ipset, a clever and effective way to block indesired hosts

Sun, 13 Oct 2013 16:06:38 +0000

This post is meant to be the sequel of the one I wrote one month ago about CentOS as router, transparent proxy, and much more.
A big chunk of the precedent article is on how configure squid and squidGuard to act as a transparent proxy with URLs filtering capabilities.
But there’s a problem with that: nowadays many sites (f4c3b00k.c0m just to name the most annoying one) are HTTPS.
With HTTP one can really easily intercept a packet and read the payload (which contains the URL) but with HTTPS this is not possible anymore since the payload is encrypted.
The only way to be able to read the payload of an HTTPS packet is doing a man-in-the-middle attack with a fake certificate, but that’s not advisable and you really don’t wanna do it.
If, like in my case, we are not interested in what the users are doing but we just want them to not be able to access some sites/services/whatever ipset (combined with iptables) are the right tools for the job.
iptables is a pretty powerful tool, the only real issue is that it doesn’t scale pretty well if the number of the rules is very big, and this is not a good thing since we probably want to blacklist thousands of IPs.
And here comes ipset: with it it’s possible to manage huge blacklists without iptables slowing down.

Firewall on nagg.eu

ipset, a clever and effective way to block indesired hosts