| |
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [FW-1] blocking question
- To: [email protected]
- Subject: Re: [FW-1] blocking question
- From: Andrew Loh <[email protected]>
- Date: Sat, 8 Dec 2001 18:22:50 +0800
- Reply-to: Mailing list for discussion of Firewall-1 <[email protected]>
- Sender: Mailing list for discussion of Firewall-1 <[email protected]>
- Thread-index: AcF/fXhYAIDunlpyTOmL1DFgea/0UgAUa54w
- Thread-topic: [FW-1] blocking question
Not really true.
Since cp rule is based on IP address, even you use domain object, the
real action is resolve the domain thru DNS and drop such IP. The
problem comes because most big service providers are big company, those
MSN MSGER, AOL and hotmail sites are round-robinned or load balanced by
different Ips, those Ips are most time in different IP subnets.
Blocking of those services is possible but you need to know the tricks,
and it cannot be done by just one rule.
E.g. hotmail can block by restricring access to passport athentication
site, Yahoo Messenger can block by the whole class C subnet of Yahoo
Messenger's network... Maybe there are other method but it takes time
to figure out.
Andrew.
-----Original Message-----
From: John Tanouye [mailto:[email protected]]
Sent: Saturday, December 08, 2001 7:38 AM
To: [email protected]
Subject: [FW-1] blocking question
I have a question about people trying to block services such as MSN
Messenger, AOL, Morpheus, etc. Aren't these services blocked by default
when using the ANY ANY DROP rule? Everything must be explicity allowed
in order to pass traffic. So, I'm just curious as to why people are
looking for ways to block these programs. Do you allow all outbound
traffic? If so, why?
just curious,
John
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
To set vacation, Out Of Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
If you have any questions on how to change your
subscription options, email Ron Alcatraz at: [email protected]
=================================================
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
To set vacation, Out Of Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
If you have any questions on how to change your
subscription options, email Ron Alcatraz at:
[email protected]
=================================================
|
|
