Re: How to block the real IP rather than an entire proxy?

[xavier renaut <list.netfilter@natch.dyndns.org>]

On Tue, May 13, 2003 at 08:05:45PM -0700, Myles Uyema wrote:
|It's the job of the proxy to block out the offender.  There's nothing you 
|can do with netfilter to prevent him from accessing your website through 
|other proxies.

what about scanning the content of the packet (-m string)
to find thee http header ?

bye


|
|On Tue, 13 May 2003, J and T wrote:
|
|My question is about blocking IPs from my network. It's a piece of cake to 
|block static IPs. But there are times when someone sitting behind a proxy 
|whos IP doesn't change, but the proxy in which he is accessing us does. 
|There's no way I can figure out how to keep these people out. For example; 
|Apache only shows the IP of the visitor and not the real IP of the visitor. 
|Here's an example of what I mean using environment variables:
|
|$ENV{'REMOTE_ADDR'};
|
|One might believe this is the IP of the visitor. But...
|
|$ENV{'HTTP_X_FORWARDED_FOR'}
|
|if the above is present it is most likely the true IP of the visitor and the 
|"REMOTE_ADDR" is just the proxy in which they are accessing the Net with.
|
|$ENV{'HTTP_CLIENT_IP'}
|
|Which you may need to deal with as well.
|
|So how can I block a visitor who is jumping around through proxies? I don't 
|want to block out the proxy as this could ultimately block out all AOL users 
|for example.
|
|Thanks!
|John
|
|_________________________________________________________________
|STOP MORE SPAM with the new MSN 8 and get 2 months FREE*  
|http://join.msn.com/?page=features/junkmail
|
|
|
|
|

-- 
xavier renaut, 514 906 1212 x226