RE: [despammed] [fw-wiz] Blocking IRC ....

From: Eric Appelboom (eric_at_mweb.com)
Date: 01/19/04

  • Next message: Melson, Paul: "RE: [fw-wiz] [1/2 OT] Tool to "draw" network topology" 
    To: "Vishwanath V" <thelinuxguyis@yahoo.co.in>, <firewall-wizards@honor.icsalabs.com>
Date: Mon, 19 Jan 2004 10:53:33 +0200

    Use snort with flexresp

    RULE-LOCKED:alert tcp $HOME_NET any -> !$SAFE_IRC any (msg:"CHAT IRC
    channel join"; flow:to_server,established; content:"JOIN \: \#"; nocase;
    offset:0; classtype:misc-activity; sid:1729; rev:2; resp: rst_all;)
    RULE-LOCKED:alert tcp $HOME_NET any -> !$SAFE_IRC any (msg:"CHAT IRC
    message"; flow:to_server,established; content:"PRIVMSG "; nocase;
    offset:0; classtype:misc-activity; sid:1463; rev:3; resp: rst_all;)

    I defined !$SAFE_IRC as IRC server I don't block.
    This also block IRC over nonstandard ports.

    Regards
    Eric

    -----Original Message-----
    From: Vishwanath V [mailto:thelinuxguyis@yahoo.co.in]
    Sent: 14 January 2004 12:47 PM
    To: firewall-wizards@honor.icsalabs.com
    Subject: [despammed] [fw-wiz] Blocking IRC ....

    Hi guys,
             I just joined the list.
    I need some help wrt iptables.
    I have a linux gateway machine acting as a IP_masq/firewall.
    My policy is a basic deny all.
    I wana block machnies on my LAN from using irc client.

    Thanks in advance.
    Visu

    ________________________________________________________________________
    Yahoo! India Mobile: Download the latest polyphonic ringtones.
    Go to http://in.mobile.yahoo.com
    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

    ----------------------------------------------
    Filtered by despammed.com. Tracer: /headers/TAA027571074475835 Consider
    a PayPal donation to help Despammed stay a step or two ahead of the bad
    guys.
    A new PayPal donation button is now on the home page. Thanks!

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Melson, Paul: "RE: [fw-wiz] [1/2 OT] Tool to "draw" network topology"