Untangle Forums - View Single Post - How To: Block sites accessed by IP Address

Silver Bullet · 03-01-2008, 06:29 PM

I have seen a couple forum topics asking about blocking sites that are accessed by it's IP address to get around the Web Filter. Well, here is how this is done using the Protocol Control module.

Click Show Settings on the Protocol Control Module.

Select the Protocol List tab

Click the green + sign to create a new rule.

You should have a new line appear green in the rules list.

In the Category cell, enter Block Access by IP

In the Protocol Cell, enter Access by IP

Check the Block and check the Log cells

In the Description Cell, enter Block requests made with IP address

In the Signature Cell, enter

Code:

(GET|POST|HEAD) [^ ]+ HTTP.*host: \b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b

Click Save

Now try to access a site by it's IP address. You should get a blank page and an Event should show up as blocked in the Protocol Control module's Event Log.

I have tested this and it seems to work fine. What that signature does is checks the "host" field in the request and if it contains an IP address in an http request, then it blocks it.

Have Fun enforcing the Web Filter!!

Thanks Seb for helping me fine tune it.

03-01-2008, 06:29 PM	#1 (permalink)
Silver Bullet Join Date: Sep 2007 URLs submitted: 3 Posts: 2,008	How To: Block sites accessed by IP Address I have seen a couple forum topics asking about blocking sites that are accessed by it's IP address to get around the Web Filter. Well, here is how this is done using the Protocol Control module. Click Show Settings on the Protocol Control Module. Select the Protocol List tab Click the green + sign to create a new rule. You should have a new line appear green in the rules list. In the Category cell, enter Block Access by IP In the Protocol Cell, enter Access by IP Check the Block and check the Log cells In the Description Cell, enter Block requests made with IP address In the Signature Cell, enter Code: (GET\|POST\|HEAD) [^ ]+ HTTP.host: \b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b Click Save Now try to access a site by it's IP address. You should get a blank page and an Event should show up as blocked in the Protocol Control module's Event Log. I have tested this and it seems to work fine. What that signature does is checks the "host" field in the request and if it contains an IP address in an http request, then it blocks it. Have Fun enforcing the Web Filter!! Thanks Seb for helping me fine tune it. Last edited by Silver Bullet; 03-01-2008 at 08:54 PM.. Reason: Edited rule*