>> 3. I'm intrested in blocking kazaa/P2P trafic with IPFW any help in thisissue you could possibly block connections at known p2p ports. deny tcp from any to any 6699 step but most of the newer protocols use dynamic ports and in turn, are configurable. so ipfw isn't exactly ideal on it's own for this. -r. -----Original Message----- From: Pons [mailto:pons@gmx.li] Sent: Tuesday, February 24, 2004 6:33 AM To: freebsd-security@freebsd.org Subject: improve ipfw rules I have configured a FreeBSD 5.1 rel box 2 NIC's (Ext.ip/Int.ip) with ipfw/natd/squid the setup is working
AFAIK, It is impossible to truely block P2P traffic with any standard firewalling system. It is the holy grail of ISPs these days. I know of only one system that can do this effectively and it is commercial http://www.qosmos.fr , as I have already stated in other FreeBSD mailing list. The way they do it , is by implementing a protocol analyser (on the fly analysis) that has protocol dictionaries and syntax , which can go up in the layers and block on the fly any traffic that it has been specified to block. It is my hope that someday someone will step in and implement a similar system under FreeBSD. But i think it requires quite a lot of work and possibly major rebuilding of ipfw if it needs to be integrated (which would be great) On Tue, 24 Feb 2004 10:09:24 -0500 Richy Kim <rkim@sandvine.com> wrote:> >> 3. I'm intrested in blocking kazaa/P2P trafic with IPFW any help in this > issue > you could possibly block connections at known p2p ports. > deny tcp from any to any 6699 step > but most of the newer protocols use dynamic ports and in turn, are > configurable. > so ipfw isn't exactly ideal on it's own for this. > > -r. >-- ==============================================================Christophe Prevotaux ===============================================================
> It is my hope that someday someone will step in and implement a similar > system under FreeBSD. But i think it requires quite a lot of work and > possibly > major rebuilding of ipfw if it needs to be integrated (which would be > great)?Perhaps Snort with Flexresp? It should be able to close a connection upon detection of a signature. Borja.
Hi. Take a look at: http://jk.yazzy.org/articles/openbsd/kazaa.html Jochem describes there how to block Kazaa with snort on OpenBSD. Hope this helps. On Tue, 24 Feb 2004 10:09:24 -0500 Richy Kim <rkim@sandvine.com> wrote:> >> 3. I'm intrested in blocking kazaa/P2P trafic with IPFW any help in this > issue > you could possibly block connections at known p2p ports. > deny tcp from any to any 6699 step > but most of the newer protocols use dynamic ports and in turn, are > configurable. > so ipfw isn't exactly ideal on it's own for this. > > -r. > > > -----Original Message----- > From: Pons [mailto:pons@gmx.li] > Sent: Tuesday, February 24, 2004 6:33 AM > To: freebsd-security@freebsd.org > Subject: improve ipfw rules > > > I have configured a FreeBSD 5.1 rel box 2 NIC's (Ext.ip/Int.ip) > with ipfw/natd/squid the setup is working > > _______________________________________________ > freebsd-security@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"