[Xitami] ip blocking

[Charles Schmidling]

Sort of.  Name servers don't allow you to change off of the standard port
(80).  They just point a shotgun at the IP and expect it to deal with
whatever comes its way.  Also, when you change an IP in a name server, it
takes the 24-72 hour propagation time to be usable.  Forwarding is instant
(nearly).

I use this analogy to get a handle on all of this.

Say, you have a private post office - your IP address.

As with everyone else at their own post office, you accept mail at PO Box 80
(standard HTTP port).  All your friends and friendly strangers write you
there.  This is also your default published address to the world (DNS
standard).  Occassionally (actually all the time) you open your mail box
(query) and get and process everything in it.  This, unfortunately, includes
the bulk mailers and scammers.

So you're tired of all that bulk garbage.  For that matter, it fills your
box so you can't get things you want.  So you tell your post master (Xitami)
to "shift" your mail box by 370.  Xitami adds 80 (the original) to this and
starts processing  mail for you at port 450 at the next work shift (reboot
of Xitami).  So dutifully you now query for your mail at box 450.  Box 80 is
physically still there but the clerk doesn't put anything in it, and mail
falls to the floor and it gets cleaned up by the bit bot (night crew).

The problem is that your friends still think your address is box 80.  That's
what your DNS server is telling them anyway and unless they know that your
address changed, their requests will end up on the floor, too.  This can be
handled in two ways:

    1.  Send your friends a change of address card.  "Hi.  I moved.  My old
address of www.me.com:80 (the actual default query for www.me.com) has been
changed to www.me.com:450 (or, heaven forbid 10.999.999.001:450).

    2.  Create a Canonical domain (CNAME) name say ww2.stillme.com and the
have your DNS service forward any web queries to www.me.com to
ww2.stillme.com:450/default.htm.  Masking optional.

The second method allows you to instantly change PO boxes on a whim,
changing the forwarding, and no one is the wiser.  I've done both and the
second is definitely preferred.  It is akin to setting up mail.me.com or
ftp.me.com and processing the query by content.

I'm actually starting to see more web sites doing this forward trick.
Probably to diminish/eliminate the same things you want to
diminish/eliminate.

caveat:
1. port shifting will also shift the FTP port.  I don't use Xitami's FTP so
I don't care.
2. When you "open" a page in IE (and others), they don't understand a query
that has a port number added on.  They make you address with "HTTP://"

Simple is good!  Hope this has been helpful, if not amusing.
Charles


----- Original Message -----
From: "admin" <admin@mrjdesign.com>
To: <xitami@lists.xitami.org>
Sent: Friday, December 03, 2004 1:24 PM
Subject: Re: [Xitami] ip blocking


> Isn't this done completely internally in Xitami when you change the
> portbase simply?
>
> In other words, chaninging the port base would simply alter the port it
> sends the queries to,
> but in the name servers you still only specify the IP number it should
> respond to.
>
> This would have the same effect since the server would know to open
> everything at a certain port but not display this, doesn't it?
>
> >Another trick to defeat these things is change your working HTTP port
from
> >80 to something other.  Since doing this, I've gotten ZERO DoS scans.
The
> >trick is to set up a CNAME for your domain and forward your web page to
the
> >new port via this "alias".
> >
> >Example:
> >Say I want my HTTP port to set at 450.  This is done as an offset setting
in
> >defaults.cfg file.  Next, I set up CNAME with my DNS service (either at
my
> >domain registrar (e.g.NetSol) or a DNS service (e.g. ZoneEdit)).  Last, I
> >forward
> >           www.mydomain.com
> >to
> >         ww2.mydomain.com:450/index.html.
> >
> >and voila, no more DoS scanners.  I now only receive "legitimate" scans
from
> >robot hunters and search engines.  And these folk are generally
identifiable
> >in the logs.
> >
> >The standard "48 to 72 hour" propagation delay will apply the first time
you
> >do this due to the new "domain."  Forwarding changes are instantaneous.
> >
> >If you use Virtual Domains, you will need to add the new ww2.mydomain.com
to
> >your domain list.  Unless you want it to go someplace different, point it
to
> >the same configuration file as www.mydomain.com.
> >
> >Happy serving,
> >Charles
>
>
>
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami