3

I have a freebsd 9.0 router with 250-300Mbit/s traffic, and need to filter small list of pages (http.request.uri).

I do not care about tor, anonymizers, proxy etc. Just prevent direct access from my network to this pages.

How? Only redirect http to squid or any other http-proxy?

I know about tcpdump -ddd and bpf netgraph node. But http is to hard for me.

2
  • 1
    +1 Interesant question. So, you currently have a two interfaced FBSD box, currently with NAT-ed (pf?) routing, (therefore don't want use proxy) and want block http requests to exactly defined URIs at some of your interface?
    – clt60
    Sep 27, 2012 at 15:09
  • Yes, ipfw ngnat and routing. Sep 28, 2012 at 4:26

2 Answers 2

1

If you don't want use proxy (e.g. transparently redirecting all traffic via ipfw rule to proxy - users don't notice anything) - for the solution you need something what is capable to deep packet inspection.

Check the: http://sourceforge.net/projects/ipfw-classifyd/ it should do what you want, "layer7 filtering" with ipfw. (or with pf too)

Or, download pfSense (freebsd based excellent firewall) and check how to use it. According the docs, (http://doc.pfsense.org/index.php/Traffic_Shaping_Guide#Layer_7) it is uses ipfw-classifyd.

Ps: only wondering why do you don't using pf instead of ipfw+ngnat)

2
  • pf can use 1 core. Thanks for ipfw-classifyd going read docs Sep 28, 2012 at 18:12
  • Looks like this projects dead.No any activity last 4 years . Status pre-alpha. Divertd socket. Sep 29, 2012 at 4:51
0

If the list is small, you could just blacklist the IPs in the firewall.

Of course you have to check from time to time, if the pages moved to another site. You could do this with a cron script.

7
  • I cant use ip. Its about big services like youtube. Sep 26, 2012 at 12:30
  • youtube sounds like fun, i noticed for example that the google chrome updater sometimes downloads his updates from a youtube domain
    – arved
    Sep 26, 2012 at 15:09
  • see also stackoverflow.com/questions/9342782/… Messing with DNS is also a solution, if your users are unskilled
    – arved
    Sep 26, 2012 at 15:11
  • yes. dns work for hosts. My problem is that i have list of http url. Sep 27, 2012 at 3:52
  • so if you need to filter on http protocol, setting up a transparent proxy with squid is fairly easy. you can find lots of howtos on the net
    – arved
    Sep 27, 2012 at 12:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .