I was taking a peek at the active connections shown by the Firestarter GUI and noticed the following (the source is my computer):

Source Destination Port Service Program
192.168.0.112 66.235.133.42 80 HTTP

I closed all Internet related apps and the connection persisted. After a reboot it did not reconnect (yet).

The IP address appears to belong to esomniture.com - some sort of web analytics company.

So my question is... How do I prevent my computer from connecting to these rascals. I have found a lot of documentation regarding stopping inbound connections to services on my computer but not the other way. I have various filtering addons installed in Firefox however, this connection seems to be at a lower level as no program is specified as being responsible for the connection.

TIA,

Ken

Hi,

iptables -i output -d 66.235.133.42 -j DROP

should force anything going from your machine to that ip to just be dropped for the session. It might require sudo and run by /sbin/iptables rather then iptables.

This of course assumes you are running iptables, this is only a temp fix, but let's see if it works first.

Thanks r3sistance,

I will try that if/when the connection reappears. Otherwise I will have no idea if it works as desired.

Yes, I am running iptables - Firestarter is a GUI front end for it as I understand.

Further searching tells me that the offending web site uses tracking cookies. I clear all cookies when I close Firefox so I generally do not worry about them very much. I have explicitly added esomniture.com to Add Block Plus so I may never see it again.

However, I have your command example in my bag of tricks should some other rascal connection appear.

Regards,

Ken

please note that the command I supplied is for the destination IP, if you want to block traffic coming from an ip you'd use -s instead of -d as -s states source IP.

Hi r3sistance,

I found another connection I did not like and tried your command. I received the following
I tried both with and w/o sudo and with and w/o sbin. What am I missing?

TIA

Ken

the case is wrong, use "iptables -I OUTPUT -d xx.xxx.xxx.xx -j DROP" instead.

Thanks acid_kewpie,

In the interim I have tracked down my latest strange connection. It seems to that VMWare player and workstation phone home to be able to download updates and other necessary files on an as needed basis. Why the programs need to maintain a continuous HTTPS connection - who knows. I found the preference settings to turn off the phone home. I will keep the correct syntax in my bag of tricks and try it in the future.

Ken

Hi Ken,

Sorry about the case mistake there, it's useful to know iptables when it comes to being secure. VMWare does like to keep up to date and has caused other issues in the past but it's still a sweet piece of software relatively speaking, personally tho, license prices do put me off.

r3sistance.

Thanks r3sistance,

From what little I have looked into Iptables - it is hardly user friendly. I am running Firestarter in anal retentive mode where it stops everything unless I allow the connection. I have enabled HTTP, HTTPS, ssh, smb and a couple of others such as ftp to my ISP's speed test site. When I see a connection which I do not expect, such as the one from VMWare, I get a little perturbed and investigate.

As to VMWare... I purchased a license for Workstation on sale a couple of years back on Cyber Monday. I though I needed it to create virtual machines although I knew I could run them in the free Player. Turns out that Player can create new machines so I have the extra capabilities of Workstation although I do not really take advantage of them.

I have run Linux for many years - at least a Samba server for file and printer sharing - but until recently not as my primary OS. Now that I have a more capable machine (Dell XPS 8000 with an i7-860 processor and 8 GB of RAM) I am running Ubuntu 9.10 64 bit with an XP Pro VM for those few things I cannot yet run in Linux (such as some Flash enabled web sites).

Enough computer stuff for the moment. I have to do some TIG welding on a brake servo I am repairing for my 1980 MGB and I have to fabricate new wings for the wife's whirly gig goose. The recent winds have broken off two of them.

Regards,

Ken