Re: [gentoo-user] IPTABLES syntax change?

[Michael Mol <mikemol@gmail.com>]

On Fri, Jan 4, 2013 at 3:17 PM, Walter Dnes <waltdnes@waltdnes.org> wrote:
> On Wed, Jan 02, 2013 at 11:32:58PM -0500, Michael Orlitzky wrote
>> On 12/30/2012 10:21 PM, Walter Dnes wrote:
>> > [0:0] -A FECESBOOK -j LOG --log-prefix "FECESBOOK:" --log-level 6
>> > [0:0] -A FECESBOOK -j DROP
>> > [0:0] -A INPUT -s 192.168.123.248/29 -i eth0 -j ACCEPT
>> > [0:0] -A INPUT -s 169.254.0.0/16 -i eth0 -j ACCEPT
>> > [0:0] -A INPUT -i lo -j ACCEPT
>> > [0:0] -A INPUT -m conntrack --ctstate INVALID,NEW -j UNSOLICITED
>>
>> In fact, since you're blocking all outgoing packets to facebook, the
>> only state that a packet from facebook can have here is INVALID or NEW.
>> So traffic from facebook will be sent to the UNSOLICITED chain and DROPped.
>>
>>
>> > [0:0] -A INPUT -s 69.63.176.0/20 -j FECESBOOK
>> > [0:0] -A INPUT -s 69.220.144.0/20 -j FECESBOOK
>> > [0:0] -A INPUT -s 69.63.176.0/20 -j FECESBOOK
>> > [0:0] -A INPUT -s 69.171.224.0/19 -j FECESBOOK
>> > [0:0] -A INPUT -s 200.58.112.0/20 -j FECESBOOK
>> > [0:0] -A INPUT -s 213.155.64.0/19 -j FECESBOOK
>>
>> ...making these pointless =)
>
>
>   I've run into at least one newspaper website (I forget which,
> it's occasionally used for links on Slashdot) which ends up trying to
> redirect me to a Facebook site even though the URL does not mention
> Facebook at all.  There is other integration as well.  See the first
> post in
> http://www.dslreports.com/forum/r26618459-Increasing-integration-of-facebook-into-many-web-sites
> I believe this may have been straightened out since then, but 13 months
> ago that post was correct.  And then there's the "LIKE" button which
> shows up all over the web.
>
>   The mere fact that you haven't manually typed in...
> http://www.facebook.com/blah_blah_blah does not mean you're not
> connecting to it.

But all that's above layer 3, since it's an HTTP redirect, or a page
transclusion which necessitates a new GET request. Michael's point
stands.

--
:wq