Slashdot Log In
Blocking a Nation's IP Space
Posted by
ScuttleMonkey
on Wed Aug 31, 2005 03:01 PM
from the haul-out-the-civil-disobedience dept.
from the haul-out-the-civil-disobedience dept.
SComps writes "The Register has a good commentary about blocking Chinese IP space and some of the pros and cons surrounding that action. The question I post to Slashdot: "What is your opinion of this and what do you propose to help correct this?" Additionally, what sort of actions do other Slashdot users take to protect themselves from rogue IP space, be it national borders or even retail broadband/dialup providers such as wannadoo or comcast, roadrunner, etc?" The author of the article raises an interesting point, will this 'slippery slope' prove too difficult to walk?
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
My ban list is extensive but I'm a home user only. (Score:4, Insightful)
Correct what? The fact that other countries are full of hackers that constantly attack you and you have little recourse to stop it? I suggest blocking them. Duh.
Additionally, what sort of actions do other Slashdot users take to protect themselves from rogue IP space, be it national borders or even retail broadband/dialup providers such as wannadoo or comcast, roadrunner, etc?
I have an extensive ban list on my firewall including tons of
I am an individual. I don't run a corporate network and I am not required to put up w/a bunch of shit from other people. Don't like it? Oh well, I'm unconcerned. This particular Ask Slashdot might be pertaining to something else but the blurb wasn't really clear.
If it were up to me, I would want entire countries in their own easy to block IP address space. Want to block
After moving off of Comcast for residential DSL through a respectable provider I find that I don't have worms constantly hitting my machine. I don't have as many attack attempts and I certainly am not blocking quite as much spam. I long for the day when I don't have to add another
Re:My ban list is extensive but I'm a home user on (Score:3, Interesting)
Re:My ban list is extensive but I'm a home user on (Score:4, Interesting)
Yeah, the "ultimate democracy." Where despotic regimes harbor cyber miscreants who piss off the inhabitants of "civilized" countries, who block those despotic regimes, therefore denying the innocent inhabitants of those regimes the ability to communicate unfettered with the rest of the free world.
"Hey, there seem to be all these hackers in China. Let's block the entire nation of China from the rest of the Internet. That will really help the Chinese Internet censorship situation."
But I guess your own convenience is more important that giving those people a conduit to freedom.
As somebody else pointed out, an individual has every right to block or receive whatever traffic they wish. But if you're a network administrator at an ISP or government who thinks he's doing some good by closing off these segments of the Internet, you're nothing but low life scum who cares more about his temporary comfort that other people's lives.
Parent
Re:My ban list is extensive but I'm a home user on (Score:5, Interesting)
230 years ago, this nation I live in was under a (different) "despotic regime" - some people decided to take some action, and it changed. The assistances they received happened after they started, not because they whined.
As an individual internet user, I have not ever blocked an email from a political dissident due to its political content. As a website author, I have not blocked anyone from viewing my site.
As a businessman, I respect and obey the laws governing my use of advertising online, by email (I fully comply with CAN-SPAM) and other means as applicable.
The above said, anyone who cannot see fit to play by the same rules can go figure out a different game *elsewhere*, instead of trying to play some bait (political freedom of speech) and switch (illegal spam serving) game.
There is no "divine right" nor requirement to maintain a web presence, to maintain completely open networks, to provide a podium upon which some poor abused oppressed individual can spout their issues to everyone else, no matter how "justified" they might be.... This whole intarweb thing borders so closely to being completely fictional it isn't funny - please *do* seek to force your beliefs concerning how things *should* be onto the current way things are - only time will tell how successful you were.
Please *don't* consider the over-worked net administrators as enemies: The real enemies are those spam servers who bury any legitimate content coming out of dissenting China more effectively than any locally-applied blocks ever could.
Parent
Re:My ban list is extensive but I'm a home user on (Score:5, Informative)
Parent
Easy ban lists (Score:5, Informative)
My philosophy is that you should get to decide who you want to talk to. If you don't want to talk to anyone in China (or Australia, or whatever), then no one says you have to.
Parent
Re:My ban list is extensive but I'm a home user on (Score:5, Insightful)
Blocking based on IP range and or country is pure and simple discrimination. A lot of people don't seem to grasp why discrimination is bad until they end up on the receiving end...
Having said that; if you want to block half the world, I believe that's your right. Just don't block it for me please, I'd like to make that decision myself.
Parent
Re:My ban list is extensive but I'm a home user on (Score:3, Insightful)
I'd suggest just keeping your services secure. Automated attacks are aimed at the lowest common denominator, even basic security steps will stop them. My smb server gets connect attempts at a rate of around 2 per second, and has done for the last six months or so. So far none have got in. I only take action if I'm getting hammered by a single IP, a
Re:My ban list is extensive but I'm a home user on (Score:5, Informative)
I'm the admin for a company with around 70 employees, we maintain our own website, and mail systems. We had been getting pounded with spam and a lot of ssh attempts.
Before taking any action, we found that China (predominately) and Korea were the source of most of our break-in attempts and spam sources. Given that we do _some_ international business, but not there, that was an easy call. Other countries soon followed. Our criteria has been that if there is any chance that someone will travel to a particular country or if the country has useful information to be had via someone with email, we don't block. I know it sounds judgmental, but it has cut our spam/scams down by about 75%. I would prefer to block all cable access to mail, but that would potentially hurt our road warriors with SMTP-AUTH. The slippery slope comes in when you say "Screw anyone on Wannadoo or BTI or Time Warner, etc. running a mail server." I know I quit running a mail server at home just because my stuff was blocked. Our compromise is that spam sources are individually blocked (rather than by range) in places where we travel or may do business.
Further if you have a good firewall scheme you don't have to block web access. You can block the ports that give you trouble and still allow http access if you need the Chinese comsumer market to see your site. I have found that an invaluable tool to use in conjuntion with iptables is IPSet [netfilter.org].
It allows for very quick processing of ranges or hashes of individual addresses.
If you want info on blocking countries (sorry if I offend anyone) look here:
http://okean.com/asianspamblocks.html [okean.com]
and http://blackholes.us/ [blackholes.us] (when it's up...)
Personally, I find blocking unwanted guests akin to allowing only people on your chat list to talk to you...
Parent
Re:My ban list is extensive but I'm a home user on (Score:3, Insightful)
It's fairly apparent where I'm from. I didn't feel the need to state it -- if you'd like more info my post history and personal URL are there.
As far as America being full of hackers. This is true. They don't typically fuck with me from American IPs though. The main problems I see from America are morons running unpatched shit on residential connections.
Anyone else from America that is tryin to exploit me is generally coming
Re:some ideas for networking (Score:5, Insightful)
Parent
Re:some ideas for networking (Score:5, Funny)
That won't protect my children from pornography.
Parent
Re:My ban list is extensive but I'm a home user on (Score:3, Insightful)
Dude, seriously, what are you doing on slashdot? Didn't you know that hot babes from all over the world are trying to email us all day every day?
Honestly, for me, email is like the phone- the list of people that I want to have access to me isn't that long. Not because I am a hot commodity, but because I don't like being disturbed.
It is your computer- you can restrict access however you want.
Re:My ban list is extensive but I'm a home user on (Score:5, Informative)
Many a discussion have been had when your business-class internet goes out, all the suits quote the same "I thought the internet meant that it doesn't go out".
Sorry, if your firewall goes out, your office is out.
If your ISP's router feeding your office is out, you're out.
If your ISP's feed has a bad router, they're out and guess what, you're out too.
Parent
Re:My ban list is extensive but I'm a home user on (Score:4, Interesting)
Redundancy. To two different ISPs.
If they don't like the cost for it, ask them what the cost is to be without internet access for 2 days.
Parent
Purpose of blocking (Score:5, Interesting)
The point of refusing access from certain IP addresses is not to deny service to any particular individual (or nationality, in case of entire countries being affected), but to protect against likely abuse and encourage individuals to use some other IP address. As long as your boycott is aimed at their network infrastructure (for aiding abuse) rather than at the country itself (for political reasons), individual users routing their traffic via other networks is not a problem; it's what you want them to do. The idea is that the secondary network will sort out the abuse (by making sure they know who their customers are, or by other means). If they fail to do so, they will be blacklisted too.
Therefore I see no point in specifically blacklisting any single country, if not for political reasons. Entire countries are blacklisted because they conveniently map to large portions of IP address space. Some Chinese universities probably received their IP blocks before the commercial operators did, and may therefore have addresses in completely separate ranges. If the universities are a bit better at managing their networks, and the bulk of the abuse therefore comes from the commercial blocks, there is no reason both should be listed merely for being assigned to the same country.
Likewise, a single address block may contain several operators in different countries, causing them all to be blacklisted simply because telling them apart takes too much time. It's all about network abuse history, not about nationality. And, I wouldn't have to rely on everyone else blocking a single abused network either, unless they all were to forward that abuse to me.
I have however considered blocking mail servers indiscriminately "bouncing" virus messages having our domain forged onto them, when they have received those messages from IP addresses (often Chinese ones) already included in public blacklists. They could avoid such action on my part by simply using said blacklists themselves, but exactly how they solve their problem is up to them. If they simply avoid "notifying" innocent people every time they receive junk mail or other abuse, I will not bother them.
Parent
Officially insane. (Score:5, Insightful)
What's so insane about it? (Score:4, Interesting)
This is just an example, but the idea goes for other kinds of sites too...
Parent
Re:What's so insane about it? (Score:5, Interesting)
If your website is not hackable from the US it's not hackable from China or Russia.
So, why are you blocking China and Russia but not the US?
Parent
What big company.... (Score:5, Insightful)
Re:What big company.... (Score:3, Interesting)
Looking for open proxies (Score:3, Interesting)
No. No. No. (Score:5, Insightful)
Ya... (Score:5, Insightful)
This seems a rather murky route to go down, that ultimately, will be in no one's best interests.
Not at all (Score:5, Insightful)
Parent
Re:Ya... (Score:5, Insightful)
Nope. Nothing strange about that.
For you or me to choose not to get email from Chinese addresses, or not to acknowledge packets from Chinese addresses, is to exercise our liberty. We have the right (among others) to ``freedom of association''. That means that we can choose who we associate with ... and who we don't.
This is radically different than a government trying to tell us that we cannot access certian websites (as the Chinese government has been doing with help from Cisco, MS and Google).
Let me try to re-phrase all that in simple terms: If we don't want to play with somebody, that's OK. If the bullies try to stop us from playing with someone, that's not OK.
OK?
Parent
I don't want to miss out on any opportunities! (Score:5, Funny)
I am chinese (Score:5, Interesting)
Re:I am chinese (Score:5, Informative)
As a Wikipedian, I can tell you that http://zh.wikipedia.org/ [wikipedia.org] is a great case study of this censorship... it had a huge chilling effect on the project during that time. See http://en.wikipedia.org/wiki/Chinese_Wikipedia [wikipedia.org]
See also: http://en.wikipedia.org/wiki/Internet_censorship_
Parent
Re:I am chinese (Score:5, Funny)
Parent
what would cut down spam (Score:5, Insightful)
would be if China blocked inbound USA connections seeing as 80% of the worlds spam originates from there [spamhaus.org], the numbers are no different for all the other scams either ie Phishing, Malware, Adware , Spyware [internetnews.com] etc etc
hmmm perhaps the rest-of-the-world should just cut off USA it would probably stop 80% of internet related crime overnight
Re:what would cut down spam (Score:5, Insightful)
It's also a list of the people creating the spam, not the location of the machines that are sending it.
And note that North America includes the US, so a lot of that spam is by Americans, for Americans. Just relayed through China, Korea and Brazil.
Parent
Re:what would cut down spam (Score:4, Informative)
There are scores of young men who sit around in internet cafes all day and do nothing but scan for vulnerabilities in badly-coded applications, mostly message boards. I know, I've seen them. Yes, it is most unusual for a Chinese fellow in an internet cafe to not be playing Counterstrike, but I assure you it does indeed happen. You can turn on the scanner and let it run in the background while you play Counterstrike, don't forget.
Parent
Sure - I block 'em (Score:4, Interesting)
Basically - if we know we want a prospect in China, Korea, etc. to use our site, we'll open something for them - otherwise they should just go the heck away.
If enough people -j DROP China, etc., maybe somethign will get done about. (I know - wishful thinking).
Baby with the bathwater? (Score:4, Insightful)
It would though depend on the size and usage of the network you would be blocking Chineses traffic from. If you're a small buisness with absolutely no connection to China whatsoever, you might be ok blocking the entire IP block to protect your network from spammers. But, even an average size network might have some sort of Chinese connection, either from the outside in or vis versa. Lots of companies and people inside China that try to access that network would effected, not just the spammers.
Re:Baby with the bathwater? (Score:3, Interesting)
I wouldn't consider blocking mail based on geography alone unless I could get input from everyone the policy would affect. You can do that as a home user,
treat your network like a sewer (Score:3, Insightful)
Do it if you can... (Score:3, Insightful)
"What is your opinion of this and what do you propose to help correct this?"
If you can get away with blocking out large IP spaces of an entire country, do it. If you can't, don't. I don't receive any legitimate mail from chinese IP addresses and never will. I don't block anything at the moment, but if it solved much of the scanning and spam I see I'd probbably consider it. Unless you have a global market, why not do it if it solves more problems than it creates?
I think when a US company starts targeting large ISPs in the US, or are an ISP yourself you're going to run into trouble though. I know an ISP that discards all mail coming from roadrunner addresses as spam. That's a terrible practice for the ISPs customers who aren't getting legitimate email.
Inappropriate & Heavy-Handed Response (Score:5, Insightful)
From a political science and ideological perspective, industrialized and democratic companies benefit little form blocking the access of citizens of 'pariah' nations to non-classified information. Any opportunity to make available memes that offer alternatives to the totalitarian state line further create the opportunity for the expansion of democracy and free access and speech in those countries. Blocking national IP ranges in this manner would also decrease this opportunity.
Firewalled people (Score:3, Interesting)
Blunt force trauma (Score:3, Insightful)
Over the past 6 months I've identified and recorded all SSH dictionary attacks on my machine. I've recorded exactly 211 IP addresses so far.
People who advocate blocking
Dynamic Block (Score:3, Insightful)
However I'd suggest a dynamic blocking as the best means to do i.e. a machine generated list. Have a server outside the firewall examine incoming requests and block IP ranges where significant numbers of dubious requests are coming from. If the number of dubious requests falls below a certain rate then the IP range is unblocked.
This is a lot better than a permanent ban because you can't be accused of implementing a political agenda of your own and it rewards ISPs/Companies/Countries that eventually clean up their network space. Of course it does mean that you have to be able to define in terms a computer will understand what a "dodgy" request is.
For corporate emial I don't see the issue (Score:3, Interesting)
If our firewall could easily block IP addresses, I'd do that too.
The easy way to do it... (Score:5, Funny)
Hypocritical? (Score:3, Insightful)
My Little Part. . . (Score:5, Informative)
I like to think that I'm doing my little part by blocking all incoming connections from China, Taiwan, and some of Japan. I throw a big ass list of IPs to block into iptables (and give it time to parse all the IPs and such), and call it good. There are some good lists to block some of those Asian countries that do a reasonably good job: Some IP addresses [tsg.ne.jp].
But in all seriousness, the reason I do this, is because of the numerous attempts to brute force sshd, or to send email via my SMTP server, the vast majority of IP addresses come from China, Hong Kong, Taiwan, and Japan.
much simpler solution to blocking chinese IP (Score:4, Insightful)
1. put some text about freedom of speech and/or human rights in china on your webserver
2. make sure google finds you
then the chinese government itself would see that chinese IP traffic can't reach you.
I wish... (Score:5, Interesting)
Until the glorious day we segragated our mail users. We set up a new beta mail server and split our users into two groups. Those needing international mail, and those not needing it. Over the course of 3 months, we informed users of the change and provided an easy opt-in one-click process to make sure they could send/recieve international mail.
After that grace period, we simply shut off international mail on our main server by blocking any IP space outside the US.
The load on our mail servers (4 dual CPU machines) went from averaging around 50% down to 5% and stayed there.
In our polling of our own customers, we found that 90% or more of them never had any intention or desire to send/recieve international mail. Our spam load went from several thousand spam messages a minute to less than a thousand per day.
The people that needed international mail were put on the new server and left open to all mail.
For the next few months, the staff at our office didn't have to buy lunch or snacks because that corny AOL commercial actually happened. We had customers in all the time taking us out to lunch and dropping off brownies, cupcakes, etc... our satifaction rate was never higher and I would venture to guess that we would not have been that loved had we sent everyone $50 cash.
Why isn't this a more popular choice? Is there really that much of a NEED in the general internet population for international mail? There wasn't at our company.
I think we could make international mail a feature add-on much like web hosts make CGI, PHP, or mySQL a feature add-on. Sure, to me those are just staples, but not everyone needs all that.
Sure, there's still in-country spam sources... but NOTHING like what comes from outside.
Re:I wish... (Score:5, Insightful)
Let me tell you my experience sending email from Japan:
1) I have been the silent party of a conference call between a professor at a major American university and the tech he was "#$%#&$ing out because said professor did not get the five-figure speaking fee we wanted to pay him because our repeated attempts to contact him went unanswered (the techs, to save themselves a little hassle, had blacklisted *.jp)
2) I have been asked "Why don't you ever write?" by a favorite auntie, who is exactly the lady at those tech support humor web sites make fun of. I do write, once a week like clockwork. Her ISP decided on her behalf that it needed to be /dev/null'ed.
3) I have a 99 year old great grandmother who, bless her heart, has started to use the computer. She is doing exceptionally well for 99, but if you ask her four days out of five she'll tell you "No, of course not, don't know anybody living abroad. I haven't been back to Ireland since I came over in 1916 and all my family there is dead". Then if you go on to prod her about her great grandsons she'll take your ears off bragging about those fine young men who went off and got educated and are now living in Korea or China or somesuch place where the folks are very friendly and they drink excellent tea although of course not the sort that they made in County Cork.
4) I get a copy of my local newspaper (for the neighborhood I grew up in) delivered to me once a month by my mother. A favorite teacher of mine from grade school just retired. One Google search later I had his school's office email address and sent them a letter of congratulation to forward on to him. I've gotten no response -- it probably got eaten. Asked yesterday whether he needed to speak to anyone abroad or not, this veteran of the Chicago Public Schools would have said "Nope, can't say that I do".
5) Three companies have lost my business because they can't handle having a customer abroad (seeming inability to handle emails played a part in all three cancellations, not entirely sure it was the only issue though). One (my bank) has gained it for life because they went the extra mile, including having a $10 an hour telephone operator having a three-day long spat with their IT department before I could get whitelisted. (Oddly, the IT department had clearly spent a lot of development resources on making their web forms, etc international-aware... and then /dev/null'ed all email from the customers using the special forms)
Parent
Re:What is my opinion?! (Score:3, Insightful)
Censorship is wrong. Blocking spam isn't censorship. That's your error.