Re: Application layer firewall on FreeBSD, is it possible ?

On Aug 30, 2005, at 2:58 PM, Daniel Dvořák wrote:
> let me ask you for task "how to control p2p applications and their  
> traffic
> with dynamic ports from user´s commputers on gateway".
>
> We are small wireless community and have shared access to internet  
> for all
> members. Core members decided to control p2p traffic by default and  
> to allow
> each person in individual way, after showing their knowledge of  
> authorial low. :)
>
> But since many dc hubs, edonkey servers, bittorents web trackers  
> and so on
> use dynamic not standard ports, how to control it ?

Start with a "deny all" policy, and use L7 proxies like squid for the  
specific protocols like HTTP which you want to permit.  If you're  
really serious about controlling the traffic, don't let your router  
talk to anything but your proxy server in order to be certain that  
the client machines have to go through that.

-- 
-Chuck