LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Non-*NIX Forums > General
User Name
Password
General This forum is for non-technical general discussion which can include both Linux and non-Linux topics. Have fun!

Notices

Reply
 
LinkBack Search this Thread
Old 11-26-2009, 08:21 AM   #1
rikijpn
Member
 
Registered: Jun 2007
Location: Japan
Distribution: Debian lenny, DSL, Solaris 10
Posts: 157

Rep: Reputation: 33
How to block QQ messenger by blocking IPs


I'm trying to block a messenger called qq or qq international, it's a chinese messenger. I'm using a very simple router that can only block by url, or IP. Since this messenger, having its default ports blocked, uses the http/https ports as a last resort, blocking its ports doesn't really do the job.

On the official website there wasn't any information about where does it connect (what server should I block), but after some googling around I found some IPs, and that it connects to servers sz.tencent.com, and sz[2-9].tencent.com.

Everytime I blocked one IP from one of those servers, it ended up changing again the next time I tried it (using ping to test whether it was blocked or not). So I just blocked the whole range of IPs from those providers, they are chinese providers and nobody uses them so there is no problem in that.

I blocked the IPs by doing a whois on the IP returned after pinging the above written URLs, and blocking the range returned. E.g.
Code:
$ping sz.tencent.com
PING sz.tencent.com (219.133.49.163) 56(84) bytes of data.
...
...
$whois 219.133.49.163
% [whois.apnic.net node-1]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

inetnum:      219.128.0.0 - 219.137.255.255
...
So I would block the IPs of the range from 219.128.0.0 to 219.137.255.255.
Done that on the sz.tencent.com and all the sz[2-9].tencent.com servers, ping returns 100% packet loss on all the servers. So at least I'm sure all those servers are blocked.

Shouldn't this work? Because for some reason QQ messenger still connects...
If anyone knows this messenger and has some information on how to block it, it would be greatly appreciated.
 
Old 11-26-2009, 11:13 PM   #2
ProtoformX
Member
 
Registered: Feb 2004
Location: Canada
Distribution: LFS SVN
Posts: 334

Rep: Reputation: 33
Quote:
Originally Posted by rikijpn View Post
I'm trying to block a messenger called qq or qq international, it's a chinese messenger. I'm using a very simple router that can only block by url, or IP. Since this messenger, having its default ports blocked, uses the http/https ports as a last resort, blocking its ports doesn't really do the job.

On the official website there wasn't any information about where does it connect (what server should I block), but after some googling around I found some IPs, and that it connects to servers sz.tencent.com, and sz[2-9].tencent.com.

Everytime I blocked one IP from one of those servers, it ended up changing again the next time I tried it (using ping to test whether it was blocked or not). So I just blocked the whole range of IPs from those providers, they are chinese providers and nobody uses them so there is no problem in that.

I blocked the IPs by doing a whois on the IP returned after pinging the above written URLs, and blocking the range returned. E.g.
Code:
$ping sz.tencent.com
PING sz.tencent.com (219.133.49.163) 56(84) bytes of data.
...
...
$whois 219.133.49.163
% [whois.apnic.net node-1]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

inetnum:      219.128.0.0 - 219.137.255.255
...
So I would block the IPs of the range from 219.128.0.0 to 219.137.255.255.
Done that on the sz.tencent.com and all the sz[2-9].tencent.com servers, ping returns 100% packet loss on all the servers. So at least I'm sure all those servers are blocked.

Shouldn't this work? Because for some reason QQ messenger still connects...
If anyone knows this messenger and has some information on how to block it, it would be greatly appreciated.

Try netstat you can see exactly were QQ is sending these packets, then add those ip's to the blacklist and boom no more QQ.
 
Old 11-26-2009, 11:52 PM   #3
rikijpn
Member
 
Registered: Jun 2007
Location: Japan
Distribution: Debian lenny, DSL, Solaris 10
Posts: 157

Original Poster
Rep: Reputation: 33
qq is not running on my computer...

Quote:
Originally Posted by ProtoformX View Post
Try netstat you can see exactly were QQ is sending these packets, then add those ip's to the blacklist and boom no more QQ.
Thanks for the advice. But QQ is not running from my computer, just from another computer on the same LAN. And all the computers in the LAN are connected to a "cheap" router.
netstat only shows the ports open on the computer it is running in, right? And my router doesn't have any netstat-like tool, that's why I had to google around looking for those IPs.
Yeah, if anyone has done as above ---blocked the IPs got with netstat---, I'd really like to get them... Other advices are welcome as well.
 
Old 11-27-2009, 02:42 PM   #4
ProtoformX
Member
 
Registered: Feb 2004
Location: Canada
Distribution: LFS SVN
Posts: 334

Rep: Reputation: 33
Quote:
Originally Posted by rikijpn View Post
Thanks for the advice. But QQ is not running from my computer, just from another computer on the same LAN. And all the computers in the LAN are connected to a "cheap" router.
netstat only shows the ports open on the computer it is running in, right? And my router doesn't have any netstat-like tool, that's why I had to google around looking for those IPs.
Yeah, if anyone has done as above ---blocked the IPs got with netstat---, I'd really like to get them... Other advices are welcome as well.
Netstat give you something better (the domain name), all you need to do is blacklist that domain name (if your router supports it)
 
Old 01-31-2010, 12:46 AM   #5
rikijpn
Member
 
Registered: Jun 2007
Location: Japan
Distribution: Debian lenny, DSL, Solaris 10
Posts: 157

Original Poster
Rep: Reputation: 33
even with netstat...

Ok, I got a computer with windows. Installed qq just so I could use netstat there and find out what IPs to block.
In the windows computer, I did
Code:
netstat -ao 5
and logged in with qq.
I looked for the PID of QQ (1620), and there were some lines like this:
Code:
Proto Local Address       Foreign Address           State       PID
TCP   NOTEBOOK:1062       reverse.gdsz.cncnet.net:http ESTABLISHED  1620
UDP   NOTEBOOK:1063       *:*                                   1620 
UDP   NOTEBOOK:4005       *:*                                   1620
I obviously thought the url, reverse.gdsz.cncnet.net, had something to do with the process of logging in. So I blocked the address in my router.

I logged out, and logged in again. And it had no problems connecting...
I tried blocking the UDP and TCP ports from 1000 to 1100, as well as the UDP ports from 4000 to 4100. And every time I try to log in again, another port gets used like UDP 4005 (previous session) to 4006 (after logging out previous session, current session). I thought blocking the UDP ports 4000-4100 would solve this, but apparently it didn't.
Somehow, QQ is still able to log in.


If I block the http port in my router, it gets blocked. And I tried pinging to the url above, and it said unknown host. So I guess the router does correctly blocks urls and the ports I tell it to. I really have no idea what to do next...
I thought there might be another program for the function of logging in, but I don't seem to find it, so I guess not.
Maybe my usage of netstat is wrong and it's not showing me the information I need or something? I really can't believe after blocking its ports and everything it still gets connected.

Any help would be greatly appreciated.
 
Old 01-31-2010, 12:55 AM   #6
jschiwal
Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 654Reputation: 654Reputation: 654Reputation: 654Reputation: 654Reputation: 654
There seem to also be some tcpconn[,2-9].tencent.com domains as well.
Code:
119.147.11.192                                                                                                                                                                                             
119.147.12.180                                                                                                                                                                                             
119.147.12.182                                                                                                                                                                                             
119.147.12.183                                                                                                                                                                                             
119.147.12.185                                                                                                                                                                                             
119.147.12.188                                                                                                                                                                                             
119.147.12.189                                                                                                                                                                                             
119.147.12.190                                                                                                                                                                                             
119.147.12.191                                                                                                                                                                                             
119.147.12.192                                                                                                                                                                                             
119.147.12.193                                                                                                                                                                                             
119.147.12.195                                                                                                                                                                                             
119.147.12.197                                                                                                                                                                                             
119.147.12.198                                                                                                                                                                                             
119.147.12.199                                                                                                                                                                                             
119.147.13.226                                                                                                                                                                                             
119.147.13.227                                                                                                                                                                                             
119.147.13.244                                                                                                                                                                                             
119.147.13.245                                                                                                                                                                                             
119.147.14.146                                                                                                                                                                                             
119.147.14.150                                                                                                                                                                                             
119.147.18.34                                                                                                                                                                                              
119.147.18.42                                                                                                                                                                                              
119.147.18.44                                                                                                                                                                                              
119.147.18.46                                                                                                                                                                                              
119.147.18.49                                                                                                                                                                                              
119.147.18.50                                                                                                                                                                                              
119.147.18.51                                                                                                                                                                                              
119.147.18.52                                                                                                                                                                                              
119.147.18.54                                                                                                                                                                                              
119.147.18.55                                                                                                                                                                                              
119.147.18.56                                                                                                                                                                                              
119.147.19.211                                                                                                                                                                                             
119.147.19.213                                                                                                                                                                                             
119.147.9.78                                                                                                                                                                                               
121.14.101.126                                                                                                                                                                                             
121.14.101.149                                                                                                                                                                                             
121.14.101.181                                                                                                                                                                                             
121.14.74.138                                                                                                                                                                                              
121.14.74.247                                                                                                                                                                                              
121.14.75.51                                                                                                                                                                                               
121.14.78.124                                                                                                                                                                                              
121.14.78.41                                                                                                                                                                                               
121.14.96.48                                                                                                                                                                                               
121.14.98.31                                                                                                                                                                                               
208.69.36.132                                                                                                                                                                                              
208.69.36.132                                                                                                                                                                                              
208.69.36.132                                                                                                                                                                                              
208.69.36.132                                                                                                                                                                                              
208.69.36.132                                                                                                                                                                                              
208.69.36.132                                                                                                                                                                                              
208.69.36.132                                                                                                                                                                                              
208.69.36.132                                                                                                                                                                                              
208.69.36.132                                                                                                                                                                                              
208.69.36.132                                                                                                                                                                                              
208.69.36.132                                                                                                                                                                                              
208.69.36.132                                                                                                                                                                                              
208.69.36.132                                                                                                                                                                                              
208.69.36.132                                                                                                                                                                                              
219.133.48.107                                                                                                                                                                                             
219.133.48.108                                                                                                                                                                                             
219.133.48.109                                                                                                                                                                                             
219.133.49.125                                                                                                                                                                                             
219.133.49.163                                                                                                                                                                                             
219.133.49.169                                                                                                                                                                                             
219.133.49.170                                                                                                                                                                                             
219.133.49.171                                                                                                                                                                                             
219.133.49.173                                                                                                                                                                                             
219.133.49.47                                                                                                                                                                                              
219.133.51.238                                                                                                                                                                                             
219.133.51.249                                                                                                                                                                                             
219.133.51.250                                                                                                                                                                                             
219.133.51.251                                                                                                                                                                                             
219.133.60.148                                                                                                                                                                                             
219.133.60.172                                                                                                                                                                                             
219.133.60.18                                                                                                                                                                                              
219.133.60.19                                                                                                                                                                                              
219.133.60.20                                                                                                                                                                                              
219.133.60.21                                                                                                                                                                                              
219.133.60.22                                                                                                                                                                                              
219.133.60.23                                                                                                                                                                                              
219.133.60.24                                                                                                                                                                                              
219.133.60.246                                                                                                                                                                                             
219.133.60.25                                                                                                                                                                                              
219.133.60.250                                                                                                                                                                                             
219.133.60.26                                                                                                                                                                                              
219.133.60.27                                                                                                                                                                                              
219.133.62.10                                                                                                                                                                                              
219.133.62.2                                                                                                                                                                                               
219.133.62.3                                                                                                                                                                                               
219.133.62.4                                                                                                                                                                                               
219.133.63.54                                                                                                                                                                                              
58.251.58.14                                                                                                                                                                                               
58.251.58.199                                                                                                                                                                                              
58.251.58.200                                                                                                                                                                                              
58.251.58.201                                                                                                                                                                                              
58.251.58.232                                                                                                                                                                                              
58.251.58.233                                                                                                                                                                                              
58.251.58.241                                                                                                                                                                                              
58.251.60.51                                                                                                                                                                                               
58.251.60.53                                                                                                                                                                                               
58.251.61.203                                                                                                                                                                                              
58.251.61.205                                                                                                                                                                                              
58.251.61.208                                                                                                                                                                                              
58.251.62.117                                                                                                                                                                                              
58.251.62.14                                                                                                                                                                                               
58.251.62.15                                                                                                                                                                                               
58.251.62.17                                                                                                                                                                                               
58.251.62.25                                                                                                                                                                                               
58.251.62.26                                                                                                                                                                                               
58.251.62.31                                                                                                                                                                                               
58.251.62.37                                                                                                                                                                                               
58.251.62.38                                                                                                                                                                                               
58.251.62.40                                                                                                                                                                                               
58.251.62.41                                                                                                                                                                                               
58.251.62.42                                                                                                                                                                                               
58.251.62.61                                                                                                                                                                                               
58.251.62.62                                                                                                                                                                                               
58.251.62.63                                                                                                                                                                                               
58.251.62.64                                                                                                                                                                                               
58.251.62.69
58.251.63.107
58.60.14.101
58.60.14.102
58.60.14.102
58.60.14.103
58.60.14.104
58.60.14.106
58.60.14.108
58.60.14.109
58.60.14.110
58.60.14.111
58.60.14.113
58.60.14.180
58.60.14.191
58.60.14.193
58.60.14.195
58.60.14.199
58.60.14.201
58.60.14.202
58.60.14.242
58.60.14.32
58.60.14.33
58.60.14.37
58.60.14.40
58.60.14.41
58.60.14.45
58.60.14.46
58.60.14.47
58.60.14.48
58.60.14.51
58.60.14.52
58.60.14.53
58.60.15.31
58.60.15.34
58.60.15.36
58.60.15.38
58.60.15.39
58.60.15.41
58.60.15.96
58.60.15.97
58.60.15.98
58.61.165.205
58.61.165.216
58.61.165.62
58.61.165.63
58.61.32.242
58.61.33.120
58.61.33.121
58.61.34.20
58.61.34.21
58.61.34.24
58.61.34.25
58.61.34.26
58.61.34.51
58.61.34.85
58.61.34.95
sorry for all the blank spaces. They occurred while cutting & pasting somehow.

Do they use a tun server service that you haven't blocked.
Installing the program yourself and monitoring your own traffic may provide more clues.

You could add IP address to block on your computers own firewall, and retry connections.
You could use netstat in the continuous mode to record traffic continuously.

Downloading an OS QQ plugin shows these domains:

strings * | egrep '(udp|tcp)'
%s(): nick=%s, udp=%s
tcp://tcpconn4.tencent.com:8000
tcp://tcpconn3.tencent.com:8000
tcp://tcpconn2.tencent.com:8000
tcp://tcpconn.tencent.com:8000
udp://202.104.129.254:8080
udp://64.144.238.155:8080
udp://202.96.170.64:8080
udp://sz7.tencent.com:8000
udp://sz6.tencent.com:8000
udp://sz5.tencent.com:8000
udp://sz4.tencent.com:8000
udp://sz3.tencent.com:8000
udp://sz2.tencent.com:8000
udp://sz.tencent.com:8000
[CClientConnection] setServer(udp=%d, host=%s, port=%d)

Last edited by jschiwal; 01-31-2010 at 01:48 AM.
 
Old 01-31-2010, 01:17 AM   #7
rikijpn
Member
 
Registered: Jun 2007
Location: Japan
Distribution: Debian lenny, DSL, Solaris 10
Posts: 157

Original Poster
Rep: Reputation: 33
already blocked><

Quote:
Originally Posted by jschiwal View Post
From digg:
Code:
;; ANSWER SECTION:
sz.tencent.com.         2891    IN      A       219.133.60.26
sz.tencent.com.         2891    IN      A       219.133.60.27
sz.tencent.com.         2891    IN      A       219.133.60.172
sz.tencent.com.         2891    IN      A       219.133.62.4
sz.tencent.com.         2891    IN      A       219.133.49.47
sz.tencent.com.         2891    IN      A       219.133.49.163
sz.tencent.com.         2891    IN      A       219.133.49.169
sz.tencent.com.         2891    IN      A       219.133.49.170
sz.tencent.com.         2891    IN      A       219.133.49.171
sz.tencent.com.         2891    IN      A       219.133.49.173
sz.tencent.com.         2891    IN      A       219.133.51.251
sz.tencent.com.         2891    IN      A       219.133.60.18
sz.tencent.com.         2891    IN      A       219.133.60.19
sz.tencent.com.         2891    IN      A       219.133.60.20
sz.tencent.com.         2891    IN      A       219.133.60.21
sz.tencent.com.         2891    IN      A       219.133.60.22
sz.tencent.com.         2891    IN      A       219.133.60.23
sz.tencent.com.         2891    IN      A       219.133.60.24
sz.tencent.com.         2891    IN      A       219.133.60.25
Thanks for the IPs. But as I already posted above, I already blocked all the IPs whithin the range 219.128.0.0 - 219.137.255.255, which includes all the IPs listed there. I already made sure it can't connect anywhere, anyhow to a sz.tencent.com server...
 
Old 01-31-2010, 01:39 AM   #8
rikijpn
Member
 
Registered: Jun 2007
Location: Japan
Distribution: Debian lenny, DSL, Solaris 10
Posts: 157

Original Poster
Rep: Reputation: 33
reverse.gdsz.cncnet.net

It's connecting to reverse.gdsz.cncnet.net through the http port, and when the URL is blocked in the router it shouldn't connect. However I found out by restarting qq a couple of times, that it keeps connecting there somehow.

I did a whois on gdsz.cncnet.net (reverse.gdsz.cncnet.net wouldn't return anything) on this site http://www.robtex.com/dns/gdsz.cncnet.net.html and got these IPs: 221.4.64.0/19 221.4.8.0/22 221.4.64.0/19, blocked them too. But still get the ESTABLISHED state on netstat when I restart the program... maybe this is likely to be the problem?
Anyone has any idea of how it keeps connecting there? / What may I be doing wrong?
 
Old 01-31-2010, 01:59 AM   #9
jschiwal
Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 654Reputation: 654Reputation: 654Reputation: 654Reputation: 654Reputation: 654
I hadn't read every IP in my list (out of laziness) because there were so many.
I did update my post with more IPs. Some of the tcpconnect*. domains may have different numbers.
 
Old 01-31-2010, 02:48 AM   #10
rikijpn
Member
 
Registered: Jun 2007
Location: Japan
Distribution: Debian lenny, DSL, Solaris 10
Posts: 157

Original Poster
Rep: Reputation: 33
monitoring with netstat

Thank you very much for the IPs! Do you have QQ blocked in your computer/router?

I had already some of them blocked, but there were a lot of them which I hadn't.

Blocking these IPs: 119.144.0.0/14, 121.14.0.0/17, 208.69.36.0/24, 219.133.48.0/18, 58.248.0.0/13, 58.56.0.0/13 should have the same effect that blocking all the IPs you gave me (I block some more, but just for the simplicity).

Also from your log
Code:
udp://202.104.129.254:8080
udp://64.144.238.155:8080
udp://202.96.170.64:8080
I'm trying blocking 202.104.128.0/17 and 64.144.0.0/16 just for the test.

It still connects...

This is the log I got from netstat. I added some comments.
Code:
#PID 1408 is QQ
#before opening qq
Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    NOTEBOOK:epmap         NOTEBOOK:0             LISTENING       984
  TCP    NOTEBOOK:microsoft-ds  NOTEBOOK:0             LISTENING       4
  TCP    NOTEBOOK:1029          NOTEBOOK:0             LISTENING       1788
  TCP    NOTEBOOK:5152          NOTEBOOK:0             LISTENING       180
  TCP    NOTEBOOK:netbios-ssn   NOTEBOOK:0             LISTENING       4
  UDP    NOTEBOOK:microsoft-ds  *:*                                    4
  UDP    NOTEBOOK:isakmp        *:*                                    764
  UDP    NOTEBOOK:1033          *:*                                    1248
  UDP    NOTEBOOK:4500          *:*                                    764
  UDP    NOTEBOOK:ntp           *:*                                    1076
  UDP    NOTEBOOK:1900          *:*                                    1376
  UDP    NOTEBOOK:ntp           *:*                                    1076
  UDP    NOTEBOOK:netbios-ns    *:*                                    4
  UDP    NOTEBOOK:netbios-dgm   *:*                                    4
  UDP    NOTEBOOK:1900          *:*                                    1376

#qq is logging in
Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    NOTEBOOK:epmap         NOTEBOOK:0             LISTENING       984
  TCP    NOTEBOOK:microsoft-ds  NOTEBOOK:0             LISTENING       4
  TCP    NOTEBOOK:1029          NOTEBOOK:0             LISTENING       1788
  TCP    NOTEBOOK:5152          NOTEBOOK:0             LISTENING       180
  TCP    NOTEBOOK:netbios-ssn   NOTEBOOK:0             LISTENING       4
  UDP    NOTEBOOK:microsoft-ds  *:*                                    4
  UDP    NOTEBOOK:isakmp        *:*                                    764
  UDP    NOTEBOOK:1033          *:*                                    1248
  UDP    NOTEBOOK:4000          *:*                                    1408
  UDP    NOTEBOOK:4002          *:*                                    1408
  UDP    NOTEBOOK:4500          *:*                                    764
  UDP    NOTEBOOK:ntp           *:*                                    1076
  UDP    NOTEBOOK:1900          *:*                                    1376
  UDP    NOTEBOOK:ntp           *:*                                    1076
  UDP    NOTEBOOK:netbios-ns    *:*                                    4
  UDP    NOTEBOOK:netbios-dgm   *:*                                    4
  UDP    NOTEBOOK:1900          *:*                                    1376

#qq logged in...
Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    NOTEBOOK:epmap         NOTEBOOK:0             LISTENING       984
  TCP    NOTEBOOK:microsoft-ds  NOTEBOOK:0             LISTENING       4
  TCP    NOTEBOOK:1029          NOTEBOOK:0             LISTENING       1788
  TCP    NOTEBOOK:5152          NOTEBOOK:0             LISTENING       180
  TCP    NOTEBOOK:netbios-ssn   NOTEBOOK:0             LISTENING       4
  TCP    NOTEBOOK:1118          reverse.gdsz.cncnet.net:http  ESTABLISHED     14
08
  UDP    NOTEBOOK:microsoft-ds  *:*                                    4
  UDP    NOTEBOOK:isakmp        *:*                                    764
  UDP    NOTEBOOK:1033          *:*                                    1248
  UDP    NOTEBOOK:4000          *:*                                    1408
  UDP    NOTEBOOK:4002          *:*                                    1408
  UDP    NOTEBOOK:4500          *:*                                    764
  UDP    NOTEBOOK:ntp           *:*                                    1076
  UDP    NOTEBOOK:1900          *:*                                    1376
  UDP    NOTEBOOK:ntp           *:*                                    1076
  UDP    NOTEBOOK:netbios-ns    *:*                                    4
  UDP    NOTEBOOK:netbios-dgm   *:*                                    4
  UDP    NOTEBOOK:1900          *:*                                    1376
Any ideas?
 
Old 01-31-2010, 03:05 AM   #11
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,539
Blog Entries: 51

Rep: Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604
Quote:
Originally Posted by rikijpn View Post
all the computers in the LAN are connected to a "cheap" router.
Blocking IP addresses isn't, this is your main problem: you're trying to turn the router into something it isn't, namely a versatile, configurable firewall.


Quote:
Originally Posted by rikijpn View Post
Other advices are welcome as well.
So how about using a GNU/Linux, .*BSD or whatever else *way* more configurable machine as router instead? That way you could more easily define a policy blocking traffic using iptables rules plus an IDS for catching traffic that doesn't "play nice" like the QQ IM. There are multiple firewall distributions to choose from in case you do not want to build it from the ground up.
 
Old 01-31-2010, 06:08 AM   #12
rikijpn
Member
 
Registered: Jun 2007
Location: Japan
Distribution: Debian lenny, DSL, Solaris 10
Posts: 157

Original Poster
Rep: Reputation: 33
Quote:
Originally Posted by unSpawn View Post
Blocking IP addresses isn't, this is your main problem: you're trying to turn the router into something it isn't, namely a versatile, configurable firewall.
So how about using a GNU/Linux, .*BSD or whatever else *way* more configurable machine as router instead? That way you could more easily define a policy blocking traffic using iptables rules plus an IDS for catching traffic that doesn't "play nice" like the QQ IM. There are multiple firewall distributions to choose from in case you do not want to build it from the ground up.
Thanks for the advice.
Yes, I realize using a linux machine as a router would be a lot easier for this task. The thing is, I already have a router. And blocking a messenger isn't supposed to be such a hard task (so I thought^^, kinda wrong).
In order to use my linux machine as a router too, I'd have to buy another lan card. Besides the fact that it would cost me money, I'd prefer not to use my main computer as a router, not only for security reasons, but simply because it's very loud, and have to shut it down at night, which is not the idea.

Well, if it really can't be done, I'd like to know so. But it sounds pretty logical to me that blocking where it connects, a messenger should be correctly blocked.
 
Old 01-31-2010, 07:22 AM   #13
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,539
Blog Entries: 51

Rep: Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604
The problem with IP blacklisting your way is that it is maintenance-intensive and it will always be incomplete unless you know its methods for "phoning home". While I prefer the GNU/Linux side of things for reasons of stability, performance, versatility and security reasons I understand perfectly well that money can be an issue. While incursions into mcrsft territory are not my thing, if you have physical access to said mcrsft machine or if you can push policies its way you could resort to installing a SW firewall locally, perferably one with lockable admin settings, that denies outbound connections based on executable specs.
 
  


Reply

Tags
block, ip, messenger, qq, router


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
blocking ips thesnaggle Linux - Networking 3 03-02-2009 12:26 PM
blocking ips jeff80 Linux - Newbie 4 06-27-2008 08:27 PM
Blocking ips from access andy1974 Linux - Security 5 06-27-2007 06:21 AM
Blocking IPs bluelaguna Linux - Security 2 05-28-2004 02:08 PM
Blocking IPS clanehleader Linux - Security 2 09-01-2003 10:13 PM


All times are GMT -5. The time now is 07:37 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration