Blocking file type by iptables?

Blocking file type by iptables?

[ads nat]

[-- Attachment #1: Type: text/plain, Size: 524 bytes --]

Hi,
I have gone through mail archives to check whether can be blocked. I also checked squid mailing list. But thre is no definite solution to block kazza file downloads. I would like t know whether using iptables can i block particular type of file. If I block .mpeg, .mp3 files through IPtables then it does not matter from which site file is coming. It will get blocked.
Any suggestion and solutions.
Thanks


---------------------------------
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software

[-- Attachment #2: Type: text/html, Size: 627 bytes --]

RE: Blocking file type by iptables?

[George Vieira]

[-- Attachment #1: Type: text/plain, Size: 1891 bytes --]

No because this is a bad idea. not only does the CPU have a bad day goign through every packet sniffing for file extensions but also that other innocent data can get blocked when it shouldn't be..
 
1. The only thing you can do is block all outgoing/incoming ports and allow only some (25,80)
2. Use transparent squid proxy to limit access and get it to use regex expressions on URLs you may also want to block.
3. Block any and all MSN/Kazaa/ICQ servers addresses
 
You could also setup a fake primary DNS domain like aol.com and icq.com and point to yourself... this is what I've done for ICQ to stop those damn ADs.. if the clients can't resolve the DNS for those domains then they also can't connect. But then they get smart and put a hosts file in their machine.. ;)
 
 
 
 

Thanks,

 
____________________________________________
George Vieira
Citadel Computer Systems Pty Ltd Systems Manager georgev AT citadelcomputer DOT com DOT au 
Citadel Computer Systems Pty Ltd
Phone : +61 2 9955 2644 HelpDesk: +61 2 9955 2698  <http://www.citadelcomputer.com.au/> http://www.citadelcomputer.com.au
 
 
-----Original Message-----
From: ads nat [mailto:adsnat@yahoo.com]
Sent: Monday, August 25, 2003 2:22 AM
To: netfilter@lists.netfilter.org
Subject: Blocking file type by iptables?


Hi,
I have gone through mail archives to check whether can be blocked. I also checked squid mailing list. But thre is no definite solution to block kazza file downloads. I would like t know whether using iptables can i block particular type of file. If I block .mpeg, .mp3 files through IPtables then it does not matter from which site file is coming. It will get blocked.
Any suggestion and solutions.
Thanks


  _____  

Do you Yahoo!?
Yahoo!  <http://us.rd.yahoo.com/evt=10469/*http://sitebuilder.yahoo.com> SiteBuilder - Free, easy-to-use web site design software

[-- Attachment #2: Type: text/html, Size: 5752 bytes --]

RE: Blocking file type by iptables?

[ads nat]

[-- Attachment #1: Type: text/plain, Size: 2054 bytes --]

Even if you block all ports except 80. Kazza manages to access through port 80. So I don't think this will work.
Thanks

George Vieira <georgev@citadelcomputer.com.au> wrote:
No because this is a bad idea. not only does the CPU have a bad day goign through every packet sniffing for file extensions but also that other innocent data can get blocked when it shouldn't be..
 
1. The only thing you can do is block all outgoing/incoming ports and allow only some (25,80)
2. Use transparent squid proxy to limit access and get it to use regex expressions on URLs you may also want to block.
3. Block any and all MSN/Kazaa/ICQ servers addresses
 
You could also setup a fake primary DNS domain like aol.com and icq.com and point to yourself... this is what I've done for ICQ to stop those damn ADs.. if the clients can't resolve the DNS for those domains then they also can't connect. But then they get smart and put a hosts file in their machine.. ;)
 
 
 
 

Thanks,

 
____________________________________________
George Vieira
Citadel Computer Systems Pty LtdSystems Managergeorgev AT citadelcomputer DOT com DOT auCitadel Computer Systems Pty Ltd
Phone : +61 2 9955 2644HelpDesk: +61 2 9955 2698http://www.citadelcomputer.com.au
 
 
-----Original Message-----
From: ads nat [mailto:adsnat@yahoo.com]
Sent: Monday, August 25, 2003 2:22 AM
To: netfilter@lists.netfilter.org
Subject: Blocking file type by iptables?


Hi,
I have gone through mail archives to check whether can be blocked. I also checked squid mailing list. But thre is no definite solution to block kazza file downloads. I would like t know whether using iptables can i block particular type of file. If I block .mpeg, .mp3 files through IPtables then it does not matter from which site file is coming. It will get blocked.
Any suggestion and solutions.
Thanks


---------------------------------
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software 

---------------------------------
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software

[-- Attachment #2: Type: text/html, Size: 5992 bytes --]

RE: Blocking file type by iptables?

[George Vieira]

[-- Attachment #1: Type: text/plain, Size: 2835 bytes --]

But you can still block based on URL using squid.
 

Thanks,

 
____________________________________________
George Vieira
Citadel Computer Systems Pty Ltd Systems Manager georgev AT citadelcomputer DOT com DOT au 
Citadel Computer Systems Pty Ltd
Phone : +61 2 9955 2644 HelpDesk: +61 2 9955 2698  <http://www.citadelcomputer.com.au/> http://www.citadelcomputer.com.au
 
 
-----Original Message-----
From: ads nat [mailto:adsnat@yahoo.com]
Sent: Monday, August 25, 2003 12:59 PM
To: George Vieira; netfilter@lists.netfilter.org
Subject: RE: Blocking file type by iptables?


Even if you block all ports except 80. Kazza manages to access through port 80. So I don't think this will work.
Thanks

George Vieira <georgev@citadelcomputer.com.au> wrote:

No because this is a bad idea. not only does the CPU have a bad day goign through every packet sniffing for file extensions but also that other innocent data can get blocked when it shouldn't be..
 
1. The only thing you can do is block all outgoing/incoming ports and allow only some (25,80)
2. Use transparent squid proxy to limit access and get it to use regex expressions on URLs you may also want to block.
3. Block any and all MSN/Kazaa/ICQ servers addresses
 
You could also setup a fake primary DNS domain like aol.com and icq.com and point to yourself... this is what I've done for ICQ to stop those damn ADs.. if the clients can't resolve the DNS for those domains then they also can't connect. But then they get smart and put a hosts file in their machine.. ;)
 
 
 
 

Thanks,

 
____________________________________________
George Vieira
Citadel Computer Systems Pty Ltd Systems Manager georgev AT citadelcomputer DOT com DOT au 
Citadel Computer Systems Pty Ltd
Phone : +61 2 9955 2644 HelpDesk: +61 2 9955 2698  <http://www.citadelcomputer.com.au/> http://www.citadelcomputer.com.au
 
 
-----Original Message-----
From: ads nat [mailto:adsnat@yahoo.com]
Sent: Monday, August 25, 2003 2:22 AM
To: netfilter@lists.netfilter.org
Subject: Blocking file type by iptables?


Hi,
I have gone through mail archives to check whether can be blocked. I also checked squid mailing list. But thre is no definite solution to block kazza file downloads. I would like t know whether using iptables can i block particular type of file. If I block .mpeg, .mp3 files through IPtables then it does not matter from which site file is coming. It will get blocked.
Any suggestion and solutions.
Thanks



  _____  

Do you Yahoo!?
Yahoo!  <http://us.rd.yahoo.com/evt=10469/*http://sitebuilder.yahoo.com> SiteBuilder - Free, easy-to-use web site design software 


  _____  

Do you Yahoo!?
Yahoo!  <http://us.rd.yahoo.com/evt=10469/*http://sitebuilder.yahoo.com> SiteBuilder - Free, easy-to-use web site design software

[-- Attachment #2: Type: text/html, Size: 9733 bytes --]

Re: Blocking file type by iptables?

[hare ram]

[-- Attachment #1: Type: text/plain, Size: 2561 bytes --]

Hi

If you want to block Kazaa
use STRING from POM, it will work great 

hare
  ----- Original Message ----- 
  From: ads nat 
  To: George Vieira ; netfilter@lists.netfilter.org 
  Sent: Monday, August 25, 2003 8:28 AM
  Subject: RE: Blocking file type by iptables?


  Even if you block all ports except 80. Kazza manages to access through port 80. So I don't think this will work.
  Thanks

  George Vieira <georgev@citadelcomputer.com.au> wrote:
    No because this is a bad idea. not only does the CPU have a bad day goign through every packet sniffing for file extensions but also that other innocent data can get blocked when it shouldn't be..

    1. The only thing you can do is block all outgoing/incoming ports and allow only some (25,80)
    2. Use transparent squid proxy to limit access and get it to use regex expressions on URLs you may also want to block.
    3. Block any and all MSN/Kazaa/ICQ servers addresses

    You could also setup a fake primary DNS domain like aol.com and icq.com and point to yourself... this is what I've done for ICQ to stop those damn ADs.. if the clients can't resolve the DNS for those domains then they also can't connect. But then they get smart and put a hosts file in their machine.. ;)




    Thanks,


    ____________________________________________
    George Vieira
    Citadel Computer Systems Pty LtdSystems Managergeorgev AT citadelcomputer DOT com DOT au
    Citadel Computer Systems Pty Ltd
    Phone : +61 2 9955 2644HelpDesk: +61 2 9955 2698http://www.citadelcomputer.com.au


    -----Original Message-----
    From: ads nat [mailto:adsnat@yahoo.com]
    Sent: Monday, August 25, 2003 2:22 AM
    To: netfilter@lists.netfilter.org
    Subject: Blocking file type by iptables?


    Hi,
    I have gone through mail archives to check whether can be blocked. I also checked squid mailing list. But thre is no definite solution to block kazza file downloads. I would like t know whether using iptables can i block particular type of file. If I block .mpeg, .mp3 files through IPtables then it does not matter from which site file is coming. It will get blocked.
    Any suggestion and solutions.
    Thanks


----------------------------------------------------------------------------
    Do you Yahoo!?
    Yahoo! SiteBuilder - Free, easy-to-use web site design software 


------------------------------------------------------------------------------
  Do you Yahoo!?
  Yahoo! SiteBuilder - Free, easy-to-use web site design software

[-- Attachment #2: Type: text/html, Size: 8053 bytes --]

Re: Blocking file type by iptables?

[ads nat]

[-- Attachment #1: Type: text/plain, Size: 2778 bytes --]

Please tell me what is POM. I tried blocking url_regen from squid. It has blocked kazza sites but still users are able to down load through search. I have just started learning Iptables, totally new. But by going through mail archieve i think STRING blocking is similer to URL_regen blocking in squid. 
Thanks 

hare ram <hareram@sol.net.in> wrote:
Hi
 
If you want to block Kazaa
use STRING from POM, it will work great 
 
hare
----- Original Message ----- 
From: ads nat 
To: George Vieira ; netfilter@lists.netfilter.org 
Sent: Monday, August 25, 2003 8:28 AM
Subject: RE: Blocking file type by iptables?


Even if you block all ports except 80. Kazza manages to access through port 80. So I don't think this will work.
Thanks

George Vieira <georgev@citadelcomputer.com.au> wrote:
No because this is a bad idea. not only does the CPU have a bad day goign through every packet sniffing for file extensions but also that other innocent data can get blocked when it shouldn't be..
 
1. The only thing you can do is block all outgoing/incoming ports and allow only some (25,80)
2. Use transparent squid proxy to limit access and get it to use regex expressions on URLs you may also want to block.
3. Block any and all MSN/Kazaa/ICQ servers addresses
 
You could also setup a fake primary DNS domain like aol.com and icq.com and point to yourself... this is what I've done for ICQ to stop those damn ADs.. if the clients can't resolve the DNS for those domains then they also can't connect. But then they get smart and put a hosts file in their machine.. ;)
 
 
 
 

Thanks,

 
____________________________________________
George Vieira
Citadel Computer Systems Pty LtdSystems Managergeorgev AT citadelcomputer DOT com DOT auCitadel Computer Systems Pty Ltd
Phone : +61 2 9955 2644HelpDesk: +61 2 9955 2698http://www.citadelcomputer.com.au
 
 
-----Original Message-----
From: ads nat [mailto:adsnat@yahoo.com]
Sent: Monday, August 25, 2003 2:22 AM
To: netfilter@lists.netfilter.org
Subject: Blocking file type by iptables?


Hi,
I have gone through mail archives to check whether can be blocked. I also checked squid mailing list. But thre is no definite solution to block kazza file downloads. I would like t know whether using iptables can i block particular type of file. If I block .mpeg, .mp3 files through IPtables then it does not matter from which site file is coming. It will get blocked.
Any suggestion and solutions.
Thanks


---------------------------------
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software 

---------------------------------
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software

---------------------------------
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software

[-- Attachment #2: Type: text/html, Size: 7967 bytes --]

Re: Blocking file type by iptables?

[hare ram]

[-- Attachment #1: Type: text/plain, Size: 3488 bytes --]

Hi

Go to netfilter.org

and you can find Patch-o-matic

hare
  ----- Original Message ----- 
  From: ads nat 
  To: hare ram ; netfilter@lists.netfilter.org 
  Sent: Monday, August 25, 2003 11:25 AM
  Subject: Re: Blocking file type by iptables?


  Please tell me what is POM. I tried blocking url_regen from squid. It has blocked kazza sites but still users are able to down load through search. I have just started learning Iptables, totally new. But by going through mail archieve i think STRING blocking is similer to URL_regen blocking in squid. 
  Thanks 

  hare ram <hareram@sol.net.in> wrote:
    Hi

    If you want to block Kazaa
    use STRING from POM, it will work great 

    hare
      ----- Original Message ----- 
      From: ads nat 
      To: George Vieira ; netfilter@lists.netfilter.org 
      Sent: Monday, August 25, 2003 8:28 AM
      Subject: RE: Blocking file type by iptables?


      Even if you block all ports except 80. Kazza manages to access through port 80. So I don't think this will work.
      Thanks

      George Vieira <georgev@citadelcomputer.com.au> wrote:
        No because this is a bad idea. not only does the CPU have a bad day goign through every packet sniffing for file extensions but also that other innocent data can get blocked when it shouldn't be..

        1. The only thing you can do is block all outgoing/incoming ports and allow only some (25,80)
        2. Use transparent squid proxy to limit access and get it to use regex expressions on URLs you may also want to block.
        3. Block any and all MSN/Kazaa/ICQ servers addresses

        You could also setup a fake primary DNS domain like aol.com and icq.com and point to yourself... this is what I've done for ICQ to stop those damn ADs.. if the clients can't resolve the DNS for those domains then they also can't connect. But then they get smart and put a hosts file in their machine.. ;)




        Thanks,


        ____________________________________________
        George Vieira
        Citadel Computer Systems Pty LtdSystems Managergeorgev AT citadelcomputer DOT com DOT au
        Citadel Computer Systems Pty Ltd
        Phone : +61 2 9955 2644HelpDesk: +61 2 9955 2698http://www.citadelcomputer.com.au


        -----Original Message-----
        From: ads nat [mailto:adsnat@yahoo.com]
        Sent: Monday, August 25, 2003 2:22 AM
        To: netfilter@lists.netfilter.org
        Subject: Blocking file type by iptables?


        Hi,
        I have gone through mail archives to check whether can be blocked. I also checked squid mailing list. But thre is no definite solution to block kazza file downloads. I would like t know whether using iptables can i block particular type of file. If I block .mpeg, .mp3 files through IPtables then it does not matter from which site file is coming. It will get blocked.
        Any suggestion and solutions.
        Thanks


------------------------------------------------------------------------
        Do you Yahoo!?
        Yahoo! SiteBuilder - Free, easy-to-use web site design software 


--------------------------------------------------------------------------
      Do you Yahoo!?
      Yahoo! SiteBuilder - Free, easy-to-use web site design software


------------------------------------------------------------------------------
  Do you Yahoo!?
  Yahoo! SiteBuilder - Free, easy-to-use web site design software

[-- Attachment #2: Type: text/html, Size: 10692 bytes --]

RE: Blocking file type by iptables?

[George Vieira]

[-- Attachment #1: Type: text/plain, Size: 1353 bytes --]

I haven't really looked into Kazaa as I don't use it.. They must login to a server somewhere.. it's gotta be able to block the server login somehow.. anyway....
 
 
"using string POM". Yes but remember that because they could be using any port, your rules will be very broad ( iptables -A FORWARD -j tcp -m string --string "Kazaa") and will check every single packet passing through the server.. This will cause some CPU overhead, so if you have a P3 1Ghz or whatever... then your probably safe..
 

Thanks,

 
____________________________________________
George Vieira
Citadel Computer Systems Pty Ltd Systems Manager georgev AT citadelcomputer DOT com DOT au 
Citadel Computer Systems Pty Ltd
Phone : +61 2 9955 2644 HelpDesk: +61 2 9955 2698  <http://www.citadelcomputer.com.au/> http://www.citadelcomputer.com.au
 
 
-----Original Message-----
From: ads nat [mailto:adsnat@yahoo.com]
Sent: Monday, August 25, 2003 3:55 PM
To: hare ram; netfilter@lists.netfilter.org
Subject: Re: Blocking file type by iptables?


Please tell me what is POM. I tried blocking url_regen from squid. It has blocked kazza sites but still users are able to down load through search. I have just started learning Iptables, totally new. But by going through mail archieve i think STRING blocking is similer to URL_regen blocking in squid. 
Thanks 

[-- Attachment #2: Type: text/html, Size: 4544 bytes --]