improve ipfw rules

[Christophe Prevotaux]

AFAIK, 

It is impossible to truely block P2P traffic with any standard
firewalling system. It is the holy grail of ISPs these days.

I know of only one system that can do this effectively and it is
commercial http://www.qosmos.fr , as I have already stated in other
FreeBSD mailing list.

The way they do it , is by implementing a protocol analyser (on the fly 
analysis) that has protocol dictionaries and syntax , which can go up
in the layers and block on the fly any traffic that it has been specified
to block.

It is my hope that someday someone will step in and implement a similar
system under FreeBSD. But i think it requires quite a lot of work and possibly
major rebuilding of ipfw if it needs to be integrated (which would be great)

On Tue, 24 Feb 2004 10:09:24 -0500
Richy Kim <rkim at sandvine.com> wrote:

> >> 3. I'm intrested in blocking kazaa/P2P trafic with IPFW any help in this
> issue
> you could possibly block connections at known p2p ports.
> deny tcp from any to any 6699 step
> but most of the newer protocols use dynamic ports and in turn, are
> configurable. 
> so ipfw isn't exactly ideal on it's own for this.
> 
> -r.
> 

--
===============================================================
Christophe Prevotaux              
===============================================================