Block Kazaa

M

MiXdNuTs

Gawd
Joined
Aug 9, 2002
Messages
832
I share Internet with some room mates and one of them won't quit using Kazaa. They are too stoopid to get it when I tell them that I can get in trouble when they share files so they won't quit. I can't just disconnect their connection because they pay a protion of our monthly bills, Internet included. I want to block Kazaa using my D-Link router, and they would be satisfied if only Kazaa was blocked because they are thick and would just write it off as Kazaa being broken as long as the rest of the net works.
I blocked port 1214, but it seems that Kazaa just jumps to port 80 after I do that. Is there anyways, short of building a linux firewall with IPlookup tabes, that I can block kazaa? Are there any ports that I am missing?
Its really starting to piss me off because not only does it slow down the connection, but it also might get me sued or arrested because P2P is more of a risk these days.
 
Your D-Link SOHO router won't do it. Kazaa is a nasty little protocol that will use ANY port available. You need something that can do QoS. I've had much success using a Sonicwall firewall or a Cisco router to block it.
 
I am concidering dropping in a Linux box into my setup.

Currently I have this:
Modem > Router/Firewall > PCs

I am thinking of this:
Modem> Linux Firewall > Router/Firewall > PCs

Would that setup work ok? I dont have much experience using linux firewalls, but are there any apps that would make this easy and would I encounter any problems running two firewalls? I could disable the NAT firewall on my router if I need to.
 
I don't know exactly how Kaazaa's protocol works, so in order to block it you might have to use a module that I don't think is included by default with Netfilter/IPTables. Its a string matching module, and basicly you need to find out how kaazaa's protocol works. It could be as simple as a short ethereal capture while they are doing it. This doesn't have to be done directly at there computer, and even if there is a switch between you and your room mates comp, there are ways around it.
 
MiXdNuTs said:
I am concidering dropping in a Linux box into my setup.

Currently I have this:
Modem > Router/Firewall > PCs

I am thinking of this:
Modem> Linux Firewall > Router/Firewall > PCs

Would that setup work ok? I dont have much experience using linux firewalls, but are there any apps that would make this easy and would I encounter any problems running two firewalls? I could disable the NAT firewall on my router if I need to.
Click to expand...

Those are good but I'm thinking this will solve your problem.

Modem <-- Linux Firewall <-- PCs.

Run Snort on your linux firewall and filter P2P traffic. Snort has a signature that will stop Kazaa P2P traffic.

The Cisco NBAR method isn't that effective. The module Cisco provides to do that is very buggy. I tried that method before and it didn't work too well. The NBAR module started blocking DNS traffic one day then POP3 traffic the next. I solved this by using my Sonicwall's IDS services (which uses an implementation of Snort).
 
I have already maxed my hardware budget so I need to use the Router/Firewall for both its integrated switch and its WiFi G radio. The network is hybrid and has several remaining wired clients, but will eventually transition to completely wireless, except for 1 wired PC possibly in the DMZ. I do have old machines lying around that I could setup as firewalls, so that is why I want to concider that.

Another option would be to drop another nic in the trusted machine that is wired and behind the router's firewall. Are there any QoS functions built into WinXP that could handle blocking of apps or possibly bandwidth throtling? If so then that would be the ideal solution.

It would look like this:
Modem
Router/Firewall
Trusted PC and semitrusted wireless clients
Untrusted wired PC connected to Trusted PC​
 
I would just kick their asses. But maybe you don't know them well enough.
 
I would like to, but that would result in negative living environment. The easiest way is to block the program and then let then just assume that it is one of the 10000 viruses or adware/spyware suites that they have clogging up their computer. I told them how to fix it but they dont seem to care. People like that don't deserve internet, but that cant be done in my situation. Blocking the service is the best nonconfrontational way to solve this problem. I tried to explain to then that my ass is on the line if they share files, but they just looked at me like I was their mom. I'm blocking Kazaa darn it. I'll puta V-Chip in their computer...
 
This can be done with a dedicated Linux Firewall distro like:

IPCop

or

SmoothWall

See blocking Kaazaa is possible using iptables-p2p, but how would you like to block all P2P apps at once :) (Blocks everything else to :()!

The trick is to have a transperant webproxy catching all traffic on port 80 and then only allow the important ports out.
It's a bit more administration but I garantee that Kazaa(or any P2P) won't find a hole, it would take a user with intimately knowledge of your setup to be able to penetrate this setup.

For a dedicated forum try IPCops

I'm no guru - But I have seen this in action and it works :)

Enjoy
 
EinsteiN said:
This can be done with a dedicated Linux Firewall distro like:

IPCop

or

SmoothWall

See blocking Kaazaa is possible using iptables-p2p, but how would you like to block all P2P apps at once :) (Blocks everything else to :()!

The trick is to have a transperant webproxy catching all traffic on port 80 and then only allow the important ports out.
It's a bit more administration but I garantee that Kazaa(or any P2P) won't find a hole, it would take a user with intimately knowledge of your setup to be able to penetrate this setup.

For a dedicated forum try IPCops

I'm no guru - But I have seen this in action and it works :)

Enjoy
Click to expand...

Thank you. I think this is the solution that I will implement. A 6 year old computer running linux and some special software is still superior to any hardare 1U unit that I can slap in a rack. Go linxu!
 
I would put in a linux firewall solution, if anything.
Cause if you think about it, they are paying for a portion of the internet. And your not their mama. You could report them to the RIAA, but then chances are, they are going to end up not paying for internet if they do infact get nailed. I would personally just leave it alone, or if your worried about getting viruses or what not (which is what i would be worried most about), put them on a different subnet when you put up the linux router.
 
You must log in or register to reply here.
Back
Top