Moblock da konsole è più bello !

Stavo armeggiando con la konsole , quando mi trovo davanti

barabba:/# blockcontrol -h
Usage: blockcontrol OPTION
Options:
        start
        stop
        restart
        reload
        update
        status
        test
        stats
        reset_stats
        show_config
        search

ho cominciato subito a provare i comandi , e devo dire che sono molto più eleganti , pratici e efficaci di mobloquer , ovvero la GUI di moblock .

vi mostrerè l’output di alcuni :

Cominciamo con il fermare moblock

barabba:/# blockcontrol stop
Stopping MoBlock: moblock.

Ora  avviamo il servizio

barabba:/# blockcontrol start
Starting MoBlock: moblock.

riavviamo  moblock

barabba:/# blockcontrol restart
Restarting MoBlock: moblock.

Ricarichiamo la lista dei fitri

barabba:/# blockcontrol reload
Reloading MoBlock: moblock.

Passiamo ora ad aggiornare le nostre liste di IP

barabba:/# blockcontrol update
Updating blocklists and reloading MoBlock: moblock.
The following lists were updated:
 TBG_Educational_Institutions (last modified: 2009-04-24 09:00)
 Bluetack_level2 (last modified: 2009-04-24 09:00)
 Bluetack_level3 (last modified: 2009-04-24 09:00)
For the following lists there was no update available:
 TBG_Primary_Threats (last modified: 2009-04-24 06:00)
 TBG_General_Corporate_Ranges (last modified: 2009-04-24 09:00)
 TBG_Business_ISPs (last modified: 2009-04-24 09:00)
 TBG_Search_Engines (last modified: 2009-04-24 04:30)
 TBG_Hijacked (last modified: 2009-04-24 04:30)
 TBG_Bogon (last modified: 2009-04-24 04:30)
 Bluetack_level1 (last modified: 2009-04-24 06:00)
 Bluetack_edu (last modified: 2009-04-24 06:00)
 Bluetack_ads (last modified: 2009-04-24 04:30)
 Bluetack_bogon (last modified: 2009-04-24 04:30)
 Bluetack_spyware (last modified: 2009-04-24 04:30)
 Bluetack_spider (last modified: 2009-04-24 04:30)
 Bluetack_Microsoft (last modified: 2009-04-24 04:30)
 Bluetack_proxy (last modified: 2009-04-24 04:30)
 Bluetack_hijacked (last modified: 2009-04-24 04:30)
 Bluetack_dshield (last modified: 2009-04-24 04:30)

Il comando che viene adesso è tra i più chiari

barabba:/# blockcontrol status
Current IPv4 iptables rules (this may take a while):

Chain INPUT (policy ACCEPT 181K packets, 254M bytes)
 pkts bytes target     prot opt in     out     source               destination
    3    85 blockcontrol_in  all  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW mark match !0x14

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 blockcontrol_fw  all  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW mark match !0x14

Chain OUTPUT (policy ACCEPT 79559 packets, 6307K bytes)
 pkts bytes target     prot opt in     out     source               destination
  130  8759 blockcontrol_out  all  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW mark match !0x14

Chain blockcontrol_fw (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           mark match 0xa
    0     0 RETURN     all  --  *      *       0.0.0.0/0            208.67.222.222
    0     0 RETURN     all  --  *      *       0.0.0.0/0            208.67.220.220
    0     0 RETURN     all  --  *      *       0.0.0.0/0            81.174.67.134
    0     0 RETURN     all  --  *      *       0.0.0.0/0            87.118.111.215
    0     0 RETURN     all  --  *      *       192.168.1.0/24       192.168.1.0/24
    0     0 NFQUEUE    all  --  *      *       0.0.0.0/0            0.0.0.0/0           NFQUEUE num 92

Chain blockcontrol_in (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           mark match 0xa
    1    29 RETURN     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
    2    56 RETURN     all  --  *      *       192.168.1.0/24       0.0.0.0/0
    0     0 RETURN     all  --  *      *       86.64.162.35         0.0.0.0/0
    0     0 RETURN     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:4672
    0     0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4662
    0     0 NFQUEUE    all  --  *      *       0.0.0.0/0            0.0.0.0/0           NFQUEUE num 92

Chain blockcontrol_out (1 references)
 pkts bytes target     prot opt in     out     source               destination
   21  1542 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           mark match 0xa reject-with icmp-port-unreachable
    0     0 RETURN     all  --  *      *       0.0.0.0/0            208.67.222.222
    0     0 RETURN     all  --  *      *       0.0.0.0/0            208.67.220.220
    0     0 RETURN     all  --  *      *       0.0.0.0/0            81.174.67.134
   11   714 RETURN     all  --  *      *       0.0.0.0/0            87.118.111.215
    1    29 RETURN     all  --  *      lo      0.0.0.0/0            0.0.0.0/0
    3   180 RETURN     all  --  *      *       0.0.0.0/0            192.168.1.0/24
    0     0 RETURN     all  --  *      *       0.0.0.0/0            74.220.215.89
    0     0 RETURN     all  --  *      *       0.0.0.0/0            86.64.162.35
    0     0 RETURN     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:5060
    0     0 RETURN     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:3479
    0     0 RETURN     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:3478
    0     0 RETURN     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:4672
    0     0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:1720
    0     0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4662
    4   240 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:443
    5   300 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80
   85  5754 NFQUEUE    all  --  *      *       0.0.0.0/0            0.0.0.0/0           NFQUEUE num 92

Current IPv6 iptables rules (this may take a while):

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Please check if the above printed iptables rules are correct!

moblock is running.

Mentre il comando test ci fa sentire più sicuri

barabba:/# blockcontrol test
Testing MoBlock:

CAUTION: This is just a simple test to check if MoBlock blocks outgoing
connections. For this, an IP from the blocklist will be pinged. Then the test
checks if this IP appears in the logfile /var/log/moblock.log.

MoBlock marks packets to be blocked. This means you have to make sure that the
marked packets are also blocked later (with appropriate iptables rules). If you
are using the default configuration and MoBlock is started after other firewalls
this will be the case.

This test does not check if you have sane iptables rules or if your complete
blocklist is in the correct format. Therefore success doesn't imply that
everything is working as you expect it.

Also have a look at "blockcontrol status" and test manually with traceroute.

Trying to ping 4.17.157.255 from /var/lib/blockcontrol/guarding.p2p ...
MoBlock marked the IP to be blocked and the IP did not answer..
Test succeeded..

Se vogliamo vedere cosa ha filtrato moblock passiamo il comando seguente

barabba:/# blockcontrol stats
Dumping stats...
----------------------------------------
Sat Apr 25 00:10:50 2009
 MoBlock Stats

   University of Iowa - 3 hits
   Enterprise Customers cablemodem - 3 hits
   CAT Telecom public company Ltd - 3 hits
   University of Michigan - 3 hits
   SURIS/RHnet Iceland University Research Network - 3 hits
   Videotron Telecom Ltee - 3 hits
   Proxad Static DSL - 3 hits
   Level 3 Communications - 1 hits
   TDC Internet Hosting - 2 hits
   UPC Austria GmbH - 2 hits
----------------------------------------

Se vogliamo resettare le stats che non verranno comunque cancellate

barabba:/# blockcontrol reset_stats
Dumping stats to /var/log/MoBlock.stats...
----------------------------------------

Come ultimo vi lascio la mia configurazione

barabba:/# blockcontrol show_config
blockcontrol current settings:
ACCEPT="1"
ACCEPT_MARK="20"
ALLOW_FW=""
ALLOW_IN="/etc/blockcontrol/allow.p2p"
ALLOW_OUT="/etc/blockcontrol/allow.p2p"
BLOCKLIST_FORMAT="p"
BLOCKLISTS_DIR="/var/spool/blockcontrol"
BLOCKLISTS_LIST="/etc/blockcontrol/blocklists.list"
CONTROL_CONF="/etc/blockcontrol/blockcontrol.conf"
CONTROL_LIB="/usr/lib/blockcontrol/blockcontrol.lib"
CONTROL_LOG="/var/log/blockcontrol.log"
CONTROL_NAME="blockcontrol"
CONTROL_SCRIPT="/usr/bin/blockcontrol"
CRON="1"
CRON_MAILTO="root"
DAEMON="/usr/bin/moblock"
DAEMON_LOG="/var/log/moblock.log"
DESC="MoBlock"
E_BADARGS="2"
E_BLOCKLIST="9"
E_CONFIG="6"
E_IPTABLES="8"
E_NETWORK_DOWN="171"
E_NOTROOT="4"
E_XBIN="5"
E_XCD="66"
E_XEXTERNAL="170"
E_XFILE="7"
INIT="1"
IP_REMOVE=""
IPTABLES_ACTIVATION="1"
IPTABLES_CUSTOM_DELETE="/etc/blockcontrol/iptables-custom-remove.sh"
IPTABLES_CUSTOM_INSERT="/etc/blockcontrol/iptables-custom-insert.sh"
IPTABLES_SETTINGS="1"
IPTABLES_TARGET="NFQUEUE"
IPTABLES_TARGET_WHITELISTING="RETURN"
LOG_IPTABLES=""
LOG_SYSLOG="0"
LOG_TIMESTAMP="1"
LSB="/lib/lsb/init-functions"
LSB_MODE="0"
MASTER_BLOCKLIST_DIR="/var/lib/blockcontrol"
MD5SUM_FILE="/var/spool/blockcontrol/MD5SUM"
NAME="moblock"
NFQUEUE_NUMBER="92"
PATH="/usr/bin:/bin:/sbin:/usr/sbin:/usr/local/bin:/usr/local/sbin"
PIDFILE="/var/run/moblock.pid"
REJECT="1"
REJECT_FW="DROP"
REJECT_IN="DROP"
REJECT_MARK="10"
REJECT_OUT="REJECT"
STATFILE="/var/log/MoBlock.stats"
STDIFS=" "
TESTHOST="iblocklist.com"
VERBOSITY="1"
WGET_OPTS="wget -q -t 5 -T 120 -w 5"
WHITE_IP_FORWARD=""
WHITE_IP_IN=""
WHITE_IP_OUT=""
WHITE_LOCAL="1"
WHITE_TCP_FORWARD=""
WHITE_TCP_IN="4662"
WHITE_TCP_OUT="http https 4662 1720"
WHITE_UDP_FORWARD=""
WHITE_UDP_IN="4672"
WHITE_UDP_OUT="4672 3478 3479 5060"

The following blocklists are configured to be used:
http://list.iblocklist.com/?list=ijfqtofzixtwayqovmxn
http://list.iblocklist.com/?list=ecqbsykllnadihkdirsh
http://list.iblocklist.com/?list=jcjfaxgyyshvdbceroxf
http://list.iblocklist.com/?list=lljggjrpmefcwqknpalp
http://list.iblocklist.com/?list=pfefqteoxlfzopecdtyw
http://list.iblocklist.com/?list=tbnuqfclfkemqivekikv
http://list.iblocklist.com/?list=ewqglwibdgjttwttrinl
http://list.iblocklist.com/?list=bt_level1
http://list.iblocklist.com/?list=bt_level2
http://list.iblocklist.com/?list=bt_level3
http://list.iblocklist.com/?list=bt_edu
http://list.iblocklist.com/?list=bt_ads
http://list.iblocklist.com/?list=bt_bogon
http://list.iblocklist.com/?list=bt_spyware
http://list.iblocklist.com/?list=bt_spider
http://list.iblocklist.com/?list=bt_microsoft
http://list.iblocklist.com/?list=bt_proxy
http://list.iblocklist.com/?list=bt_hijacked
http://list.iblocklist.com/?list=bt_dshield

Se avete capito tutto ora siete pronto per questo

2matti

ciao

Lascia un commento

Il tuo indirizzo email non sarà pubblicato. I campi obbligatori sono contrassegnati *

*