Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm from Republic of Moldova and during recent events in april our government restricted access to some websites that presented news from other point than the official one, also it was restricted access to facebook and over social networks.

I'm wondering how it is done.

NOTE: The restriction could be overcomed by using Firefox plugin Tor.

share|improve this question
add comment

5 Answers

up vote 3 down vote accepted

There are numerous ways to block undesirable traffic.

  • Identify all the connections to the outside world
  • Instruct the owners of those connections to:
    • Block certain websites based on their IP (ie, don't route packets addressed to certain IPs on a block list)
    • Block DNS results based on wildcards (so *news* might block all DNS requests that have "news" anywhere in their name)
    • Use a packet inspector to monitor HTTP and other traffic for keywords, and send a TCP disconnect packet if certain triggers on the content are seen.
    • Block non port 80 and 25 traffic

Note that the gov't can't control all the ISPs (those with satellite phone data plans are ok since the company doesn't have an office in the country they can put pressure on).

Further, some tactics can't be used due to the burden - the packet inspector, running on even a relatively slow 10gbps trunk line requires a ton of processing power and speed to keep up with traffic. Compromises must be made.

On the other hand, 99% of the people in the country are going to be stymied by a simple DNS blocking scheme. Those that can get past that easily will also be able to get around most of the other block anyway.

The goal of such a program isn't to prevent anyone from having access, it's to capture the greatest portion of the public and make sure they are getting your message and only your message.

In political battles that's usually sufficient.

-Adam

share|improve this answer
    
Thanks Adam for comprehensive answer. –  Jenea Aug 18 '09 at 20:25
add comment

The easist way for them to block sites, is to redirect the DNS record.

The easy way to check this, would be to use a DNS server from another country, or set up your own dns that hasnt blocked the sites. (in other words, does the entire check from root dns for every new site you try to access.

share|improve this answer
add comment

At a guess, making sure there were blackhole routes in place on most (all?) ISPs' connection to "outside of Moldova". This would tie in nicely with "works to bypass via TOR" (as the packet destined for the server IP would be encapsulated until quite probably outside of Moldova).

As far as I understand TOR, name resolution still happens as per normal on the client machine, so any DNS intercept would still have caused a block. The blackhole route option is also good from a network performance perspective, as it doesn't require any extra work to be done for either "blocked" or "unblocked" packets, it's still just normal routing packet forwarding.

share|improve this answer
add comment

Well ... Probably done by some kind of firewall technology, that would have to be running at the country's all ISP:s, to inspect and block traffic to selected external sites.

And, not to give them any ideas, but ... According to the wiki page on Tor, it should be possible to block that too, for an entity like a government. At least it's possible for the US government.

share|improve this answer
add comment

If you can gain ssh access to server outside of the country (any sort of shared hosting solution such as dreamhost can provide this for maybe 10 bucks a month) you can then tunnel your traffic through this server using ssh. If you tunnel both the web and DNS traffic through ssh you should be able to browse anything. I wrote how to do this in my blog here, it says how to do this with Firefox (I hope the plug is okay, if not let me know and I will edit my post).

share|improve this answer
    
The plug is ok, but keep in mind that your answer doesn't address the question of how the gov't might block people, it only discusses ways to get around that... –  Adam Davis May 20 '09 at 12:47
    
Adam: Good point, I should have read the question a little more carefully. –  Kyle Brandt May 20 '09 at 12:55
    
It's still good information. If your answer was directly related to the question I would have suggested quoting the most useful parts in the answer itself, and pointing to the article for further explanation and information. –  Adam Davis May 20 '09 at 12:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.