Re: Is there anybody out there?

On Thu, 2008-10-16 at 04:07 -0600, Scott C. Lemon wrote:
> I noticed in some comments that you mention an exception about Windows
> Update ... And that it is "broken".  Do you remember what the issues was
> that Windows Update was causing, and why you had to write the exception??
> 
> # Redirect outbound non-auth web traffic to the local gateway process
> # except to windowsupdate.microsoft.com, which is broken.
>
> I am trying to track down how I am seeing these computers that have "broken"
> through the gateway, and am often seeing numerous "attacks" by various
> update services ... Symantec, MacAfee, etc. ... Where they are hammering the
> gateway with requests over and over for long periods.

That was it precisely. It makes the gateway fall over. I think that
iptables supports some kind of rate limiting that might be useful here.

> What I end up with is a iptables rule that appears as "half" of the access
> permit pair ... Only the NoCat_Inbound rule is there ... But it allows them
> to use the Internet somehow.  When I run the access deny command, I get an
> error that the NoCat rule doesn't exist ...

I confess that I haven't touched this code in so long that I honestly
don't recall... :(

SDE