Date: Tue, 24 Feb 2004 17:07:35 +0100 From: Christophe Prevotaux <c.prevotaux@hexanet.fr> To: Richy Kim <rkim@sandvine.com> Cc: pons@gmx.li Subject: Re: improve ipfw rules Message-ID: <20040224170735.305df436.c.prevotaux@hexanet.fr> In-Reply-To: <FE045D4D9F7AED4CBFF1B3B813C853370397699F@mail.sandvine.com> References: <FE045D4D9F7AED4CBFF1B3B813C853370397699F@mail.sandvine.com>
next in thread | previous in thread | raw e-mail | index | archive | help
AFAIK, It is impossible to truely block P2P traffic with any standard firewalling system. It is the holy grail of ISPs these days. I know of only one system that can do this effectively and it is commercial http://www.qosmos.fr , as I have already stated in other FreeBSD mailing list. The way they do it , is by implementing a protocol analyser (on the fly analysis) that has protocol dictionaries and syntax , which can go up in the layers and block on the fly any traffic that it has been specified to block. It is my hope that someday someone will step in and implement a similar system under FreeBSD. But i think it requires quite a lot of work and possibly major rebuilding of ipfw if it needs to be integrated (which would be great) On Tue, 24 Feb 2004 10:09:24 -0500 Richy Kim <rkim@sandvine.com> wrote: > >> 3. I'm intrested in blocking kazaa/P2P trafic with IPFW any help in this > issue > you could possibly block connections at known p2p ports. > deny tcp from any to any 6699 step > but most of the newer protocols use dynamic ports and in turn, are > configurable. > so ipfw isn't exactly ideal on it's own for this. > > -r. > -- =============================================================== Christophe Prevotaux ===============================================================
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040224170735.305df436.c.prevotaux>