Hari ini salah satu pabrik kita yang di Thailand mendadak kasih PR. Beberapa client disana pake software UltraSurf yang mereka dapet dari email temen-temenya. Setelah itu pada bisa browsing dengan bebas. Dan gak tercatat di proxy server.
Dari googling, ktemu deh software UltraSurf-nya di site UltraReach.Ternyata software mungil for Windows. Emang pabrik yang satu ini mau migrasi juga. Tapi tetep aja problem ini harus di beresin.
Dari gue coba, Ultrasuft emang kecil banget. Cuman 138KB dan langsung running sebagai proxy server di localhost port 9666. Hebatnya stelah berhasil jalan, di langsung buka IE yang dah menggunakan proxy servernya dia. Tentu ini mudah banget kan bagi client. Karena gak ada proses install sama skali :-D
Dari log squid, ktemu hasilnya seperti ini:
1207549596.504 220101 192.168.10.17 TCP_MISS/200 1109 CONNECT 64.62.138.13:443 - DIRECT/64.62.138.13 -
1207549619.202 259 192.168.10.17 TCP_MISS/503 0 CONNECT secure.gohosting.com.au:443 - DIRECT/203.220.45.66 -
1207549619.387 448 192.168.10.17 TCP_MISS/200 39 CONNECT www.webassign.net:443 - DIRECT/128.109.135.22 -
1207549619.410 469 192.168.10.17 TCP_MISS/200 39 CONNECT sf1.strengthsfinder.com:443 - DIRECT/63.113.14.162 -
1207549619.749 807 192.168.10.17 TCP_MISS/200 39 CONNECT reg.netpas.cn:443 - DIRECT/60.28.193.69 -
1207549619.793 848 192.168.10.17 TCP_MISS/200 39 CONNECT www.amazon.com:443 - DIRECT/72.21.206.5 -
1207549619.806 852 192.168.10.17 TCP_MISS/503 0 CONNECT signin.ebay.com.cn:443 - DIRECT/66.135.209.238 -
1207549619.869 928 192.168.10.17 TCP_MISS/200 39 CONNECT member.hmsa.com:443 - DIRECT/64.128.4.7 -
1207549620.138 928 192.168.10.17 TCP_MISS/200 287 CONNECT 61.59.225.183:443 - DIRECT/61.59.225.183 -
1207549620.278 1062 192.168.10.17 TCP_MISS/200 287 CONNECT 66.51.207.186:443 - DIRECT/66.51.207.186 -
1207549620.774 1825 192.168.10.17 TCP_MISS/200 39 CONNECT www.statenb.com:443 - DIRECT/65.67.224.153 -
1207549620.854 1610 192.168.10.17 TCP_MISS/200 287 CONNECT 72.25.66.189:443 - DIRECT/72.25.66.189 -
1207549621.147 1901 192.168.10.17 TCP_MISS/200 287 CONNECT 72.25.123.42:443 - DIRECT/72.25.123.42 -
1207549622.064 2814 192.168.10.17 TCP_MISS/200 287 CONNECT 61.225.217.146:443 - DIRECT/61.225.217.146 -
1207549622.285 3037 192.168.10.17 TCP_MISS/200 287 CONNECT 122.127.83.243:443 - DIRECT/122.127.83.243 -
1207549622.349 3402 192.168.10.17 TCP_MISS/200 39 CONNECT grants.hrsa.gov:443 - DIRECT/162.99.248.247 -
1207549622.355 3402 192.168.10.17 TCP_MISS/200 39 CONNECT grants.hrsa.gov:443 - DIRECT/162.99.248.247 -
1207549622.356 3410 192.168.10.17 TCP_MISS/200 39 CONNECT www.hosei.org:443 - DIRECT/125.206.112.191 -
1207549622.398 3447 192.168.10.17 TCP_MISS/200 39 CONNECT secure.madriverweb.com:443 - DIRECT/12.152.254.60 -
1207549622.908 481 192.168.10.17 TCP_MISS/200 287 CONNECT 64.62.138.13:443 - DIRECT/64.62.138.13 -
1207549622.915 482 192.168.10.17 TCP_MISS/200 287 CONNECT 64.62.138.10:443 - DIRECT/64.62.138.10 -
1207549623.087 538 192.168.10.17 TCP_MISS/200 287 CONNECT 125.173.32.157:443 - DIRECT/125.173.32.157 -
1207549623.101 587 192.168.10.17 TCP_MISS/200 287 CONNECT 59.104.191.209:443 - DIRECT/59.104.191.209 -
1207549623.119 599 192.168.10.17 TCP_MISS/200 287 CONNECT 72.25.66.20:443 - DIRECT/72.25.66.20 -
1207549625.036 2486 192.168.10.17 TCP_MISS/200 287 CONNECT 218.162.175.153:443 - DIRECT/218.162.175.153 -
1207549628.568 8415 192.168.10.17 TCP_MISS/200 1397 CONNECT 61.59.225.183:443 - DIRECT/61.59.225.183 -
1207549662.268 156 192.168.10.17 TCP_MISS/200 39 CONNECT ebank.eonbank.com.my:443 - DIRECT/203.115.239.38 -
1207549662.480 368 192.168.10.17 TCP_MISS/200 39 CONNECT support.apple.com:443 - DIRECT/17.254.2.9 -
1207549662.580 463 192.168.10.17 TCP_MISS/200 39 CONNECT dlenote.ed.gov:443 - DIRECT/160.109.122.224 -
1207549662.600 501 192.168.10.17 TCP_MISS/200 287 CONNECT 64.62.138.13:443 - DIRECT/64.62.138.13 -
1207549662.644 542 192.168.10.17 TCP_MISS/200 39 CONNECT www.aetna.com:443 - DIRECT/206.213.211.171 -
1207549662.645 541 192.168.10.17 TCP_MISS/200 39 CONNECT www.aetna.com:443 - DIRECT/206.213.211.171 -
1207549662.652 554 192.168.10.17 TCP_MISS/200 39 CONNECT collab.sakaiproject.org:443 - DIRECT/194.35.219.182 -
1207549662.668 568 192.168.10.17 TCP_MISS/200 39 CONNECT www.ana.co.jp:443 - DIRECT/64.215.167.82 -
1207549662.771 651 192.168.10.17 TCP_MISS/200 39 CONNECT www.2checkout.com:443 - DIRECT/64.128.185.215 -
1207549662.771 655 192.168.10.17 TCP_MISS/200 39 CONNECT www.navycollege.navy.mil:443 - DIRECT/206.37.214.18 -
1207549662.778 660 192.168.10.17 TCP_MISS/200 39 CONNECT docline.gov:443 - DIRECT/165.112.6.76 -
1207549662.779 655 192.168.10.17 TCP_MISS/200 39 CONNECT www.virusbtn.com:443 - DIRECT/194.203.134.163 -
1207549662.780 657 192.168.10.17 TCP_MISS/200 39 CONNECT uk.etrade.com:443 - DIRECT/12.153.224.57 -
1207549662.817 522 192.168.10.17 TCP_MISS/200 287 CONNECT 66.51.207.186:443 - DIRECT/66.51.207.186 -
1207549662.832 538 192.168.10.17 TCP_MISS/200 287 CONNECT 61.59.225.183:443 - DIRECT/61.59.225.183 -
1207549662.832 33880 192.168.10.17 TCP_MISS/200 9456 CONNECT 64.62.138.13:443 - DIRECT/64.62.138.13 -
1207549662.943 644 192.168.10.17 TCP_MISS/200 287 CONNECT 72.25.66.189:443 - DIRECT/72.25.66.189 -
1207549664.714 2418 192.168.10.17 TCP_MISS/200 141 CONNECT 72.25.123.42:443 - DIRECT/72.25.123.42 -
1207549664.762 1712 192.168.10.17 TCP_MISS/200 512 CONNECT 64.62.138.13:443 - DIRECT/64.62.138.13 -
1207549664.762 2463 192.168.10.17 TCP_MISS/200 287 CONNECT 122.127.83.243:443 - DIRECT/122.127.83.243 -
1207549664.762 2460 192.168.10.17 TCP_MISS/200 287 CONNECT 61.225.217.146:443 - DIRECT/61.225.217.146 -
1207549730.403 349 192.168.10.17 TCP_MISS/200 39 CONNECT eupdate.dnb.com:443 - DIRECT/159.137.146.39 -
1207549730.535 503 192.168.10.17 TCP_MISS/200 39 CONNECT www.imeem.com:443 - DIRECT/208.72.33.133 -
1207549730.754 723 192.168.10.17 TCP_MISS/200 39 CONNECT my.avantgo.com:443 - DIRECT/64.157.224.8 -
Sepertinya software ini cara kerjanya mirip sama Skype. Tapi dia mencari web server yang ada ke tidak beresan fasilitas proxynya. Seperti Apache yang menggunakan mod_proxy gitu deh. Makanya dia brusaha kontak ke HTTPS smuanya. Tapi rata2 reverce ip nya gak bisa diresolve.
Cara pengeblokannya simple aja. Gak beda dengan cara pengeblokan Skype. Taruh saja 3 baris ini di /etc/squid.conf:
# bloking UltraSurf/Skype
acl numeric_IPs url_regex ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+
http_access deny CONNECT numeric_IPs all
Save file /etc/squid.conf dan konfirmasi ke squid untuk menerima perubahan konfigurasinya dengan cara:
#squid -k reconfigure
Well.... ampuh bangettttttt :-p
Dari googling, ktemu deh software UltraSurf-nya di site UltraReach.Ternyata software mungil for Windows. Emang pabrik yang satu ini mau migrasi juga. Tapi tetep aja problem ini harus di beresin.
Dari gue coba, Ultrasuft emang kecil banget. Cuman 138KB dan langsung running sebagai proxy server di localhost port 9666. Hebatnya stelah berhasil jalan, di langsung buka IE yang dah menggunakan proxy servernya dia. Tentu ini mudah banget kan bagi client. Karena gak ada proses install sama skali :-D
Dari log squid, ktemu hasilnya seperti ini:
1207549596.504 220101 192.168.10.17 TCP_MISS/200 1109 CONNECT 64.62.138.13:443 - DIRECT/64.62.138.13 -
1207549619.202 259 192.168.10.17 TCP_MISS/503 0 CONNECT secure.gohosting.com.au:443 - DIRECT/203.220.45.66 -
1207549619.387 448 192.168.10.17 TCP_MISS/200 39 CONNECT www.webassign.net:443 - DIRECT/128.109.135.22 -
1207549619.410 469 192.168.10.17 TCP_MISS/200 39 CONNECT sf1.strengthsfinder.com:443 - DIRECT/63.113.14.162 -
1207549619.749 807 192.168.10.17 TCP_MISS/200 39 CONNECT reg.netpas.cn:443 - DIRECT/60.28.193.69 -
1207549619.793 848 192.168.10.17 TCP_MISS/200 39 CONNECT www.amazon.com:443 - DIRECT/72.21.206.5 -
1207549619.806 852 192.168.10.17 TCP_MISS/503 0 CONNECT signin.ebay.com.cn:443 - DIRECT/66.135.209.238 -
1207549619.869 928 192.168.10.17 TCP_MISS/200 39 CONNECT member.hmsa.com:443 - DIRECT/64.128.4.7 -
1207549620.138 928 192.168.10.17 TCP_MISS/200 287 CONNECT 61.59.225.183:443 - DIRECT/61.59.225.183 -
1207549620.278 1062 192.168.10.17 TCP_MISS/200 287 CONNECT 66.51.207.186:443 - DIRECT/66.51.207.186 -
1207549620.774 1825 192.168.10.17 TCP_MISS/200 39 CONNECT www.statenb.com:443 - DIRECT/65.67.224.153 -
1207549620.854 1610 192.168.10.17 TCP_MISS/200 287 CONNECT 72.25.66.189:443 - DIRECT/72.25.66.189 -
1207549621.147 1901 192.168.10.17 TCP_MISS/200 287 CONNECT 72.25.123.42:443 - DIRECT/72.25.123.42 -
1207549622.064 2814 192.168.10.17 TCP_MISS/200 287 CONNECT 61.225.217.146:443 - DIRECT/61.225.217.146 -
1207549622.285 3037 192.168.10.17 TCP_MISS/200 287 CONNECT 122.127.83.243:443 - DIRECT/122.127.83.243 -
1207549622.349 3402 192.168.10.17 TCP_MISS/200 39 CONNECT grants.hrsa.gov:443 - DIRECT/162.99.248.247 -
1207549622.355 3402 192.168.10.17 TCP_MISS/200 39 CONNECT grants.hrsa.gov:443 - DIRECT/162.99.248.247 -
1207549622.356 3410 192.168.10.17 TCP_MISS/200 39 CONNECT www.hosei.org:443 - DIRECT/125.206.112.191 -
1207549622.398 3447 192.168.10.17 TCP_MISS/200 39 CONNECT secure.madriverweb.com:443 - DIRECT/12.152.254.60 -
1207549622.908 481 192.168.10.17 TCP_MISS/200 287 CONNECT 64.62.138.13:443 - DIRECT/64.62.138.13 -
1207549622.915 482 192.168.10.17 TCP_MISS/200 287 CONNECT 64.62.138.10:443 - DIRECT/64.62.138.10 -
1207549623.087 538 192.168.10.17 TCP_MISS/200 287 CONNECT 125.173.32.157:443 - DIRECT/125.173.32.157 -
1207549623.101 587 192.168.10.17 TCP_MISS/200 287 CONNECT 59.104.191.209:443 - DIRECT/59.104.191.209 -
1207549623.119 599 192.168.10.17 TCP_MISS/200 287 CONNECT 72.25.66.20:443 - DIRECT/72.25.66.20 -
1207549625.036 2486 192.168.10.17 TCP_MISS/200 287 CONNECT 218.162.175.153:443 - DIRECT/218.162.175.153 -
1207549628.568 8415 192.168.10.17 TCP_MISS/200 1397 CONNECT 61.59.225.183:443 - DIRECT/61.59.225.183 -
1207549662.268 156 192.168.10.17 TCP_MISS/200 39 CONNECT ebank.eonbank.com.my:443 - DIRECT/203.115.239.38 -
1207549662.480 368 192.168.10.17 TCP_MISS/200 39 CONNECT support.apple.com:443 - DIRECT/17.254.2.9 -
1207549662.580 463 192.168.10.17 TCP_MISS/200 39 CONNECT dlenote.ed.gov:443 - DIRECT/160.109.122.224 -
1207549662.600 501 192.168.10.17 TCP_MISS/200 287 CONNECT 64.62.138.13:443 - DIRECT/64.62.138.13 -
1207549662.644 542 192.168.10.17 TCP_MISS/200 39 CONNECT www.aetna.com:443 - DIRECT/206.213.211.171 -
1207549662.645 541 192.168.10.17 TCP_MISS/200 39 CONNECT www.aetna.com:443 - DIRECT/206.213.211.171 -
1207549662.652 554 192.168.10.17 TCP_MISS/200 39 CONNECT collab.sakaiproject.org:443 - DIRECT/194.35.219.182 -
1207549662.668 568 192.168.10.17 TCP_MISS/200 39 CONNECT www.ana.co.jp:443 - DIRECT/64.215.167.82 -
1207549662.771 651 192.168.10.17 TCP_MISS/200 39 CONNECT www.2checkout.com:443 - DIRECT/64.128.185.215 -
1207549662.771 655 192.168.10.17 TCP_MISS/200 39 CONNECT www.navycollege.navy.mil:443 - DIRECT/206.37.214.18 -
1207549662.778 660 192.168.10.17 TCP_MISS/200 39 CONNECT docline.gov:443 - DIRECT/165.112.6.76 -
1207549662.779 655 192.168.10.17 TCP_MISS/200 39 CONNECT www.virusbtn.com:443 - DIRECT/194.203.134.163 -
1207549662.780 657 192.168.10.17 TCP_MISS/200 39 CONNECT uk.etrade.com:443 - DIRECT/12.153.224.57 -
1207549662.817 522 192.168.10.17 TCP_MISS/200 287 CONNECT 66.51.207.186:443 - DIRECT/66.51.207.186 -
1207549662.832 538 192.168.10.17 TCP_MISS/200 287 CONNECT 61.59.225.183:443 - DIRECT/61.59.225.183 -
1207549662.832 33880 192.168.10.17 TCP_MISS/200 9456 CONNECT 64.62.138.13:443 - DIRECT/64.62.138.13 -
1207549662.943 644 192.168.10.17 TCP_MISS/200 287 CONNECT 72.25.66.189:443 - DIRECT/72.25.66.189 -
1207549664.714 2418 192.168.10.17 TCP_MISS/200 141 CONNECT 72.25.123.42:443 - DIRECT/72.25.123.42 -
1207549664.762 1712 192.168.10.17 TCP_MISS/200 512 CONNECT 64.62.138.13:443 - DIRECT/64.62.138.13 -
1207549664.762 2463 192.168.10.17 TCP_MISS/200 287 CONNECT 122.127.83.243:443 - DIRECT/122.127.83.243 -
1207549664.762 2460 192.168.10.17 TCP_MISS/200 287 CONNECT 61.225.217.146:443 - DIRECT/61.225.217.146 -
1207549730.403 349 192.168.10.17 TCP_MISS/200 39 CONNECT eupdate.dnb.com:443 - DIRECT/159.137.146.39 -
1207549730.535 503 192.168.10.17 TCP_MISS/200 39 CONNECT www.imeem.com:443 - DIRECT/208.72.33.133 -
1207549730.754 723 192.168.10.17 TCP_MISS/200 39 CONNECT my.avantgo.com:443 - DIRECT/64.157.224.8 -
Sepertinya software ini cara kerjanya mirip sama Skype. Tapi dia mencari web server yang ada ke tidak beresan fasilitas proxynya. Seperti Apache yang menggunakan mod_proxy gitu deh. Makanya dia brusaha kontak ke HTTPS smuanya. Tapi rata2 reverce ip nya gak bisa diresolve.
Cara pengeblokannya simple aja. Gak beda dengan cara pengeblokan Skype. Taruh saja 3 baris ini di /etc/squid.conf:
# bloking UltraSurf/Skype
acl numeric_IPs url_regex ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+
http_access deny CONNECT numeric_IPs all
Save file /etc/squid.conf dan konfirmasi ke squid untuk menerima perubahan konfigurasinya dengan cara:
#squid -k reconfigure
Well.... ampuh bangettttttt :-p
Postingan
15 komentar:
...bener2 ampuh bos....aq dah nyoba masang di squid.conf-ku & tnyata emang keblokir. Klo diblok dr firewall bisa ga?
Tentu bisa. coba ini:
iptables -A FORWARD -p tcp --dport https -j REJECT
Tapi efeknya semua paket ke luar menuju https:// akan di blok. Dgn setting proxy di client, via squid kita blok cuman https://#.#.#.# (#=angka). Alias blok https ke hostname yg gak bs diresolve. Sedangkan https://hostname tetep bs.
Goodluck
Di sini kok masih tembus ya?? Padahal uda ngikutin saran dari 'lufti' bahkan aku coba beberapa command lain tapi tetep aja ngga bisa. Uda mentok niii...
Client pakai UltraSurf 8.9
Saya lihat log dari firewall, ada yang CONNECT ke hostname (bukan IP)
Bisa tolong bantu? Takutnya lama-lama semua client pakai program ini...
Ya jelas dong?
log firewall gak ada CONNECT-nya deh. Itu log squid kalee.
Gini yah 2 kemungkinan ultrasurf (ato skype) bs jalan:
1. Via firewall
2. Via proxy server (squid)
Yg gue jelasin itu via squid. Dengan asumsi firewallnya dah di tutup. Jd mau gak mau semua user harus pake proxy utk bs browsing.
Jadi, usahakan tutup firewallnya (pake iptables). Lalu tutup di squid juga (tentu dgn hirarki yg bener). Beres ;-)
klo di mikrotik yang jalanin hotspot, gimana ya blokingnya???
Gue blon pernah pake mikrotik. Jd sorry, blon bs bantu. Eh hotspot ini dmn sih? For public area or internal offc user aja?
Aku coba pada Ultrasurf 8.9 tidak berhasil
Coba cek jawaban gue di comment ini. Dah gue jelasin tuh knp ;)
gw dan temen2 dah banyak make ultrasurf,tapi berefek jadi rusak sistem internetnya.dimana kalo buka IE tanpa ultrasurf,jadi gabisa.dan berimbas ke gak bisa login YM dan gabisa update virus kalo ultrasurfnya ga dibuka.bgmn ni penanganannya???
kalau pake ultra surf 95 tembus ngak om??
soalnye yg 95 lebih gila lagi :(
bos kalo pake iptables ini
iptables -A FORWARD -p tcp --dport https -j REJECT
gak bisa konek ke gmail doang?
pake ultrasurf terbaru 8.9 ga ngaruh tuh boss, emang sih dilognya tertulis access_denies cuma masih bisa lolos az
pake ultrasurf 9.94 ga ngaruh nih boss, masih nyelonong az..
kebetulan ane proxynya manual bukan yang transparent
bos, klo gitu skype ketutup jg ya?naah gw butuh skype.tp ultrasurfnya kudu mati...gmn ya..moon bantuannya
ane new kamer nih gan...
gini di kantor ane banyak yang pake ultrasurf (selanjutnya disebut "susu ultra") ditambah aplikasi klo ga salah ane namanya "cfos". ini jadi masalah gan, soale ane mo donlot antipirus kecepatan donlotnya cuma 1kbps.
ane mo tanya nih ama agan (harus mau jawab)... gimana caranya biar ntu dua aplikasi ntu ga lagi merajalela di kantor.
ane yakin pasti agan bisa kasi solusi ke ane...
NB. mohon balas ke email ane di kpknl.060100148@gmail.com ya gan? sekalian minta aplikasi dan petunjuk penggunaan jika operasinya pake kompi client (karena di kantor PICnya bukan ane gan)
demikian, tararengkiyu banyak2.
Posting Komentar