Block URLs containing IP addresses.

[sjatkn]

I am new to ISA 2004 and Surfcontrol 5.0 and just discovered a problem with our filtering. If I attempt to view a site which is blocked (based on its FQDN) using it's IP address then I can get past our URL filtering.

 

For example:

http://www.facebook.com/ - blocked by Surfcontrol

http://69.63.176.140/ - not blocked by anything.

 

How do I block URLs which are based on IP addresses instead of FQDNs using ISA or Surfcontrol 5.0?

 

Thanks.

Edited June 2, 2008 by sjatkn
Original URLs not formatted properly.

[TechMonkey]

We went for the brute force method and have set a whole raft of rules such as "***.***.***.***". This isn't on ISA though so there could be a better way. The only thing to be wary of this method is that it catches short URLs, such as BBC - Homepage!

[tom_newton]

Firstly, you might refine your regex so it looks for numbers, if indeed ISA can manage PCRE or something close (i'm thinking ([0-2][1-9]{2}\.){3}[0-2][0-9]{2} or similar, but don't quote me, it's early )

 

Otherwise... get a filter which has a "block all IP address access" mode. As to where you'd find such a thing..

[rrichmond]

 

Otherwise... get a filter which has a "block all IP address access" mode. As to where you'd find such a thing..

 

Not sure this is a good idea. Have you ever had a look though your logs and seen the number of IP address lookup done?

[webman]

We use IPCop, and have a little tickbox that says "Block sites accessed by it's IP address". Which we have ticked

[Friez]

Firstly, you might refine your regex so it looks for numbers, if indeed ISA can manage PCRE or something close (i'm thinking ([0-2][1-9]{2}\.){3}[0-2][0-9]{2} or similar, but don't quote me, it's early )

 

Otherwise... get a filter which has a "block all IP address access" mode. As to where you'd find such a thing..

 

Doesn't quite work for me (because your regex doesn't allow for ip addresses that aren't all triple digits), although ([0-9]{0,3}\.){3}([0-9]{0,3}) does.

 

This will match any IP address, but isn't 100% valid because it can include addresses like 300.562.24.999 which obviously aren't valid

 

Assuming you have a regex engine to filter with of course!

[webman]

There's some nice IP regex stuff here.

[mac_shinobi]

When I was using ISA ( cant remember which version now ) we had 2 block lists

 

One block lists for URL's ie Welcome to Facebook! | Facebook

 

One block lists for I.P Addresses ie 84.15.12.15 ( dummy ip addy btw )

 

that way ISA wouldnt fall over with the URL's and I.P Addys being mixed and it still blocked the I.P Addys.

 

This meant that obviously you would have a cmd window open and use nslookup on the URL's to find what ip addys the URL's were using. ( If that makes sense )

 

Hope that helps.

[toasteroven]

We use a modified Smoothwall at all our sites and use AdvancedProxy. Similar to IPCop, we also "Block IP address"; the same day we had initiated our proxy settings, we were seeing students bypass them by typing in the IPs.

 

Word of caution; if you manage your proxy solution by IP address in a web browser... might not want to include your account / machine when you initiate the "block IPs".

[elsiegee40]

And for those of you using RM for your filtering, this is their response to my email to them today...

 

"We are aware of this issue, we have a database in place that resolves

the host name into an IP address and then applies the filtering. This

database presently is down so the problem does exist (database should

be back on line this week).

 

Thank you for bringing this to our attention

 

Kind regards

John Barstead

RM Filtering Team"

 

To be fair, RM have been pretty reliable. From the sites reported on here, (proxies etc), very few get through the net.

[TechMonkey]

And for those of you using RM for your filtering, this is their response to my email to them today...

 

"We are aware of this issue, we have a database in place that resolves

the host name into an IP address and then applies the filtering. This

database presently is down so the problem does exist (database should

be back on line this week).

 

Thank you for bringing this to our attention

 

Kind regards

John Barstead

RM Filtering Team"

 

To be fair, RM have been pretty reliable. From the sites reported on here, (proxies etc), very few get through the net.

 

Thats interesting as we had to initiate the brute force ban after being told RM hadn't got anything in place and hadn't planned to do anything. Hmm, will have to look into this next week when this is supposedly up again.

[tom_newton]

@Friez - thanks for the fix - a thinko of the worst kind there might go with {1,3} tho - make sure at least a digit is present.

 

@rrichmond - there's 2 options - use reverse lookup *or* ban access by "bare" IP addresses. Each has weaknesses - including the one yu pointed out for rdns, but between the 2 methods you should be able to find a best fit.

[pabs1983]

I have developed a DLL that plugs into IE that blocks IP addresses. I have posted my source code and basic instructions here