RE: [despammed] Blocking IRC ....

["Eric Appelboom" <eric () mweb com>]

Use snort with flexresp

RULE-LOCKED:alert tcp $HOME_NET any -> !$SAFE_IRC any (msg:"CHAT IRC
channel join"; flow:to_server,established; content:"JOIN \: \#"; nocase;
offset:0; classtype:misc-activity; sid:1729;  rev:2; resp: rst_all;)
RULE-LOCKED:alert tcp $HOME_NET any -> !$SAFE_IRC any (msg:"CHAT IRC
message"; flow:to_server,established; content:"PRIVMSG "; nocase;
offset:0; classtype:misc-activity; sid:1463;  rev:3; resp: rst_all;)


I defined !$SAFE_IRC as IRC server I don't block.
This also block IRC over nonstandard ports.

Regards
Eric

-----Original Message-----
From: Vishwanath V [mailto:thelinuxguyis () yahoo co in] 
Sent: 14 January 2004 12:47 PM
To: firewall-wizards () honor icsalabs com
Subject: [despammed] [fw-wiz] Blocking IRC ....

Hi guys,
         I just joined the list.
I need some help wrt iptables.
I have a linux gateway machine acting as a IP_masq/firewall.
My policy is a basic deny all.
I wana block  machnies on my LAN from using irc client.

Thanks in advance.
Visu

________________________________________________________________________
Yahoo! India Mobile: Download the latest polyphonic ringtones.
Go to http://in.mobile.yahoo.com
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

----------------------------------------------
Filtered by despammed.com.  Tracer: /headers/TAA027571074475835 Consider
a PayPal donation to help Despammed stay a step or two ahead of the bad
guys.
A new PayPal donation button is now on the home page.  Thanks!


_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards