blocking by domain

blocking by domain

[Spiro Azkoul]

Is it possible to block any packets that ride on a specific domain by
domain? I know blocking is possible based on IP/Subnet, but wanted to
double-check the domain
Thanks

Re: blocking by domain

[Cedric Blancher]

Le sam 12/06/2004 à 23:27, Spiro Azkoul a écrit :
> Is it possible to block any packets that ride on a specific domain by
> domain? I know blocking is possible based on IP/Subnet, but wanted to
> double-check the domain

Unless you use a dedicated userspace application using QUEUE target to
reverse lookup source and/or destination IP, you can't.

Netfilter is a paquet filter and works on IP, not names. Moreover, I
think it would generate too much latency if you had to check DNS for
packets at firewall level.

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

Re: blocking by domain

[Chris Brenton]

On Sun, 2004-06-13 at 04:29, Cedric Blancher wrote:
>
> Moreover, I
> think it would generate too much latency if you had to check DNS for
> packets at firewall level.

Not to mention the accuracy is pretty poor. Say I'm fubar.com and you
have a rule blocking traffic from my domain. I can either:

1) Not create a PTR record for my IP
2) Create a PTR calling myself www.microsoft.com or similar

Both methods will defeat a domain based filter. So blocking at an IP
level is faster and more accurate. Best bet is to just do a few whois
queries to identify the IP range for the domain and block accordingly. 

HTH,
Chris