Application layer firewall on FreeBSD, is it possible ?
cswiger at mac.com
Tue Aug 30 19:50:52 GMT 2005
On Aug 30, 2005, at 2:58 PM, Daniel Dvořák wrote:
> let me ask you for task "how to control p2p applications and their
> with dynamic ports from user´s commputers on gateway".
> We are small wireless community and have shared access to internet
> for all
> members. Core members decided to control p2p traffic by default and
> to allow
> each person in individual way, after showing their knowledge of
> authorial low. :)
> But since many dc hubs, edonkey servers, bittorents web trackers
> and so on
> use dynamic not standard ports, how to control it ?
Start with a "deny all" policy, and use L7 proxies like squid for the
specific protocols like HTTP which you want to permit. If you're
really serious about controlling the traffic, don't let your router
talk to anything but your proxy server in order to be certain that
the client machines have to go through that.
More information about the freebsd-current