, and fingerprint what is on screen across every input. With a Pi-hole on the network, most of that can be stopped in an evening: block the right names, keep the ones the TV needs, and make sure the TV cannot route around the blocker. The steps work in any country and on any router that can redirect a port.

What an LG TV asks for (what DNS can see)

A typical Pi-hole log for a 2021 LG OLED over two days, with the set mostly idle:

A reverse-DNS sweep of the whole LAN, all day. About fifty in-addr.arpa lookups an hour — the TV asking for the name of every device on the network, whether or not the TV was on.
A heartbeat to the ThinQ / smart-home cloud every few minutes. kic.api.lgtviot.com — 319 queries in the sample.
Advertising, recommendation and “nudge” hosts. lgsmartad.com, recommend, nudge, homeprv, cdpbeacon and wiseconfig under lgtvcommon.com, wiselg.com, rdx2.nextlgsdp.com.
Content recognition (ACR) provisioning on the older set. prov-lg.alphonso.tv on a 2019 model — the service that fingerprints what is on screen.
And the things it needs. Firmware updates from snu.lge.com, the app store and its thumbnails, the account service, the platform’s online check. These have to keep working or the TV becomes a worse TV.

The one thing the community lists get wrong for most of the world: LG prefixes its hosts by region. American lists assume us., European ones eic.; a Thai set uses th. and kic.. A list that blocks us.nextlgsdp.com does nothing for a Thai, Japanese or Brazilian set. That is why this guide starts with watch first — your TV’s own log tells you your prefixes in ten minutes.

What you need

Pi-hole, v6 or later. The one hard requirement. Everything that decides which names to block lives here, and it is the only place that can block by client, so the rest of the house is untouched. Two Pi-holes? Do every step on both.
A fixed address for each TV. A static DHCP lease by MAC on your router, so the rules below stay pointed at the right device.
A router that can redirect a port and block a port. Any of pfSense, OPNsense, OpenWrt, MikroTik, a Linux box doing NAT, or a UniFi gateway will do. A plain ISP router usually cannot redirect; see the fallback in step 3.
Ten minutes at the TV itself. The blocking stops the reporting; the TV’s own switches stop some of the collecting (step 4).

Step 1 — watch first

Point the TV at Pi-hole (it probably already is, via DHCP), use it normally for a day, then read its log. You are looking for two things: the region prefix, and which hosts are chatter versus which are the platform.

Pi-hole → Query Log → filter by client (the TV’s IP or hostname). Sort by count. Everything under lgtviot, lgsmartad, lgtvcommon, wiselg, alphonso and the in-addr.arpa lookups is chatter. Note the two-letter or three-letter prefix on nextlgsdp.com, lgtvsdp.com and lgeapi.com — that is your region, and you will need it for the allow list.

Or from a shell on the Pi-hole (FTL v6)

# the TV's most-asked names in the last day (replace the IP)
sqlite3 /etc/pihole/pihole-FTL.db \
  "SELECT domain, COUNT(*) n FROM queries WHERE client='192.168.1.50' AND timestamp > strftime('%s','now','-1 day') GROUP BY domain ORDER BY n DESC LIMIT 40;"

Step 2 — Pi-hole: block by client group, keep the platform

Two published lists do most of the work; a client group keeps the blocks from touching phones and laptops; a short allow list keeps updates and the app store alive. Everything here is in the Pi-hole web interface (Groups, Clients, Lists, Domains).

The two lists

HaGeZi — native LG webOS (https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/native.lgwebos.txt). Adblock-style, so subdomains match; deliberately leaves the update, store and platform hosts alone. The careful list.
Perflyst — Smart-TV (https://raw.githubusercontent.com/Perflyst/PiHoleBlocklist/master/SmartTV.txt). Exact hosts, wider net, all vendors. It blocks every regional nextlgsdp.com — including yours — which is why the allow list below is not optional.

Add both under Lists, assign them to the group you create next (or leave them in Default if you are happy blocking these hosts for everyone), then Tools → Update Gravity.

A client group for the TVs

Groups → add LG TVs. Clients → add each TV by MAC address (a MAC survives an IP change; the router’s static lease is belt and braces) and put it in the group. Every regex below is then scoped to that group, which is what lets you block lgthinq.com on the TV while the ThinQ app on your phone keeps working.

The regex denies (group-scoped)

Domains → Regex filter → Deny, group: LG TVs

(^|\.)(rdx2|smartshare)\.(nextlgsdp|lgtvsdp)\.com$
(^|\.)lgtviot\.com$
(^|\.)lgthinq\.com$
(^|\.)wiselg\.com$
(^|\.)(recommend|nudge|homeprv|cdpbeacon|rdl|wiseconfig|ads)\.lgtvcommon\.com$
(^|\.)lgsmartad\.com$
(^|\.)alphonso\.tv$
\.in-addr\.arpa$

Pattern	What it stops	Cost of blocking it
`rdx2 / smartshare`	telemetry upload and the media-share discovery service	none seen
`lgtviot.com`	the ThinQ / Home Hub heartbeat	the TV stops acting as a ThinQ smart-home hub — speculative: the first one to lift if something breaks
`lgthinq.com`	ThinQ cloud from the TV	the phone app is unaffected (group scope)
`wiselg.com`, `lgsmartad.com`	advertising and audience measurement	none
`… .lgtvcommon.com`	recommendations, nudges, home-screen promotion, beacons, remote config	a quieter home screen
`alphonso.tv`	content recognition (ACR) provisioning	none
`.in-addr.arpa`	reverse lookups of your own LAN devices	the TV’s network scan cannot put names to addresses; the scan itself is local traffic and DNS cannot stop it (see “what this does not do”)

Never wildcard lge.com, lgtvsdp.com or nextlgsdp.com whole — that is where updates and the platform live.

The allow list (exact, beats the lists)

Replace th. with the prefix you found in step 1. These are the hosts the TV needs to update, sign in and open the store.

Domains → Exact → Allow, group: Default (global)

snu.lge.com
su.lge.com
su-ssl.lge.com
th.nextlgsdp.com
th.lgtvsdp.com
lgtvonline.lge.com
th.lgeapi.com
th.emp.lgsmartplatform.com
kic-gfts.nextlgsdp.com
ngfts.nextlgsdp.com
ngfts.lge.com
gfts.lge.com

What the allows are: the three lge.com hosts are firmware and app updates; <region>.nextlgsdp.com / lgtvsdp.com and lgtvonline are the platform’s online check; lgeapi and emp.lgsmartplatform are the LG account; the gfts hosts serve store thumbnails. Two to leave alone rather than block: www.ueiwsp.com, the Magic Remote’s device database, and the Netflix voice host under lgtvcommon.com.

Step 3 — the router: make Pi-hole the only way out

A TV that ignores DHCP and asks 8.8.8.8 directly, or uses encrypted DNS, walks straight past Pi-hole. Three rules on the router close that. They apply only to the TVs’ addresses, so nothing else in the house changes.

Rule A — redirect. Any DNS (port 53, TCP and UDP) the TV sends to anything other than Pi-hole is rewritten to Pi-hole. The TV thinks it asked Google; Pi-hole answered.

Rule B — no DNS-over-TLS. Block port 853 from the TVs to anywhere, and log it.

Rule C — no DNS-over-HTTPS. Block port 443 (TCP and UDP, which covers QUIC) from the TVs to the well-known public resolvers. It cannot cover every DoH endpoint on earth — nothing can — but it covers the ones a TV vendor would bake in.

The public-resolver set (rule C)

8.8.8.8  8.8.4.4          # Google
1.1.1.1  1.0.0.1          # Cloudflare
9.9.9.9  149.112.112.112  # Quad9
208.67.222.222  208.67.220.220   # OpenDNS

pfSense / OPNsense

Aliases. LG_TVs = the TV addresses; Pi_holes = your Pi-hole(s); DoH_resolvers = the set above.
Rule A: Firewall → NAT → Port Forward. Interface LAN, protocol TCP/UDP, source LG_TVs, destination not Pi_holes, destination port 53, redirect target your Pi-hole port 53, with the associated pass rule. Check it with pfctl -sn: you should see rdr … from <LG_TVs> to ! <Pi_holes> port = domain -> <pi-hole>.
Rules B and C: Firewall → Rules → LAN. Block, log, source LG_TVs, destination any port 853; block, log, source LG_TVs, destination DoH_resolvers port 443, TCP/UDP. Drag both above the default “allow LAN to any” rule — a new rule lands at the bottom, where it never fires.

OpenWrt, MikroTik, or any Linux router

The same three rules in iptables form (an ipset holds the resolvers). On OpenWrt put them in a firewall include; on MikroTik the equivalents are a dst-nat rule and two forward drops.

Linux router (example addresses: TV 192.168.1.50, Pi-hole 192.168.1.2; repeat per TV)

TV=192.168.1.50; PH=192.168.1.2
# A: redirect DNS the TV sends anywhere else
iptables -t nat -A PREROUTING -s $TV ! -d $PH -p udp --dport 53 -j DNAT --to-destination $PH
iptables -t nat -A PREROUTING -s $TV ! -d $PH -p tcp --dport 53 -j DNAT --to-destination $PH
# B: no DNS-over-TLS
iptables -A FORWARD -s $TV -p tcp --dport 853 -j REJECT
# C: no DNS-over-HTTPS to the public resolvers (TCP and QUIC)
ipset create doh hash:ip 2>/dev/null
for ip in 8.8.8.8 8.8.4.4 1.1.1.1 1.0.0.1 9.9.9.9 149.112.112.112 208.67.222.222 208.67.220.220; do ipset add doh $ip 2>/dev/null; done
iptables -A FORWARD -s $TV -m set --match-set doh dst -p tcp --dport 443 -j REJECT
iptables -A FORWARD -s $TV -m set --match-set doh dst -p udp --dport 443 -j REJECT

If your router can only block

Consumer routers rarely redirect a port, but most can block one. Then invert rule A: block port 53 from the TVs to everything except Pi-hole, and keep B and C. A TV that tries to go around Pi-hole gets no DNS at all, which fails safe — the reporting cannot resolve its targets, and the TV falls back to the address DHCP gave it. One lab write-up reports a recent webOS falling back to public DNS about twenty seconds after boot; rules B and C make that harmless either way.

Step 4 — the TV’s own switches

Blocking stops the reporting; these stop some of the collecting and the home-screen advertising that survives DNS.

Settings → General → System → Additional Settings → Live Plus: off. This is the content-recognition feature.
Settings → Support → Privacy & Terms → User Agreements: untick viewing information, interest-based advertising and voice information. The menu names vary by year and region; the three ideas do not.
Voice: far-field “Hi LG” off; the remote’s microphone button still works when you press it.
Home Promotion, Content Recommendation, Home Hub / ThinQ: off unless you use them. If you do use the TV as a smart-home hub, lift the lgtviot regex from step 2 — that is the one it needs.

Verify

With a TV on, the Pi-hole log for that client should show a clear split, and the router log should show the TV trying and failing.

Blocked (regex denied): kic.api.lgtviot.com (or your region’s), …rdx2.nextlgsdp.com, anything lgsmartad / wiselg / alphonso, and every in-addr.arpa lookup.
Allowed: snu.lge.com, <region>.nextlgsdp.com, lgtvonline.lge.com. Then prove it: Settings → Support → Software Update → check for updates must succeed, and the app store must open with pictures.
Router: the two block rules should log a few hits in the first hour after a power cycle. Silence there is fine too — it means the TV never tried.
If the TV reports a network error or ThinQ sign-in fails: disable the lgtviot and lgthinq regexes first — they are the speculative ones. The rest block reporting only and leave the TV’s own features untouched.

What DNS cannot stop

DNS blocking stops the TV from reporting; it cannot stop it from looking. The LAN enumeration is local traffic that never touches a resolver, and blocking reverse lookups only denies the TV the names. If that matters to you, the answer is network isolation: a VLAN or guest network for the TVs. Watch out when you build it: Home Assistant’s LG webOS integration controls the TV on ports 3000 and 3001, and media servers that cast to the TV need to reach it too — allow those ports from the machines that use them, or the TV silently drops out of your automations.

It also cannot cover every DNS-over-HTTPS endpoint that exists, only the resolvers a vendor would plausibly hard-code. A firmware update could change that; the Pi-hole log and the router’s block counters are the ongoing check, and they take a minute a month.

Things to watch out for

Region prefixes are the whole game. Every block and allow above that carries th. or kic. carries your own region’s prefix on your TV. Read the log before you copy a list.
Adblock-style lists match subdomains; hosts-style lists match exactly. The HaGeZi list is the former, Perflyst the latter, which is why Perflyst needs the allow list and HaGeZi mostly does not.
Group scope is what makes this livable. Blocking lgthinq.com for the whole house would break the LG appliance app on every phone; scoped to the TVs it costs nothing.
Add the TVs by MAC, and give them static leases anyway. The router rules are by address; the Pi-hole group is by MAC. Both stay right only if the address does not wander.
New firewall rules land at the bottom. On pfSense the block rules have to be dragged above the default allow, or they never match — the log stays empty and it looks as if the TV never tried.

Sources: the Gamers Nexus investigation (September 2026) and LG’s response as reported by Tom’s Hardware and The Register; HaGeZi’s native.lgwebos list and its discussion thread; Perflyst’s SmartTV list; the community allow lists that identified snu.lge.com and su-ssl.lge.com as the update hosts. The host names and query rates above come from Pi-hole and pfSense logs on a working install.