Bloquear Ultrasurft y demas configuraciones iptables

By 
# ANTI-ULTRASURF
for string in `sed $route/blacklist-string`; do
 $iptables -I FORWARD -p tcp --dport 443 --tcp-flags SYN,ACK,FIN,RST,PSH ACK,PSH -m string --to 77 --hex-string "|$string|" --algo bm -j DROP
 $iptables -I FORWARD -m tcp -p tcp --dport 443 -m string --to 256 --hex-string "|$string|" --algo bm -j DROP
http://www.hackplayers.com/2014/08/powerless.html
http://www.chw.net/foro/gnu-linux-y-otros-sistemas-operativos/910355-how-to-bloquear-gmail-hotmail-facebook-443-iptables.html
http://www.linux-party.com/index.php/57-seguridad/7980-20-ejemplos-iptables-para-administradores-de-sistemas-linux#
http://kb.kerio.com/product/kerio-control/content-filtering/how-to-block-facebook-789.html

# BLOCK FACEBOOK
iptables -I FORWARD -p tcp --dport 443 -m string --string 'facebook' --algo bm -j DROP
#iptables -A FORWARD -p tcp -m string --string 'facebook.com' --algo kmp -j DROP
iptables -A INPUT -s 173.252.120.6 -j DROP
iptables -A INPUT -s 31.13.73.161 -j DROP
iptables -A INPUT -s 31.13.73.97 -j DROP
iptables -A INPUT -s 31.13.73.145 -j DROP
---

http://www.maravento.com/2013/03/firewall.html
http://www.nirsoft.net/utils/smsniff.html
http://www.eltipodeinformatica.com/2013/02/bloquear-youtube-y-permitir-solo.html
http://segurancalinux.blogspot.com/2013/06/bloquear-o-ultrasurf-iptables-fail2ban.html
http://misapuntesti.blogspot.com/2013/08/bloquear-ultrasurf.html
http://amperis.blogspot.com/2008/11/bloquear-ultrasurf.html

1 comentario:

  1. Anónimo5 de octubre de 2015, 7:07

    Hi. Update rule. Thanks

    route=/etc/acl
    # blacklist-string download
    # https://drive.google.com/open?id=0B0IOC2-GhY8PYzNwdEpKX1FHRlk

    # Iptables Anti-Ultrasurf
    for string in `sed '/#.*/d' $route/blackstring`; do
    $iptables -I FORWARD -p tcp --dport 443 --tcp-flags SYN,ACK,FIN,RST,PSH ACK,PSH -m string --to 77 --hex-string "|$string|" --algo bm -j DROP
    $iptables -I FORWARD -p tcp --dport 443 --tcp-flags SYN,ACK,FIN,RST,PSH ACK,PSH -m string --to 77 --hex-string "|$string|" --algo bm -j NFLOG --nflog-prefix 'Illegal: ultrasurf'
    # to extra expand search
    $iptables -I FORWARD -p tcp --dport 443 -m string --to 512 --hex-string "|$string|" --algo bm -j DROP
    done

    ResponderEliminar