Filter / firewalling ultrasurf traffic perfectly with Iptables or mikrotik

Ultrasurf is an application that allows users browse anonymously throws transparent proxys. All the traffic is routed encrypted throws SSL(Secure socket layer) by port 443. This well- known protocol is used by thousands of web pages that let you browse secure for e-shopping , bank consulting and things that requires more private communications. Obviously firewalls usually doesn’t block this kind of traffic because this will be a nightmare for the vast majority of users.  In my case this software is used by my students to overpass  the web page restrictions applied by the high School firewall. For example is forbidden use social networks like facebook or tuenti, but with this application (ultrasurf) it can be easy pass over  this restrictions when is installed in pupils computers.

 I have been researching in internet and finally I have found a good way to restrict only the traffic generated by ultrasurf and allow the rest of SSL traffic pass the firewall.

First of all I’ve downloaded wireshark protocol analyzer in a computer with ultrasurf installed.  When I have begun to capture network traffic I’ve realized that ultrasurf has started to generate a lot of  traffic in port 443 (ssl protocol). Looking at the ‘Client Hello’ frame that is used as a hand shake by SSL protocol I’ve realized that all packets sent by wireshark follows the same pattern in all "Client hello" frames the following hex sequence is repeated "16 03 01 00 41 01 00 00 3D 03 01 … ". This traffic is encrypted and I don’t know what hell means but I’ve been comparing traffic with other web pages with SSL enabled and I discovered that ins his "Client Hello" frames they are sending other information. 

 

 With this usefull information in my hands It’s only a matter of fact start to try with firewall rules applied at layer 7 level. 

For example with this iptables rule that filters and capture all traffic that is sent by SSL and with the hex sequence 16030100410100003d0301 inside in is enough to drop only ultrasurf generated network traffic  

iptables -I FORWARD -m tcp -p tcp –dport 443 -m string –to 256 –hex-string   ’|16030100410100003d0301|’ –algo bm -j DROP

If ultrasurf is using another port you can try with this

 iptables -I FORWARD -m tcp -p tcp –tcp-flags SYN,ACK,FIN,RST,PSH ACK,PSH -m string –to 256 –hex-string   ’|16030100410100003d0301|’ –algo bm -j DROP

 And if your firewall is a router OS based one try this:

/ip firewall layer7-protocol
add name=ultrasurf regexp="^\16\03\01\00\41\01\00\00\3D\03\01"
/ip firewall mangle
add chain=prerouting action=add-dst-to-address-list protocol=tcp address-list=ultrasurf \
  address-list-timeout=0s  layer7-protocol=ultrasurf in-interface=lan dst-port=443

Obviously this is not the definitive rule, in newer versions of ultrasurf maybe if this firewall rules become popular this will be changed.

Useful source: http://awarmanf.wordpress.com/

 

88 pensaments a “Filter / firewalling ultrasurf traffic perfectly with Iptables or mikrotik

  1. Retroenllaç: buy dofollow blog posting

  2. Retroenllaç: The iStreamSport.com site is a remarkable go-to site whenever you need to watch an NFL American football game, a MLB baseball game, NBA OR Euroleague basketball games, racing, golfing, or anything in between. This excellent source of live sport streaming

  3. Retroenllaç: http://www.chiefelectrical.net

  4. Retroenllaç: you could try here

  5. Retroenllaç: http://optimumdentist.com

  6. Retroenllaç: www.originalhandymen.com

  7. Retroenllaç: Are there any other important fence etiquette tips?

  8. Retroenllaç: why not find out more

  9. Retroenllaç: basement cleaning

  10. Retroenllaç: What does HVAC stand for?

  11. Retroenllaç: http://rapidfirerestoration.net

  12. Retroenllaç: skin lightening pills

  13. Retroenllaç: social signals checker

  14. Retroenllaç: try this

  15. Retroenllaç: clickfunnels

  16. Retroenllaç: http://www.selectshowers.net

  17. Retroenllaç: Continued

  18. Retroenllaç: Matcha for cooking

  19. Retroenllaç: best matcha green tea powder

  20. Retroenllaç: extrait casier judiciaire

  21. Retroenllaç: drone helicopter

  22. Retroenllaç: premium grade matcha

  23. Retroenllaç: terrazzo floor care

  24. Retroenllaç: matcha tea powder

  25. Retroenllaç: Buy Glutathione Pills OnlineBuy Glutathione PillsGlutathione Pills

  26. It is not really worth paying the extra for 95% tungsten darts, if the pros are winning
    tournaments with 80% darts thats proof enough. If you have a traditional practice, use
    feedback periodically to confirm attention. Also, the batteries used in the electronic cigarette kit can be charged in a car, a wall, or a USB outlet.

    Take a look at my blog; Papierfliegeranleitung.Com

  27. Retroenllaç: ILS

  28. Retroenllaç: ?????????led

  29. Retroenllaç: ac repair new jersey

  30. Retroenllaç: medicare insurance san diego

  31. Retroenllaç: view

  32. Greetings! Somebody in my Facebook group distributed this site with us so I came
    to look it over. I’m definitely enjoying the information. I’m bookmarking and will
    likely be tweeting this to my followers! Excellent blog as well as outstanding design and style.

    My webpage; Maidenhead SEO

  33. Retroenllaç: magnum options review

  34. Retroenllaç: Sell Jewelry NJ

  35. Retroenllaç: iced matcha latte recipe

  36. Retroenllaç: all natural microdermabrasion at home

  37. However, in the end it likely is a scheme to had some freshness to Marvel’s endless relaunches
    of franchise titles with a fresh “#1″ on the cover, which has been a sales
    gimmick the company has shamelessly run into the
    ground over the past seven years. Two ports found on either ends of the canal are Cristobal (on the Caribbean sea) and Balboa (on the Pacific Ocean).
    Jeremy Renner will be on the Marvel panel as well as signing
    autographs and doing photo-ops.

    My blog: http://Www.marvelcontestofchampionshack.xyz

  38. Retroenllaç: Green tea powder

  39. Retroenllaç: Buy matcha Australia

  40. Retroenllaç: jogos friv

  41. Retroenllaç: can you buy propecia in the uk

  42. Retroenllaç: cambridge video, video company cambridge, cambridge film, cambridge video production, cambridge animation, cambridge film production

  43. Bramah manufactures locks for domestic and commercial
    use. Usually a security code is used to open these kinds of locks.
    This is one of the miracles an auto locksmith can perform.

    Here is my page ????

  44. Retroenllaç: buy matcha in australia

  45. Retroenllaç: venus factor cost

  46. Since then, the design of locks has advanced
    and incorporated new materials, such as steel, plastic, and other synthetic materials.
    • Don’t forget to check its compatibility with your building structure and
    the ability of the system to deliver a good sound quality which depends on the structure of your home.
    Make sure you clean your face thoroughly before
    moisturizing.

    Also visit my blog post :: ????? ???????

  47. Write more, thats all I have to say. Literally, it seems as though you relied on the video to
    make your point. You clearly know what youre talking about, why waste your
    intelligence on just posting videos to your blog when you could be
    giving us something informative to read?

  48. hey there and thank you for your info – I have certainly picked up something new from right here.
    I did however expertise several technical issues
    using this site, as I experienced to reload the
    website a lot of times previous to I could get it to load properly.
    I had been wondering if your web hosting is OK? Not that I’m complaining,
    but sluggish loading instances times will very frequently affect your placement
    in google and can damage your quality score if
    ads and marketing with Adwords. Anyway I am adding this RSS
    to my e-mail and can look out for a lot more of your respective interesting content.
    Ensure that you update this again very soon.

  49. %With many families taking advantage of buying food items in bulk when they find them on sale or when they make a trip to their local warehouse club, there is even greater need for extra shelving when they return home to find a place to store those.

    Here is my site … garage storage – http://www.sin78.net -

  50. If you have 50 points in Science, you can hack the terminal next to him and turn him
    back on. Since that sounds like a nice addition to our arsenal, it’s time for a little detective work.
    Surviving and thriving will require not only natural talent,
    but skills honed by education and practice.

    Also visit my blog post: dragon city gems hack

  51. Thanks for one’s marvelous posting! I seriously enjoyed reading it, you can be a great
    author. I will make certain to bookmark your blog and may come back
    in the foreseeable future. I want to encourage yourself
    to continue your great posts, have a nice afternoon!

    Visit my page: Amado

  52. After going over a number of the blog posts on your web site, I honestly like
    your technique of writing a blog. I saved it to my bookmark website list and will be
    checking back in the near future. Please visit my web site as well
    and tell me your opinion.

    Also visit my page – Bernd

  53. %That means that after you finished reading this article you will learn over why they are called floating shelves, some installation tips and how they can make your corner an example to others.

    My homepage: shelving units, Denise,

  54. %I first remember Wayne Rooney from a game at Old Trafford in 2002 when he came on as a late substitute for Everton and, in a brilliant 15-minute performance, skipped past me on a couple of occasions.

    Here is my weblog floating shelves (Marilyn)

  55. %For sale in designs which are open-air as well as fully and partially enclosed, a costco car shelter can be used as an economical approach to provide all weather shelter for your car in your house, in order to bring along for camping trips.

    My weblog … garage Shelf

Deixa un comentari

L'adreça electrònica no es publicarà Els camps necessaris estan marcats amb *

*

17 + 17 =

Podeu fer servir aquestes etiquetes i atributs HTML: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>