Guys I have multiple servers with OpenVPN installed on them and they are all getting suspended left and right due to abuse reports from PlayStation network . Now , I'm assuming that my VPN clients are trying to crack PlayStation accounts , right ? What I'm trying to do is to block VPN traffic to all PlayStation URLs . The problem is that there is no specific IPs to block ! They use GeoDNS which serves data from different IPs based on user's location . What can I do here ? Is there a full list of PlayStation IPs to block ? Or can I block access to these URLs ?

  • I am pretty sure that they are behind a CDN (Akamai if I remember correctly). – Orphans Feb 25 at 9:28
  • we can't block all akamai IPs :D I really don't know how to go with this . – master lfc6 Feb 25 at 9:45

A third party Linux kernel module xt_tls provides the capability to match the hostname in a TLS Server Name Indication field, thus you can interrupt https connections to specific hostnames.

For example:

iptables -I FORWARD -p tcp --dport 443 -m tls --tls-host "auth.api.sonyentertainmentnetwork.com" -j REJECT --reject-with tcp-reset
ip6tables -I FORWARD -p tcp --dport 443 -m tls --tls-host "auth.api.sonyentertainmentnetwork.com" -j REJECT --reject-with tcp-reset

See the module's documentation if you need to block a large list of hosts.

Note that Encrypted SNI will eventually become widespread and this will no longer work.

You could also match on DNS traffic that passes through and block that. Eventually DNSSEC or some alternative will become widespread and that will no longer work either.

Note also that you should dump such customers as soon as you discover them. Also choose service providers that will work with you with respect to abuse complaints rather than just dropping you instantly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.