Recommend LG TVs to friends and family for many years. Luckily, I've also recommended UniFi networking infrastructure. If you don't use UniFi, I can't guarantee that you'll have the same settings exposed to you, or if any of this approach would change. But I'd expect most of this to still be applicable. And I should stress that (besides a brief stint in IT) I do not consider myself a networking/InfoSec expert, but I thought I'd share my immediate response for the networks that I manage, in case it might help anyone in a similar situation: 1. Create a dedicated VLAN/network for your TVs In UniFi Network: Settings → Networks → Create New Network. I called mine "LG-TVs". 2. Move your LG TVs onto that VLAN For wired TVs, assign the switch port to the new network/VLAN. For Wi-Fi TVs, use a dedicated SSID/VLAN or a device-specific network assignment if your setup supports it. 3. Block the TV VLAN from initiating connections into your trusted LAN Depending on your UniFi Network version, these settings may appear under Zones, Policy Table/Policy Engine, CyberSecure Content Filter, Traffic Rules, or legacy Firewall Rules. Using UniFi’s Zone-Based Firewall/policies, create a rule: Source: LG-TVs Destination: your Trusted/Internal networks Action: Block new connections This keeps the TVs from initiating arbitrary connections to PCs, NAS boxes, phones, etc., while still allowing them to access the internet. Trusted devices should still be allowed to initiate connections toward the LG-TV VLAN when needed, with established/related return traffic allowed. In current UniFi UI, use the applicable return-traffic policies or Auto Allow Return Traffic on the trusted-to-TV allow policy if needed. On older versions using the legacy firewall UI, the equivalent isolation rule was typically LAN In; those configurations may need an explicit Established/Related allow rule above the deny rule. 4. Add a UniFi Content/Domain Filter scoped ONLY to the LG-TV VLAN and block: nextlgsdp.com lgtvcommon.com lgsmartad.com lgtviot.com lgthinq.com ngfts.lge.com I also specifically block: lgsmartweb.com ^ that appears to be tied to LG cloud voice functionality, so blocking it may disable voice search. 5. Do NOT block all HTTPS/443 Most telemetry uses normal HTTPS, so “block a few spyware ports” is not enough. **Blocking 443 would also break streaming and other legitimate TV functions.** 6. Block outbound DNS-over-TLS from the TV VLAN Create another firewall rule: Source: LG-TVs Destination: Internet Port: TCP/UDP 853 Action: Block This helps prevent bypassing your normal DNS filtering over port 853 (TCP covers DNS-over-TLS; UDP covers DNS-over-QUIC). It does not block DNS-over-HTTPS on 443; do not blanket-block TCP/UDP 443. Also prevent direct external DNS (defense-in-depth): Some LG/webOS devices have been observed using hardcoded public DNS resolvers such as Google DNS (8.8.8.8). Current UniFi Content Filtering can intercept/redirect ordinary TCP/UDP port 53 DNS to the gateway even when a client targets an external resolver, so hardcoded port-53 DNS does not automatically bypass it. Have DHCP assign the UniFi gateway/local resolver as DNS. For defense-in-depth, block outbound TCP/UDP destination port 53 from the LG-TV VLAN to the Internet, while continuing to allow DNS to the UniFi gateway/local resolver. This prevents direct external DNS and reinforces the domain filtering policy. 7. Keep firmware/update and app-store domains allowed. I am intentionally NOT blocking: lgtvsdp.com lgappstv.com snu.lge.com su.lge.com su-ssl.lge.com That way normal hostname-based LG firmware updates and the Content Store can still function. Block 156.147.69.32:8080. This endpoint has been observed as a hardcoded webOS software-update fallback. DNS/domain filtering cannot block a connection made directly to this IP. To block that fallback, create a firewall policy: Source: LG-TV VLAN Destination IP: 156.147.69.32 Destination port: TCP 8080 Action: Block This blocks a hardcoded firmware-update fallback, not a telemetry-specific endpoint. Normal hostname-based update services can remain allowed, but this does not preserve every update path. The tradeoff is losing this fallback firmware-update path. 8. If you need AirPlay/casting across VLANs, use UniFi mDNS/Bonjour reflection only if needed for discovery. mDNS/Bonjour reflection only handles discovery; it does not itself grant network access. AirPlay/casting also needs actual session traffic: allow the required Trusted LAN → LG-TV traffic and established/related return traffic. Do NOT create a broad LG-TV → Trusted LAN allow rule just to make AirPlay work. The important concept is: LG-TV VLAN → Internet allowed LG-TV VLAN → Trusted LAN arbitrary new connections blocked LG telemetry/ad/IoT domains → blocked only for the TV VLAN Firmware/app-store domains → allowed (update-fallback IP blocked, with the tradeoff above) -- Of course, if you don’t use webOS apps at all, the strongest option is even simpler: block the TV’s internet access entirely and use it strictly as an HDMI display (and use something like an AppleTV). But I hope this helps anyone who is working with a situation where that's not an option. And if you ARE indeed a networking expert, and spot any gaps / issues in this post, please chime in and let us know what changes you'd make.