Community discussions

MUM Europe 2020
 
User avatar
Belyivulk
Member Candidate
Member Candidate
Topic Author
Posts: 285
Joined: Mon Mar 06, 2006 10:53 pm
Location: Whangarei, New Zealand
Contact:

Blocking Web Based Proxys

Thu Aug 02, 2007 7:31 am

Hi All,

I'm wondering if anyone has had any experience with filtering out web based proxy servers, commonly used to get around URL filtering.

Does MT have any function to work with this?

Cheers!
 
User avatar
cholegm
Frequent Visitor
Frequent Visitor
Posts: 56
Joined: Thu Jul 19, 2007 7:43 pm
Location: Gornji Milanovac, Serbia
Contact:

Re: Blocking Web Based Proxys

Thu Aug 02, 2007 9:20 am

Try to drop dst-port=3128,8080
 
User avatar
sergejs
MikroTik Support
MikroTik Support
Posts: 6621
Joined: Thu Mar 31, 2005 3:33 pm
Location: Riga, Latvia
Contact:

Re: Blocking Web Based Proxys

Thu Aug 02, 2007 9:27 am

This will work only in the case, when open proxy are used on these ports.
 
User avatar
Belyivulk
Member Candidate
Member Candidate
Topic Author
Posts: 285
Joined: Mon Mar 06, 2006 10:53 pm
Location: Whangarei, New Zealand
Contact:

Re: Blocking Web Based Proxys

Thu Aug 02, 2007 9:32 am

Not quite what i was looking for :)
 
dada
Member Candidate
Member Candidate
Posts: 245
Joined: Tue Feb 21, 2006 1:44 pm

Re: Blocking Web Based Proxys

Thu Aug 02, 2007 11:40 am

Hi All,

I'm wondering if anyone has had any experience with filtering out web based proxy servers, commonly used to get around URL filtering.

Does MT have any function to work with this?

Cheers!
I think there is no easy way how to do it.
The only way is to analyze the data sent to the remote server. It means recognizing HTTP connections from other ones. The HTTP header sent from client to proxy differs from the one sent to server by the first line. Proxy server has to know what server you want to access so the browser must include full path to the document (GET http://www.server.com/document.htm HTTP/1.1). If browser connects directly to the WWW server the first header line contains only relative path to the document (GET /document.htm HTTP/1.1)....
HTTPS sites has to be treated differently (CONNECT method used through proxies)

I have no idea if you can do such content filtering in MT...

Regards
Dalibor Toman
 
User avatar
janisk
MikroTik Support
MikroTik Support
Posts: 6283
Joined: Tue Feb 14, 2006 9:46 am
Location: Riga, Latvia

Re: Blocking Web Based Proxys

Thu Aug 02, 2007 12:09 pm

you can filter by packet content - but that uses a lot of resources

look up filter in manual
 
User avatar
Belyivulk
Member Candidate
Member Candidate
Topic Author
Posts: 285
Joined: Mon Mar 06, 2006 10:53 pm
Location: Whangarei, New Zealand
Contact:

Re: Blocking Web Based Proxys

Thu Aug 02, 2007 12:48 pm

Thanks guys. So if i understand correctly, i would want to try to filter traffic based on content, in particular looking for the GET method used by proxy's? Proxys are totally new to me.
 
dada
Member Candidate
Member Candidate
Posts: 245
Joined: Tue Feb 21, 2006 1:44 pm

Re: Blocking Web Based Proxys

Thu Aug 02, 2007 12:55 pm

Thanks guys. So if i understand correctly, i would want to try to filter traffic based on content, in particular looking for the GET method used by proxy's? Proxys are totally new to me.
as I wrote - the only differentce is that the 'http://hostname' part is missinf from the request if the browser access the WWW server directly. So you have to be able to recognize GET requests with protocol://hostname part from other ones which has no protocol://hostname definition. Maybe it ould be enough to check for http:// on beginning of the URL definition.

NOTE: the HTTP protocol defines other methods then GET too (POST,HEAD, TRACE,...). But I think you can forget about them in the filtering rules. If GET is blocked it is enough to prevent users to use not allowed proxies.

NOTE2: What if a customer will use SOCKS based proxy to go through your restriction rules ? :-)
 
User avatar
Belyivulk
Member Candidate
Member Candidate
Topic Author
Posts: 285
Joined: Mon Mar 06, 2006 10:53 pm
Location: Whangarei, New Zealand
Contact:

Re: Blocking Web Based Proxys

Thu Aug 02, 2007 1:07 pm

define socks based?

A bit of background. This is for a school, with a Windows based domain, so the computers are locked down quite tight, however the users are getting to 'blocked' sites such as bebo by using web based proxys, hence the questions :)

However, i think there are no other options available to them in this scenario, or are there?

Do you have any examples of the type of rules, or what the syntax may look like to acheive what youve mentioned above?

Cheers
Hayden

Who is online

Users browsing this forum: Bing [Bot] and 146 guests