This guide will let you block updates (and/or eshop access or any other specified URLs) by using your computer as filtering gateway.
If you want to use an online filtering method instead of keeping your computer powered, you should follow the [ Register or Signin to view external links. ] . But be aware that OpenDNS IS NOT SAFE and works with your router's IP, it will render your 3DS/WiiU vulnerable if you are not at home.
Using a proxy on your computer will have better blocking assurance as online will not be possible at all without being near it.

INFORMATION :
Stay in 5.3.2 if you want homebrew !!

NOTE:
The Proxy setting is NOT always used to access internet.
The proxy setting is there to be used by applications which want to use it. Some applications (vWii, USBLoaders on vWii, Netflix once launched, Xenoblade X, etc.) are NOT using the proxy information and are connected to internet directly. They are completely ignoring this feature.

NOT ALL YOUR TRAFFIC will be filtered!!! Only part of it. Nintendo could even bypass proxy use to update the console if they feel like it in a future System version. Currently (up to 5.3.2, maybe 5.4.0) the proxy is used to access eshop and updates so you can safely filter updates with this tutorial.

NOTE:
If you use Tubehax DNS in your WiiU settings and use CCProxy at the same time, tubehax filtering will not work.
When using a proxy, the console doesn't resolves the server's IP but let the proxy do it, so it will NOT filter the update servers.
To enable Tubehax DNS filtering while using CCProxy, you need to set the Tubehax DNS IP into CCproxy filter menu.

The solution :

- Block onlines updates

- Keep Webkit exploit.

- Only need a PC on Windows XP or newer that all ! (No router to configure).


- The same Wifi Access on PC and Wii U (but not power on the Wii U too long during the process AND NOT BEFORE PC STEP -> or you can be auto-updated)

- Need a PC always on to keep access to internet.

- Download and install CCProxy v8.0 [ Register or Signin to view external links. ] (free up to 3 user's accounts)


CCProxy Setup
[ Register or Signin to view external links. ]

Click on "Options"
[ Register or Signin to view external links. ]

Fill it like the picture :
- Set the proxy port for HTTP to 8080, it will edit all the related ports at the same time.
- or set a different port number for HTTP if 8080 is already used by another application (808, 1080, etc.)

Click on "Advanced", then choose "Networks" tab.
[ Register or Signin to view external links. ]

Check "Disable External Users" for security reasons.
If you want to allow external users (friend, family, internet) to use your proxy server, uncheck this.

Note: My screenshot is from version 6.4.1, "Networks" settings are located on miscellaneous tab.

Click on "OK" and again on "OK".

You come back here :
[ Register or Signin to view external links. ]

Click on "Account"
[ Register or Signin to view external links. ]

Set the option to "Permit only" users using your Proxy based on they "MAC address".
Set to "IP+Mac" to filter by IP if you plan to allow external users from internet. (only for advanced users)


Click on "Web filter"
[ Register or Signin to view external links. ]

Fill it like the picture :
- Set a name for your filter
- Check "Site Filter"
- Set "Forbidden Sites" radio choice
- Fill the filtered/forbidden URL, separated by semicolon :

Code:
cbvc.cdn.nintendo.net;*.cdn.shop.wii.com;*.wup.shop.nintendo.net;*.c.shop.nintendowifi.net;*.deploy.s
tatic.akamaitechnologies.com;*.deploy.akamaitechnologies.com

This list will block all eShop access and update download on Wii, WiiU and 3DS. The akamai servers are used for cloud computing and data servers. it's unknown if they host updates.


Click on "OK".

You come back here :
[ Register or Signin to view external links. ]

Click on "New"
[ Register or Signin to view external links. ]

Fill it like the picture :
- Set a User name for this account
- Enable this account
- Filter by MAC Address (enter the WiiU or 3DS MAC address here)
- Check "Web Filter" and select the previously defined filter rule.


In this picture, the MAC address for CCProxy is 8ccde8886572 ! (no space, hyphen or colon)
[ Register or Signin to view external links. ]

Click on "OK".
[ Register or Signin to view external links. ]

You can create another Account for another console if you want.

[ Register or Signin to view external links. ]
If you have multiple consoles which share the same setup (web filter, quota, protocol, scheduler, etc.), you can create a "Group" account.

- Set a Group name
- Set the account "As Group"
- Set the Web Filter and all the settings for this group
- Click "OK"

[ Register or Signin to view external links. ]
- Edit your User Account to specify wich Group it belongs to.
- Click "OK"

Now you can set all your 3DS and WiiU consoles to "Nintendo" group.
If you want to edit the blocked servers, edit the filter list and it will affect all consoles set to that group.



Now PC Solution is okay !
Next is for the WiiU...


[ Register or Signin to view external links. ]

[ Register or Signin to view external links. ]

Go to "Console Settings" then "Internet" and then "Internet Connection".

Setup your connection as usual.

Go to 3rd page, click on "Proxy server".

Set to "yes" and fill the LAN IP address of your computer (for example :192.168.1.2) and 8080 (or whatever you chose in CCProxy) for the port.

You might want to set your Computer's IP to a fixed IP instead of using DHCP, or you'll have to edit the computer's IP every time the router provides it with a new IP.


Now your Wii U or 3DS are protected against auto-updates...

- You can see the number of connected users and active connections on the main CCProxy screen.

- Double click the main screen graphics to see current access log from CCProxy users.
If you use an old version (6.4.1 like in the screenshot) it doesn't tell if accessed URL is allowed or blocked.
Update to CCProxy 8.x to see proper blocked information.

- To analyze older log, Select "Log analysis", pick a log date in the drop down menu and click on "Analysis".



Information for advanced users

This section is only informative, it's not part of the tutorial.

The console is doing two different connections to initiate a system update:
CONNECT nus.c.shop.nintendowifi.net:443
and
GET nus.cdn.c.shop.nintendowifi.net/ccs/download/TitleID_high/TitleID_low

If CONNECT command fails, no system update is triggered and you receive an error message on your console.
If CONNECT succeed, then the console will initiate a series of GET to download all the files required for the update.


When CCProxy filters an URL it returns an HTTP answer 403 forbidden code, and a text message in html.
The WiiU (and probably other Nintendo's consoles) will NOT stop on HTTP error code and still stores the data returned by the GET command as if it was the expected content downloaded from Nintendo's update server, and will download next file until it reaches the end of the download list.

After all the updated files are downloaded it will attempt to update the console. As the files are not the expected data it will display a message telling you that the console couldn't be updated, and will tell you to reboot.
On next reboot, a new message will tell you "please wait...", while it's in fact deleting the bad downloaded update files.

After few seconds you are back to your current system menu with no update information in your update log. (Home>Update progress)


Customize error message seen by the console

If you want, you can customize the html content served by CCProxy when a website is blocked.
Option > Advanced > Customize (at the bottom)



The default message for filtered website on CCProxy 8.0 is :
[ Register or Signin to view external links. ]

I suggest to delete that content in order to not serve any content when hitting a blocked URL.
This way the console will download a 0 byte file instead of an error message.

On older version of CCProxy, the error message can be edited manually in ccproxy.ini file.

On the latest version of CCProxy 8.0 (2015-10-09 and newer), you can now change the error code to return. Instead of 403, you should set it to 404 and the console will not download any fake files.
You can see the difference when using the browser to access a filtered url.

ATTENTION:
As it seems to not brick the WiiU console (I did it 4 times), it hasn't been tested on 3DS.
I don't recommend performing this, use it at your own risk.