how can i block a proxy

sanjay_mishra · 07-26-2006, 10:39 AM

i am working as a system administrator in an institution. i have blocked many malicious sites. but people are still accessing them using some proxy. how can i overcome this problem.

msound · 07-26-2006, 11:01 AM

could you tell us a little more about your setup? how many users? what are you using to block the malicous sites, how do you know they're accessing a remote proxy? If you check your gateway's outgoing logs, you could probably find the ip address of the remote proxy they're using. You could probably then filter the proxy's ip using the same system you use to filter web sites.

cachemonet · 07-26-2006, 03:43 PM

If you are using iptabkes as your firewall you can add teh geoip extensions. They block based upon contry code and they have a country code for proxies. Check out patch-o-matic at http://www.netfilter.org/ It is a bit more complicted than that but, if you decide to go this route, I can help a bit more later.

sanjay_mishra · 07-27-2006, 03:32 AM

Quote:

Originally Posted by msound

could you tell us a little more about your setup? how many users? what are you using to block the malicous sites, how do you know they're accessing a remote proxy? If you check your gateway's outgoing logs, you could probably find the ip address of the remote proxy they're using. You could probably then filter the proxy's ip using the same system you use to filter web sites.

i am using debian distro and squid proxy server.
i blocked sites using the file /etc/squid/sitesBlocked . i can see the ip-addresses of proxies in logfiles, and blocked some also, but anyone can find other proxies by searching on google. how many of them can i block. these sites are thousands in number.

prozac · 07-27-2006, 04:28 AM

there seems to be no simple answer for this, atleast i haven't found one. you can by default block all sites and then open the good sites one by one but its helluva difficult and impractical. in another way, you can attempt to block all the nasty proxy sites, but how many? your best choice would be to, plug-out the network cable of the defaulters and warn them not to go against the rules else, let the defaulter(s) system be a standalone for sometime till the lesson drives home. That threat works!

win32sux · 07-27-2006, 05:12 AM

you could install dansguardian along with your squid... it comes with a phraselist for proxies...

having said that, the most effective thing would be to whitelist websites, like prozac suggested - if it's possible for you...

~=gr3p=~ · 07-27-2006, 05:33 AM

yes i too use dansguardian and sarg...and offcourse you will have to impose the policies on your users..like banning them if found bypassing the filter.

Matir · 07-27-2006, 12:29 PM

And of course, you have to look at your motivations and goal in the end. Which 'malicious sites' are people going out of their way to access?

This may be a case for policy, not technology.

Farrukh Fida · 09-28-2006, 01:09 AM

Quote:

Originally Posted by sanjay_mishra

i am working as a system administrator in an institution. i have blocked many malicious sites. but people are still accessing them using some proxy. how can i overcome this problem.

Here I want to ask that Transparent proxy setting is not working in your scenario
like if 192.168.1.1 is your gateway or proxy and ports are 3128 or 8080 either then

iptables -A FORWARD -s 192.168.1.1/24 -d ! 192.168.1.1 --dport 3128 -p TCP -j DROP

iptables -A FORWARD -s 192.168.1.1/24 -d ! 192.168.1.1 --dport 8080 -p TCP -j DROP

We must also make sure that nobody will try to cheat and connect to the internet directly (IP-masquerade) to download web pages:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

Have an easy Life.....