Forum Moderators: phranque

Message Too Old, No Replies

How do I block anonymous proxy referers

         

max666

11:00 am on Nov 16, 2007 (gmt 0)

10+ Year Member



Hi All

Im new to this site and htaccess. I have a blocked a couple of IPs from access to my site that were attempting to access root directories. One has since discovered Proxyway and is now by passing the original IP block. I want to know if there is a line of script that I can add that will proactively block any anonymous proxy access. My thoughts were that maybe this can be done by blocking at the referer level. Below is an extract from my log file.

202.63.100.211 - - [15/Nov/2007:18:38:28 +1100] "GET / HTTP/1.0" 200 1460 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)"
202.63.100.211 - - [15/Nov/2007:18:38:40 +1100] "GET /button1.jpg HTTP/1.0" 200 28333 "Field blocked by ProxyWay (http://www.ProxyWay.com)" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)"

Thanks in advance max666

jdMorgan

9:06 pm on Nov 16, 2007 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



By definition, if a proxy is anonymous, it sends no information that could be used to identify it as a proxy other than its unique IP address. As such, anonymous proxies must be blocked by IP address.

However, this looks like a software 'internet privacy' proxy, and so may be blockable by the modified Referer header value and IP address.

You could, for example, rewrite such requests to a PERL script that adds code to your .htaccess file to block misbehaving clients by their IP address. A good example of just such a script is posted in this thread [webmasterworld.com] in our Perl Server Side CGI Scripting forum.

Jim

max666

10:58 am on Nov 17, 2007 (gmt 0)

10+ Year Member



Hi Jim

Thanks for your reply, I didnt quite follow the Perl script but did come across the following which you had once replied to. Would this address my issue.

RewriteCond %{HTTP_REFERER} (Field\sblocked¦proxyway¦Outpost¦Agnitum¦anonym¦steganos¦Norton) [NC]
RewriteRule!\.403\.php$ - [F]

regards max666

jdMorgan

4:49 pm on Nov 17, 2007 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Assuming you modified that code to better fit your requirements, it would still only block the requests that had the proxy software name in the referer. Looking at your log examples above, it would block the second, but not the first request.

Using the script, once a single request was detected with the proxy software name in the referer, an entry would be added to your .htaccess file to block that requester by IP address forever -- unless you manually removed that IP address blocking later.

Jim

max666

11:00 am on Nov 18, 2007 (gmt 0)

10+ Year Member



OK thanks for your help, I'll see how it goes, hopefully it will be enough that they give up and find something better to do.

Regards Max666