Re: [gentoo-user] Blocking certain sites the easy way ?
On Thursday 28 May 2015 07:44:23 meino.cra...@gmx.de wrote: > Mick [15-05-28 07:44]: > > On Thursday 28 May 2015 06:11:08 meino.cra...@gmx.de wrote: > > > Hi, > > > > > > With wireshark I found, that firefox accesses sites on startup, from > > > which I dont know, for what reason this access is needed or whether > > > the NSA, CIA, FBI, BDN, MOSSAD (fill in what organisation you ever > > > suspect to do such things) has invaded my PC. > > > > It may none of the above, but FF and any addons checking what the latest > > version is of themselves, as well as the Google search on the default > > hope page doing a DNS query or some such. > > > > > I want to block such accesses for two reasons: First is ...hmmm... > > > to block that accesses...second is to find out what will not work > > > than. > > > > > > I dont want to install and configure a complete full blown firewalled > > > SEL-Linux thingy here and I dont want to reboot my Linux box for every > > > new site I added. I am looking for a simple solution, which I can use > > > without studying the history of TCP/IP and others... ;))) > > > > > > What can I use for this purpose? > > > > You could try an application layer filter[1], but I think it won't work > > insofar the connections you observed are probably using ports and > > protocols same as your day to day browsing activity. Therefore you will > > likely need to use iptables to block individual domains or IP addresses > > and then regularly add to the list when the servers your browser wants > > to contact change in that amorphous and reconfiguring cloud out there. > > > > You don't have to reboot your box when you change rules, but you'll need > > to reload iptables. > > > > > > [1] http://l7-filter.sourceforge.net/HOWTO-kernel > > Hi Mick, > > thanks for your help ! :) > > What mechanism is recommended to be used to reinstall/initiate the > iptable rules while booting? Any Gentoo-ish? ;) iptables save any rules in: /var/lib/iptables/rules-save You can edit this and then run '/sbin/iptables-apply -t 90' in case you have something wrong in there and there is a risk of locking yourself out. Or run '/etc/init.d/iptables stop' then change /var/lib/iptables/rules-save to your liking and then '/etc/init.d/iptables start' This is for vanilla iptables (IPv4). There are other scripts available (like arnos-firewall) which have their own configuration files as a front end to iptables. -- Regards, Mick signature.asc Description: This is a digitally signed message part.
Re: [gentoo-user] Blocking certain sites the easy way ?
meino.cra...@gmx.de wrote: > Hi, > > With wireshark I found, that firefox accesses sites on startup, from > which I dont know, for what reason this access is needed or whether > the NSA, CIA, FBI, BDN, MOSSAD (fill in what organisation you ever > suspect to do such things) has invaded my PC. > > I want to block such accesses for two reasons: First is ...hmmm... > to block that accesses...second is to find out what will not work > than. > > I dont want to install and configure a complete full blown firewalled > SEL-Linux thingy here and I dont want to reboot my Linux box for every > new site I added. I am looking for a simple solution, which I can use > without studying the history of TCP/IP and others... ;))) > > What can I use for this purpose? > > Thank you very much in advance for any help! > Best regards, > Meino > > > Maybe net-firewall/ufw is what you are looking for. It has easy to define filter rules and there also exists a graphical frontend for it (net-firewall/ufw-frontends, never tested by myself). -- Regards wabe
Re: [gentoo-user] Blocking certain sites the easy way ?
On Thursday, May 28, 2015 7:11:08 AM meino.cra...@gmx.de wrote: > Hi, > > With wireshark I found, that firefox accesses sites on startup, from > which I dont know, for what reason this access is needed or whether > the NSA, CIA, FBI, BDN, MOSSAD (fill in what organisation you ever > suspect to do such things) has invaded my PC. > > I want to block such accesses for two reasons: First is ...hmmm... > to block that accesses... For an easy way to block sites based on domain name just add them to /etc/hosts and map them to 127.0.0.1. > second is to find out what will not work than. It depends on what it is, mostlikely something you want. It may be firefox downloading the database of blacklisted sites for the "Block reported attack sites" and "Block reported web forgeries" features so those thing will not work properly. It could also be an ad block or some other plugin downloading the ads database. It could be downloading or verifying SSL certificates. It could be the Bookmark sync feature, etc, etc. -- Fernando Rodriguez
Re: [gentoo-user] Blocking certain sites the easy way ?
On Thu, 28 May 2015 06:36:35 +0100, Mick wrote: > It may none of the above, but FF and any addons checking what the > latest version is of themselves, as well as the Google search on the > default hope page doing a DNS query or some such. I thought all Google search pages were based on hope? ;-) SCNR! -- Neil Bothwick Suicide is the most sincere form of self-criticism. pgpO3S4_A57_B.pgp Description: OpenPGP digital signature
Re: [gentoo-user] Blocking certain sites the easy way ?
Mick [15-05-28 07:44]: > On Thursday 28 May 2015 06:11:08 meino.cra...@gmx.de wrote: > > Hi, > > > > With wireshark I found, that firefox accesses sites on startup, from > > which I dont know, for what reason this access is needed or whether > > the NSA, CIA, FBI, BDN, MOSSAD (fill in what organisation you ever > > suspect to do such things) has invaded my PC. > > It may none of the above, but FF and any addons checking what the latest > version is of themselves, as well as the Google search on the default hope > page doing a DNS query or some such. > > > > I want to block such accesses for two reasons: First is ...hmmm... > > to block that accesses...second is to find out what will not work > > than. > > > > I dont want to install and configure a complete full blown firewalled > > SEL-Linux thingy here and I dont want to reboot my Linux box for every > > new site I added. I am looking for a simple solution, which I can use > > without studying the history of TCP/IP and others... ;))) > > > > What can I use for this purpose? > > You could try an application layer filter[1], but I think it won't work > insofar the connections you observed are probably using ports and protocols > same as your day to day browsing activity. Therefore you will likely need to > use iptables to block individual domains or IP addresses and then regularly > add to the list when the servers your browser wants to contact change in that > amorphous and reconfiguring cloud out there. > > You don't have to reboot your box when you change rules, but you'll need to > reload iptables. > > > [1] http://l7-filter.sourceforge.net/HOWTO-kernel > > -- > Regards, > Mick Hi Mick, thanks for your help ! :) What mechanism is recommended to be used to reinstall/initiate the iptable rules while booting? Any Gentoo-ish? ;) Best regard, Meino
Re: [gentoo-user] Blocking certain sites the easy way ?
On Thursday 28 May 2015 06:11:08 meino.cra...@gmx.de wrote: > Hi, > > With wireshark I found, that firefox accesses sites on startup, from > which I dont know, for what reason this access is needed or whether > the NSA, CIA, FBI, BDN, MOSSAD (fill in what organisation you ever > suspect to do such things) has invaded my PC. It may none of the above, but FF and any addons checking what the latest version is of themselves, as well as the Google search on the default hope page doing a DNS query or some such. > I want to block such accesses for two reasons: First is ...hmmm... > to block that accesses...second is to find out what will not work > than. > > I dont want to install and configure a complete full blown firewalled > SEL-Linux thingy here and I dont want to reboot my Linux box for every > new site I added. I am looking for a simple solution, which I can use > without studying the history of TCP/IP and others... ;))) > > What can I use for this purpose? You could try an application layer filter[1], but I think it won't work insofar the connections you observed are probably using ports and protocols same as your day to day browsing activity. Therefore you will likely need to use iptables to block individual domains or IP addresses and then regularly add to the list when the servers your browser wants to contact change in that amorphous and reconfiguring cloud out there. You don't have to reboot your box when you change rules, but you'll need to reload iptables. [1] http://l7-filter.sourceforge.net/HOWTO-kernel -- Regards, Mick signature.asc Description: This is a digitally signed message part.
[gentoo-user] Blocking certain sites the easy way ?
Hi, With wireshark I found, that firefox accesses sites on startup, from which I dont know, for what reason this access is needed or whether the NSA, CIA, FBI, BDN, MOSSAD (fill in what organisation you ever suspect to do such things) has invaded my PC. I want to block such accesses for two reasons: First is ...hmmm... to block that accesses...second is to find out what will not work than. I dont want to install and configure a complete full blown firewalled SEL-Linux thingy here and I dont want to reboot my Linux box for every new site I added. I am looking for a simple solution, which I can use without studying the history of TCP/IP and others... ;))) What can I use for this purpose? Thank you very much in advance for any help! Best regards, Meino
