1 |
On 15/12/14 20:39, Alan McKinnon wrote: |
2 |
> On 15/12/2014 18:47, meino.cramer@×××.de wrote: |
3 |
>> Hi, |
4 |
>> |
5 |
>> this question is not related to a fully fledged, |
6 |
>> big local area network with DMZs and such. |
7 |
>> |
8 |
>> Even the word "firewall" seems to be a little too |
9 |
>> "huge and mighty" in this context to me. |
10 |
>> |
11 |
>> "The network" consists of a PC, which is connected |
12 |
>> to a FritzBox (cable, no Wifi/WLAN), which connects |
13 |
>> to the ISP (internet) and (same adress range) to a |
14 |
>> embedded system (eth1) |
15 |
>> |
16 |
>> There are two additional embedded systems, both on |
17 |
>> a separate interface (eth over usb: usb0 & usb1). |
18 |
>> |
19 |
>> I want to block (DROP or REJECT) the access to certain |
20 |
>> sites (the "noise" which is produced mostly by sites, |
21 |
>> which all exclusively "only want my best": ads, trackers, analysts |
22 |
>> and so on...) |
23 |
>> |
24 |
>> I tried different tools: fwbuilder, which locks up either itsself |
25 |
>> or my rulesset...I had to reboot and Shorewall, which definitely |
26 |
>> is a great tool....a little too great tool and much more capable |
27 |
>> as I am... ;) |
28 |
>> |
29 |
>> I am sure that the problems are mostly not the problems of the |
30 |
>> tools but mine. |
31 |
>> |
32 |
>> Is there any simple straight forward tool to just block accesses |
33 |
>> to certain sites? |
34 |
> |
35 |
> |
36 |
> to do it network-wide: squid |
37 |
|
38 |
+1 |
39 |
and not in transparent mode either -- if you have a proxy server set |
40 |
then https traffic is filtered by domain name as it is part of the proxy |
41 |
connection request. |
42 |
squid + squidGuard / dansguardian is the way forward. |
43 |
for examle, in my "advertisers/tracking" database there are some 12 |
44 |
thousand domains listed. good luck adding those individually to iptables. |
45 |
|
46 |
the only other way to do things super paranoidly is by whitelisting |
47 |
i.e. on the router just keep adding ip and port to whitelist table for |
48 |
those you _want_ |
49 |
iptables -N whitelist |
50 |
iptables -A whitelist -d 8.8.8.8 -m udp --dport 53 -j ACCEPT |
51 |
|
52 |
iptables -A FORWARD -i LAN -o WAN -j whitelist |
53 |
iptables -A FORWARD -J REJECT |
54 |
|
55 |
this takes longer to "start" but is easier to maintain, as facebook for |
56 |
example are constantly buying ip ranges and adding them to their global |
57 |
domination, so you start by thinking you have blocked all 100 facebook |
58 |
ip addresses and then a month or two later discover they have another |
59 |
200 you need to block |
60 |
> |
61 |
> to do it on a per-pc per-browser basis: there's a large variety of |
62 |
> firefox plugins to chose from that will block this and allow that. It |
63 |
> seems to me this is the better approach as you want to stop your browser |
64 |
> chatting with sites who only have your best interest at heart :-) |
65 |
> |
66 |
> |
67 |
> Either way, the list of black and white lists gets very big very quick, |
68 |
> so chose your tool carefully. Try a bunch and pick one that makes sense |
69 |
> to you, bonus points if it comes with a community-supported blacklist |
70 |
> you can drop in, maintained by people whose POV matches your own. |
71 |
> |
72 |
> You don't want a classic firewall for this; firewalls are mostly built |
73 |
> to block based on address and port, this is not how you solve your problem |
74 |
> |