[gentoo-user] Blocking certain sites the easy way ?

[gentoo-user] Blocking certain sites the easy way ?

[Meino.Cramer]

Hi,

With wireshark I found, that firefox accesses sites on startup, from
which I dont know, for what reason this access is needed or whether
the NSA, CIA, FBI, BDN, MOSSAD (fill in what organisation you ever
suspect to do such things) has invaded my PC.

I want to block such accesses for two reasons: First is ...hmmm...
to block that accesses...second is to find out what will not work
than.

I dont want to install and configure a complete full blown firewalled
SEL-Linux thingy here and I dont want to reboot my Linux box for every
new site I added. I am looking for a simple solution, which I can use
without studying the history of TCP/IP and others... ;)))

What can I use for this purpose?

Thank you very much in advance for any help!
Best regards,
Meino

Re: [gentoo-user] Blocking certain sites the easy way ?

[Mick]

[-- Attachment #1: Type: Text/Plain, Size: 1617 bytes --]

On Thursday 28 May 2015 06:11:08 Meino.Cramer@gmx.de wrote:
> Hi,
> 
> With wireshark I found, that firefox accesses sites on startup, from
> which I dont know, for what reason this access is needed or whether
> the NSA, CIA, FBI, BDN, MOSSAD (fill in what organisation you ever
> suspect to do such things) has invaded my PC.

It may none of the above, but FF and any addons checking what the latest 
version is of themselves, as well as the Google search on the default hope 
page doing a DNS query or some such.


> I want to block such accesses for two reasons: First is ...hmmm...
> to block that accesses...second is to find out what will not work
> than.
> 
> I dont want to install and configure a complete full blown firewalled
> SEL-Linux thingy here and I dont want to reboot my Linux box for every
> new site I added. I am looking for a simple solution, which I can use
> without studying the history of TCP/IP and others... ;)))
> 
> What can I use for this purpose?

You could try an application layer filter[1], but I think it won't work 
insofar the connections you observed are probably using ports and protocols 
same as your day to day browsing activity.  Therefore you will likely need to 
use iptables to block individual domains or IP addresses and then regularly 
add to the list when the servers your browser wants to contact change in that 
amorphous and reconfiguring cloud out there.

You don't have to reboot your box when you change rules, but you'll need to 
reload iptables.


[1] http://l7-filter.sourceforge.net/HOWTO-kernel

-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 473 bytes --]

Re: [gentoo-user] Blocking certain sites the easy way ?

[Meino.Cramer]

Mick <michaelkintzios@gmail.com> [15-05-28 07:44]:
> On Thursday 28 May 2015 06:11:08 Meino.Cramer@gmx.de wrote:
> > Hi,
> > 
> > With wireshark I found, that firefox accesses sites on startup, from
> > which I dont know, for what reason this access is needed or whether
> > the NSA, CIA, FBI, BDN, MOSSAD (fill in what organisation you ever
> > suspect to do such things) has invaded my PC.
> 
> It may none of the above, but FF and any addons checking what the latest 
> version is of themselves, as well as the Google search on the default hope 
> page doing a DNS query or some such.
> 
> 
> > I want to block such accesses for two reasons: First is ...hmmm...
> > to block that accesses...second is to find out what will not work
> > than.
> > 
> > I dont want to install and configure a complete full blown firewalled
> > SEL-Linux thingy here and I dont want to reboot my Linux box for every
> > new site I added. I am looking for a simple solution, which I can use
> > without studying the history of TCP/IP and others... ;)))
> > 
> > What can I use for this purpose?
> 
> You could try an application layer filter[1], but I think it won't work 
> insofar the connections you observed are probably using ports and protocols 
> same as your day to day browsing activity.  Therefore you will likely need to 
> use iptables to block individual domains or IP addresses and then regularly 
> add to the list when the servers your browser wants to contact change in that 
> amorphous and reconfiguring cloud out there.
> 
> You don't have to reboot your box when you change rules, but you'll need to 
> reload iptables.
> 
> 
> [1] http://l7-filter.sourceforge.net/HOWTO-kernel
> 
> -- 
> Regards,
> Mick

Hi Mick,

thanks for your help ! :)

What mechanism is recommended to be used to reinstall/initiate the
iptable rules while booting? Any Gentoo-ish? ;)

Best regard,
Meino

Re: [gentoo-user] Blocking certain sites the easy way ?

[Mick]

[-- Attachment #1: Type: Text/Plain, Size: 2559 bytes --]

On Thursday 28 May 2015 07:44:23 Meino.Cramer@gmx.de wrote:
> Mick <michaelkintzios@gmail.com> [15-05-28 07:44]:
> > On Thursday 28 May 2015 06:11:08 Meino.Cramer@gmx.de wrote:
> > > Hi,
> > > 
> > > With wireshark I found, that firefox accesses sites on startup, from
> > > which I dont know, for what reason this access is needed or whether
> > > the NSA, CIA, FBI, BDN, MOSSAD (fill in what organisation you ever
> > > suspect to do such things) has invaded my PC.
> > 
> > It may none of the above, but FF and any addons checking what the latest
> > version is of themselves, as well as the Google search on the default
> > hope page doing a DNS query or some such.
> > 
> > > I want to block such accesses for two reasons: First is ...hmmm...
> > > to block that accesses...second is to find out what will not work
> > > than.
> > > 
> > > I dont want to install and configure a complete full blown firewalled
> > > SEL-Linux thingy here and I dont want to reboot my Linux box for every
> > > new site I added. I am looking for a simple solution, which I can use
> > > without studying the history of TCP/IP and others... ;)))
> > > 
> > > What can I use for this purpose?
> > 
> > You could try an application layer filter[1], but I think it won't work
> > insofar the connections you observed are probably using ports and
> > protocols same as your day to day browsing activity.  Therefore you will
> > likely need to use iptables to block individual domains or IP addresses
> > and then regularly add to the list when the servers your browser wants
> > to contact change in that amorphous and reconfiguring cloud out there.
> > 
> > You don't have to reboot your box when you change rules, but you'll need
> > to reload iptables.
> > 
> > 
> > [1] http://l7-filter.sourceforge.net/HOWTO-kernel
> 
> Hi Mick,
> 
> thanks for your help ! :)
> 
> What mechanism is recommended to be used to reinstall/initiate the
> iptable rules while booting? Any Gentoo-ish? ;)

iptables save any rules in:  /var/lib/iptables/rules-save

You can edit this and then run '/sbin/iptables-apply -t 90' 

in case you have something wrong in there and there is a risk of locking 
yourself out.

Or run '/etc/init.d/iptables stop' then change /var/lib/iptables/rules-save to 
your liking and then '/etc/init.d/iptables start'


This is for vanilla iptables (IPv4).  There are other scripts available (like 
arnos-firewall) which have their own configuration files as a front end to 
iptables.

-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 473 bytes --]

Re: [gentoo-user] Blocking certain sites the easy way ?

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 394 bytes --]

On Thu, 28 May 2015 06:36:35 +0100, Mick wrote:

> It may none of the above, but FF and any addons checking what the
> latest version is of themselves, as well as the Google search on the
> default hope page doing a DNS query or some such.

I thought all Google search pages were based on hope? ;-)

SCNR!


-- 
Neil Bothwick

Suicide is the most sincere form of self-criticism.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: [gentoo-user] Blocking certain sites the easy way ?

[Fernando Rodriguez]

On Thursday, May 28, 2015 7:11:08 AM Meino.Cramer@gmx.de wrote:
> Hi,
> 
> With wireshark I found, that firefox accesses sites on startup, from
> which I dont know, for what reason this access is needed or whether
> the NSA, CIA, FBI, BDN, MOSSAD (fill in what organisation you ever
> suspect to do such things) has invaded my PC.
> 
> I want to block such accesses for two reasons: First is ...hmmm...
> to block that accesses...

For an easy way to block sites based on domain name just add them to 
/etc/hosts and map them to 127.0.0.1.

> second is to find out what will not work than.

It depends on what it is, mostlikely something you want. It may be firefox 
downloading the database of blacklisted sites for the "Block reported attack 
sites" and "Block reported web forgeries" features so those thing will not 
work properly. It could also be an ad block or some other plugin downloading 
the ads database. It could be downloading or verifying SSL certificates. It 
could be the Bookmark sync feature, etc, etc.


-- 
Fernando Rodriguez

Re: [gentoo-user] Blocking certain sites the easy way ?

[wabenbau]

Meino.Cramer@gmx.de wrote:

> Hi,
> 
> With wireshark I found, that firefox accesses sites on startup, from
> which I dont know, for what reason this access is needed or whether
> the NSA, CIA, FBI, BDN, MOSSAD (fill in what organisation you ever
> suspect to do such things) has invaded my PC.
> 
> I want to block such accesses for two reasons: First is ...hmmm...
> to block that accesses...second is to find out what will not work
> than.
> 
> I dont want to install and configure a complete full blown firewalled
> SEL-Linux thingy here and I dont want to reboot my Linux box for every
> new site I added. I am looking for a simple solution, which I can use
> without studying the history of TCP/IP and others... ;)))
> 
> What can I use for this purpose?
> 
> Thank you very much in advance for any help!
> Best regards,
> Meino
> 
> 
> 

Maybe net-firewall/ufw is what you are looking for. It has easy to define
filter rules and there also exists a graphical frontend for it 
(net-firewall/ufw-frontends, never tested by myself).

--
Regards
wabe