Proxy Bypass Websites

[ticker]

I don’t know if any one else is having this problem, but having banned a lot of websites at both a local and county level. The students are using proxy bypass websites to get around ours and county’s proxy servers as well as the firewalls.

Has any one been able to stop them doing this with out having to block ever single websites that does this? We are using Windows Server 2003, with ISA 2004.[align=justify]

[Geoff]

You need a filter that blocks via keywords rather than simple blacklists. I'd done that sucessfully with Dansguardian and Squid running on a Linux box. I'm sure others can suggest a windows approach though.

[W32Jbot]

MKKidguard blocks all CGI-proxies for us here, you could contact the nice guys at the Open University - MK Schools.net project to find out how its done. (kidguard is their development and free to all who are provided broadband by them).

 

Before Kidguard we used to block CGI-proxies individually at our ISA server, crude but it worked nonetheless.

[indiegirl]

Hello hello... another MK-er. Hi Jason!

 

MK Schools have only started blocking those proxies recently, after we complained to them that they weren't being blocked!!

 

ticker - we use ISA 2004, and we haven't found the best way around this yet either - like Jason above, we blocked each site individually (why oh why can't ISA block with *? At least then we could block *proxy*).

 

Unless your internet provider can block by keyword, the only way around it (as it is for us) is to put in some sort of keyword filtering mechanism, a la Dansguardian...

[Gatt]

Our LEA has denied access to sites via IP - bit of a bugger at times but does help

 

We are getting ready to switch to denied to all except a whitelist of sites that we specify.

[TechMonkey]

We block *proxy* which catches most but we also found a string that was in a lot of the URL's to proxies, something like 10110A. Filtered this and has caught a whole more. I'll dig through our lists and see if I can find it.

[Benji1]

Our LEA uses RM Safetynet and this blocks alot and then we purchased surfcontrol to allow us to filter even more and surfcontrol includes a filter for proxies this seems to stop them !

[ticker]

Cheers guy's, will have a bash at it, have already been looking at buying surfcontrol to give us more control and filtering locally rather than using the county councils.

[NetworkGeezer]

We block *proxy* which catches most but we also found a string that was in a lot of the URL's to proxies, something like 10110A. Filtered this and has caught a whole more. I'll dig through our lists and see if I can find it.

 

Come on techmonkey don'y keep us in suspense.

 

Does your method work for translator sites like Babel Fish which is another vector the kids use.

[NetworkGeezer]

Come on techmonkey don'y keep us in suspense.

 

(Typo or bad attempt at a Scottish accent. You decide)

[Gatt]

Come on techmonkey don'y keep us in suspense.

 

(Typo or bad attempt at a Scottish accent. You decide)

 

Both we spell it Dinnae

[TechMonkey]

Sorry, forgot about this. URL part is 010110A. Do a google search on it and you will find a hundred and one different prokies or links to proxies. It is from a CGI-Proxy so will only stop that one, but it seems to be a very prevelant one. Doesn't do the translator sites though I'm afraid, though we have filtered most of these as well.

We have also filtered */http/* to stop a lot of proxies this way. It does catch a few legitimate redirection scripts though so this may be one you don't want to do.

[Geoff]

It's simpler to just whitelist the odd site that is blocked accidently by that rule.

[TechMonkey]

Yep, that's what we currently do. It's just annoying when it pops up on a site that you don't usually use, or keep forgetting to add it (ala The Register RSS feed!) Can also confuse teachers when they have a a nice site that suddenly throws up a filter just because they tried going to a different section or to an external link that looked safe. BUt is fun going into tell them that they're filter was logged, just to see their faces