I have configured MikroTik router RB450G for blocking UltraSurf according to your post. Ar first, I have created the address list “UltraSurfServers” as follows in Firewall.
Do you have any idea for blocking this, ZeroByte? I believe that everyone need 1 automatically recognization & add Ultrasurf IP address into address-list
I’ve never even heard of Ultrasurf before. Being lazy, I’m not going to Google about it or how it works or whether they (or anyone else) publish(es) a current list of their IP addresses.
It may be possible to block them using DNS entries if the client software uses DNS to discover the list of addresses. If so, then you can add whatever hostname(s) Ultrasurf uses into an address-list and that list will automatically resolve whatever IP address(es) are used to reach that service, and block those IP addresses. This will be the most effective if the clients are also forced to use the Mikrotik as a DNS proxy, as load balancing / global anycasted DNS / etc might return different IP addresses to client requests than the ones the Mikrotik itself receives… YMMV.
Thank you for your suggestion
It’s same to my mind, as just the way we could prevent youtube, facebook or something related to encryted connection. However, in case of client software Ultrasurf connect directly to pubic server’s IPs which were imported, instead of domain dns, the workaround may be not useful
Anw, I will try dumping packet and monitoring the behavior of client which is installed this tool.
Yeah - if the client comes hard-wired with a list of known addresses to connect to for discovering the current peer list, etc… then the only thing you can do is learn those addresses and make an address-list out of them. Sometimes, the seed is a list of domain names so that the servers can be moved around more easily if they get blocked by IP address. When analyzing the client, look to see if there are any DNS requests which give the IP address that the client connects to first… Otherwise, a list of know IPs is the only solution.
