[7.910][BUG][SUSPENDED] LBB to drastic!!!

Hi, the Location Based blocking is too drastic!!!
It's a great feature but it really needs to be redefined. For example, I want to block all HTTP(S) and SSH traffic for particular countries of the world BUT I want them self to access them!
So I want to block traffic for example china (no offense) but I'm going on vacation to China (just an example) so I like to visit some websites in China.

The it is now setup, I have too make a choice; block the attackers or visit websites....

0 Astaro Beta Bot over 15 years ago

Astaro Beta Report
--------------------------------
Version: 7.910
Type: BUG
State: RESOLVED/SUSPENDED
Reporter: fobe++
Contributor: r2k, BrucekConvergent, Billybob
MantisID: 13646
Target version: 
Fixed in version: 
--------------------------------

0 r2k over 15 years ago

Yes please!

Same here: Block SMTP from China (same as above) but allow Webbrowsing to China and Webvisitors to my Webpage from China.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 kbr over 15 years ago

Slightly off-topic, but China is no longer on the list of the top 10 spam sending/relaying countries.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 r2k over 15 years ago in reply to kbr

Slightly off-topic, but China is no longer on the list of the top 10 spam sending/relaying countries.

OT: but if we block all traffic to or from the us, we will get enormous problems [;)]
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 15 years ago in reply to r2k

I agree; we should be able to set this to allow inbound OR outbound access restrictions... exception addition capability should also be added; otherwise the feature won't find much use with my customers that have asked for this feature.

Also, as an aside: Will netblocks blocked using this feature not trigger teh portscanner? The current behaviour in 7.504 is, even if the source of the portscan (the IP or netblock) is set to DROP on all services, all interfaces, and even if I define a "blackhole" DNAT route, the portscan detector keeps firing... this needs to be fixed badly if this isn't changed in 8.x.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 kbr over 15 years ago in reply to BrucekConvergent

Also, as an aside: ... portscan detector keeps firing... this needs to be fixed badly if this isn't changed in 8.x.

If you are really serious about this, you shouldn't post it as a side note within this thread, as i can only track one issue per thread. Instead, you should start a new thread with this topic.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Billybob over 15 years ago

Hi, the Location Based blocking is too drastic!!!
The it is now setup, I have too make a choice; block the attackers or visit websites....

I don't think it should be too hard to make it work for all/incoming only/ougoing only but I am not the programmer [:D]
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Billybob over 15 years ago in reply to kbr

Slightly off-topic, but China is no longer on the list of the top 10 spam sending/relaying countries.

[[:D]] I knew we were still number one on some things[[:D]] I guess I am going to block all communications from them.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel