On 07/24/2016 07:22 PM, Andrew David Wong wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
On 2016-07-24 10:56, Achim Patzner wrote:
Am 23.07.2016 um 00:41 schrieb Andrew David Wong <[email protected]>:
Your best bet is to whitelist the entire CIDR block of bank's domain
(and hope the site doesn't rely too much on CDNs). You can typically find
the CIDR block in the domain's WHOIS information:
… and then you’ll find out that $BANK is using an external service for its
financial transactions and their website is only providing you with a
locally running front end to that gateway. Which will probably not use any
machine in their own registered block. Or the web servers are hosted by a
third party who is not hosting the transaction gateway.
Well, that's why I said:
If things still aren't loading properly, use the developer console in
your browser (e.g., press F12) to see the domains of any network
resources that aren't being loaded properly, then follow the same
procedure to whitelist those, as well.
Sorry, but this answer might cause more problems than it solves.
Have you actually tried it? It's been working for me for years.
But if anyone has a better solution, I'm all ears.
A quick and dirty solution: In each restricted VM I open a terminal and do:
> sudo tcpdump | grep unreachable | awk '{print $8}'
When the firewall rejects a connection, sending back an ICMP message,
the hostname will be listed in that window. My .bashrc for each
restricted VM contains a simple alias:
prohibitedHosts() {
sudo tcpdump | grep unreachable | awk '{print $8}'
}
alias blocked=prohibitedHosts
So I can just type the word "blocked" at the command line, perform the
failing operation, and then use the hostnames to tweak the firewall
rules for that VM. I'm sure you could do filtering with tcpdump rather
than using grep, but the stream buffering doesn't delay the output too
much. Its been working fine for me.
- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-----BEGIN PGP SIGNATURE-----
iQIcBAEBCgAGBQJXlU23AAoJENtN07w5UDAwZxkP/30AGgV88vJIEI5t4YxkH2QM
90ss/+YPO8UvkWCJYheQQ5U85nEF78eNhNq0VGBb5P383JIJTLpBXG9Y5WzjZLS/
/9pEx7FUCIC1hcIITTExu2zAzQJjzeEwPUnf6CTEfvjzKkN8eXmITValwbfshzoY
B2pNqME8n6HZ0ndgdXKYzxe6kZ3tZqkR+oFF0+wuDwjyn/KNgyCqCzQ25csqdAWw
z6rUsbVF6vBep3ViNL/iMu3KKipkQ5Czklg7C16y+2QTzR0ASPALEgT1ZiNvQMNM
S3kniRJ+u0gLvt9ZKsQSm/p5ngXC7MCAn2apo8ky++yFh+ekyF8odGZslw7Ymb0c
lXWULRaRYcIJ3s2A1ffN9oB1Jg55bcYhTLKflaHhBaLqKxYEbNxyWL+21fOL7MeD
d9WiIoHmKmOEsXjs4KpkYD+vNdcZskNetyK/6o/iph6RasRiMLpQu0mEtM3LiYf+
9nOyiRPAFHzc8DKCciDA4HHO800v4XNhrtgUJ3HAgcD+JA1WaBdxVO1Zsy9a8W7j
1d8COT2dtMPvUwkGmWBiZReNqJyHzNsdcwnAdd6isqJWKFA7GJ/wltI/ukgjxDyh
AEeJbV/VMxTUY6ALT0iHf2NwOAv3tBlgjTpErswx4mVMnbbElhQ8At373XuIkBoT
oDNgrOexOJmSvbERU3ok
=q9re
-----END PGP SIGNATURE-----
--
You received this message because you are subscribed to the Google Groups
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/qubes-users/6d3f76a2-caa7-5b96-1e8e-8aacab7ce4b3%40jhuapl.edu.
For more options, visit https://groups.google.com/d/optout.
