Blocking specific network applications with iptables
Many organizations face
a productivity problem with employees who abuse chat programs like MSN
Messenger. Some IT departments are instructed to block this kind of
traffic for users who either abuse or simply don’t require the
software. You can block applications like MSN Messenger in your proxy
server, but some clients may still have access to the applications,
because there are many versions of MSN Messenger in use, making
blocking the application with a proxy server difficult. Instead, block
MSN Messenger traffic more easily with iptables.
Each
version of Messenger sends network packets with unique headings, so in
Squid, for example, you must use a url_regex-based access control list
to scan a packet going through a Linux box looking for a string that
allows the MSN Messenger connection, such as gateway.dll or
application/x-msn-messenger, and instruct the proxy to deny those kinds
of packets.
Leave a Reply