Re: Gmail and China's GFW

[bk <chort0 () gmail com>]

On Mar 21, 2011, at 4:53 PM, nix () myproxylists com wrote:
> > > Try it, you will get a connection timeout:
> > >
> > > $ curl --connect-timeout 60 https://mail.google.com/
> > > curl: (28) SSL connection timeout
> > >
> > > The same applies for Twitter, Facebook... Much more efficient than
> > > DNS/IP blocking!
> >
> > Thanks for the information. I was not actually aware of that you can block
> > with iptables using hex strings. Very nice.
>
> Forgot to say, in terms of performance. It's better to use -j REJECT
> instead of DROP (then no timeout is caused and the connection is rejected
> with ICMP destination unreachable.

Not if you want it to look like a problem with Google's infrastructure rather than an active block where initiator can 
see the source of the ICMP datagrams.

--
chort

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/