IPCop Firewall

> I've tried everything I could think of, BOT, AdvProxy etc, but no
> success.
> 
> I can block Friendster at will (for example), but facebook is really a
> pain... I can use global ban, it's efficient and less hassle... for me,
> but
> not for my boss lol.

Try blocking fbcdn.net instead of facebook ... this supplies all of the
applications and widgets which run on facebook, and without it the whole
thing just doesn't work properly, so people give up.

David

I've tried to put that fbcdn.net into Banish.

Facebook.com can still be opened though. I can ping facebook and traceroute
it as well.

The only way to stop people from accessing Facebook on my LAN is, putting a
time restriction altogether on AdvProxy (I can exclude myself). There's also
a... stupid wayby blocking IE and Firefox useragent lolz.
---
You don't need a reason to help people.
http://bloggingwithsuccess.net


On Fri, Apr 17, 2009 at 4:44 PM, Administrator <
admin@...> wrote:

> > I've tried everything I could think of, BOT, AdvProxy etc, but no
> > success.
> >
> > I can block Friendster at will (for example), but facebook is really a
> > pain... I can use global ban, it's efficient and less hassle... for me,
> > but
> > not for my boss lol.
>
> Try blocking fbcdn.net instead of facebook ... this supplies all of the
> applications and widgets which run on facebook, and without it the whole
> thing just doesn't work properly, so people give up.
>
> David
>
>

Check that it's still switched on at the bottom of the adv proxy page,
and that social net is ticked on the url filter page. What blacklist
database are you using?

On 2009/04/17 11:39, Fransiska Ike wrote:
> That's... the problem.
>
> The URL Filter has been installed since a long time ago, but suddenly
> it stopped working... duh...
>
> I can't use any of its features. I am still able to utilize AdvProxy
> features, though.
> ---
> You don't need a reason to help people.
> http://bloggingwithsuccess.net
>
>
> On Fri, Apr 17, 2009 at 4:28 PM, Alex Schaft
> <alexs@... <mailto:alexs@...>> wrote:
>
>     On 2009/04/17 11:02, Fransiska Ike wrote:
>>     I've tried everything I could think of, BOT, AdvProxy etc, but no success.
>>
>>     I can block Friendster at will (for example), but facebook is really a
>>     pain... I can use global ban, it's efficient and less hassle... for me, but
>>     not for my boss lol.
>>
>>       
>     Add urlfilter to advproxy
>
>

It's turned on already, and I am not using any database, since I use custom
blacklist.

And now it's working as usual again -_-. I don't know why, but it fixed
itself... The only thing remaining here, is that my Update Accelerator does
not work. It just doesn't cache any updates.

---
You don't need a reason to help people.
http://bloggingwithsuccess.net


On Fri, Apr 17, 2009 at 4:50 PM, Alex Schaft <alexs@...:

>  Check that it's still switched on at the bottom of the adv proxy page, and
> that social net is ticked on the url filter page. What blacklist database
> are you using?
>
>
> On 2009/04/17 11:39, Fransiska Ike wrote:
>
> That's... the problem.
>
> The URL Filter has been installed since a long time ago, but suddenly it
> stopped working... duh...
>
> I can't use any of its features. I am still able to utilize AdvProxy
> features, though.
> ---
> You don't need a reason to help people.
> http://bloggingwithsuccess.net
>
>
> On Fri, Apr 17, 2009 at 4:28 PM, Alex Schaft <alexs@...:
>
>>  On 2009/04/17 11:02, Fransiska Ike wrote:
>>
>> I've tried everything I could think of, BOT, AdvProxy etc, but no success.
>>
>> I can block Friendster at will (for example), but facebook is really a
>> pain... I can use global ban, it's efficient and less hassle... for me, but
>> not for my boss lol.
>>
>>
>>
>>  Add urlfilter to advproxy
>>
>>
>
>

And I am still wondering why Banish can't block Facebook by itself. This is
the first Banish failure I've ever seen.
---
You don't need a reason to help people.
http://bloggingwithsuccess.net


On Fri, Apr 17, 2009 at 6:06 PM, Fransiska Ike <blackzero85@...:

> It's turned on already, and I am not using any database, since I use custom
> blacklist.
>
> And now it's working as usual again -_-. I don't know why, but it fixed
> itself... The only thing remaining here, is that my Update Accelerator does
> not work. It just doesn't cache any updates.
>
> ---
> You don't need a reason to help people.
> http://bloggingwithsuccess.net
>
>
> On Fri, Apr 17, 2009 at 4:50 PM, Alex Schaft <alexs@...:
>
>>  Check that it's still switched on at the bottom of the adv proxy page,
>> and that social net is ticked on the url filter page. What blacklist
>> database are you using?
>>
>>
>> On 2009/04/17 11:39, Fransiska Ike wrote:
>>
>> That's... the problem.
>>
>> The URL Filter has been installed since a long time ago, but suddenly it
>> stopped working... duh...
>>
>> I can't use any of its features. I am still able to utilize AdvProxy
>> features, though.
>> ---
>> You don't need a reason to help people.
>> http://bloggingwithsuccess.net
>>
>>
>> On Fri, Apr 17, 2009 at 4:28 PM, Alex Schaft <alexs@...:
>>
>>>  On 2009/04/17 11:02, Fransiska Ike wrote:
>>>
>>> I've tried everything I could think of, BOT, AdvProxy etc, but no success.
>>>
>>> I can block Friendster at will (for example), but facebook is really a
>>> pain... I can use global ban, it's efficient and less hassle... for me, but
>>> not for my boss lol.
>>>
>>>
>>>
>>>  Add urlfilter to advproxy
>>>
>>>
>>
>>
>

Duh...

FYI, we need to put this into banish:

www-f.facebook.com

I don't know wtf www-f is, but hey, it works. Banish can shut facebook down
completely. :D
---
You don't need a reason to help people.
http://bloggingwithsuccess.net


On Fri, Apr 17, 2009 at 6:08 PM, Fransiska Ike <blackzero85@...:

> And I am still wondering why Banish can't block Facebook by itself. This is
> the first Banish failure I've ever seen.
> ---
> You don't need a reason to help people.
> http://bloggingwithsuccess.net
>
>
> On Fri, Apr 17, 2009 at 6:06 PM, Fransiska Ike <blackzero85@...:
>
>> It's turned on already, and I am not using any database, since I use
>> custom blacklist.
>>
>> And now it's working as usual again -_-. I don't know why, but it fixed
>> itself... The only thing remaining here, is that my Update Accelerator does
>> not work. It just doesn't cache any updates.
>>
>> ---
>> You don't need a reason to help people.
>> http://bloggingwithsuccess.net
>>
>>
>> On Fri, Apr 17, 2009 at 4:50 PM, Alex Schaft <alexs@...:
>>
>>>  Check that it's still switched on at the bottom of the adv proxy page,
>>> and that social net is ticked on the url filter page. What blacklist
>>> database are you using?
>>>
>>>
>>> On 2009/04/17 11:39, Fransiska Ike wrote:
>>>
>>> That's... the problem.
>>>
>>> The URL Filter has been installed since a long time ago, but suddenly it
>>> stopped working... duh...
>>>
>>> I can't use any of its features. I am still able to utilize AdvProxy
>>> features, though.
>>> ---
>>> You don't need a reason to help people.
>>> http://bloggingwithsuccess.net
>>>
>>>
>>> On Fri, Apr 17, 2009 at 4:28 PM, Alex Schaft <alexs@...:
>>>
>>>>  On 2009/04/17 11:02, Fransiska Ike wrote:
>>>>
>>>> I've tried everything I could think of, BOT, AdvProxy etc, but no success.
>>>>
>>>> I can block Friendster at will (for example), but facebook is really a
>>>> pain... I can use global ban, it's efficient and less hassle... for me, but
>>>> not for my boss lol.
>>>>
>>>>
>>>>
>>>>  Add urlfilter to advproxy
>>>>
>>>>
>>>
>>>
>>
>

Fransiska Ike wrote:
> I've tried everything I could think of, BOT, AdvProxy etc, but no success.

If you're in a business environment, the FIRST thing you need is an 
official policy in Acceptable Use, signed off on by all employees. 
Otherwise you're just playing whack-a-mole with this months' popular 
site.  Terminating a few under performers for AUP violation makes a good 
example for the others.  I really wonder how much of the US and global 
economic recession is due to time spent surfing.  Despite its benefits, 
the Internet is the biggest productivity vampire business has ever seen.

-RW

On Sun, Apr 19, 2009 at 10:10:45AM -0400, Rob wrote:
> Fransiska Ike wrote:
>> I've tried everything I could think of, BOT, AdvProxy etc, but no success.
> 
> If you're in a business environment, the FIRST thing you need is an 
> official policy in Acceptable Use, signed off on by all employees. 

Generally that is a good idea. Otherwise everybody is left to make
assumption on what is allowed and what is not, and those assumptions
will be different.

But be aware that some people might use the Internet during their
lunch break, when you are not paying them to work. It could be a
good way to relax and come back to work refreshed, or it might be
potentially dangerous if they use VDU equipment throughout the day.

There are plenty of little programs that force you to take a break
from typing or VDU data entry. Both an AUP and Health and Safety
guidelines could also make it clear who's responsibilty that it.


> Otherwise you're just playing whack-a-mole with this months' popular 
> site.

Maybe there is a good reason why Fransiska wanted to only block
Facebook.

I would block Myspace instead, just on Health and Safety grounds.
Some of the layout and colour schemes there are truely nausea inducing.


> Terminating a few under performers for AUP violation makes a good 
> example for the others.

I suppose decimation worked for the Romans, didn't it?


Seriously, one of the best ways to reduce motivation is to sack
people for petty stuff such as using the Internet. If it is easy
for your best staff for get jobs elsewhere then they will do so,
and so having got rid of the good and the bad, you are just left
with the mediocre. There are rumours of some large corporations
that actively practise the march to mediocrity.

So if you are going to dismiss someone, please at least be honest
about why (within legal restrictions of course).


> I really wonder how much of the US and global 
> economic recession is due to time spent surfing.

Compared to the numbers traded around in the derivates, futures and
housing market, so close to zero that it you would need an electron
microscope to find it.


> Despite its benefits, 
> the Internet is the biggest productivity vampire business has ever seen.

The positive benefits of unrestricted web access are much larger
than sending a few minutes each day looking at a friend's website.

Do you remember the world before Google, Wikimedia and co? When
you had to spend hours searching through a library of books and
journals just to find out about one topic. Assuming that you even
had easy access to a library.

And remember when it used to take a few days to for you to send a
letter to a company, and for them to send it to you? Now it can
take minutes via email.

E-commerce websites mean I can get quotes on equipment from a wide
number of companies within minutes, order the same day, and have it
delivered by the morning.


I admit the benefits are higher in industries where access to
knowledge is a major factor (such as IT or science).

But for the "sit on your arse" jobs (and I've worked in a few places
like that) I think people will avoid work whenever they are not
motivated to work. Before Internet access was wide spread people
used to read newspapers (usually the sports columns), do crosswords, 
listen to the radio, stare out of the window, etc. Ever seen the UK
version of "The Office"?


ps. Did you use your company email account for this email?
Is that allowed in your company's AUP?


-- 
#---------------------------------------------------------#
|    John Edwards   Email: john@...    |
#---------------------------------------------------------#

John Edwards wrote:
>> If you're in a business environment, the FIRST thing you need is an 
>> official policy in Acceptable Use, signed off on by all employees. 
> 
> Generally that is a good idea. Otherwise everybody is left to make
> assumption on what is allowed and what is not, and those assumptions
> will be different.

It would be nice to think that everyone in a work place is an adult with 
good judgment and discipline, but unfortunately it's not the case.  I 
think it's also reasonable to grant professional office employees more 
leeway than the "grunt" workers.  But in many environments they both 
have PCs wide open to them.

> But be aware that some people might use the Internet during their
> lunch break, when you are not paying them to work. It could be a
> good way to relax and come back to work refreshed, or it might be

There are things that have no place in a work environment.  Period.  On 
or off the clock.  Porno is rampant on the 'net, and can open the 
company up to lawsuits for sexual harassment or "hostile work 
environment" lawsuits, at least in the litigious US.  We had a tool crib 
manager with hard core porn photos on his PC's desktop AND a young lady 
assistant using the same machine.  She was no angel, but the company had 
already treated her badly and coupled with the porn could have easily 
turned it into a lawsuit.

>> Terminating a few under performers for AUP violation makes a good 
>> example for the others.
> 
> I suppose decimation worked for the Romans, didn't it?
> Seriously, one of the best ways to reduce motivation is to sack
> people for petty stuff such as using the Internet. If it is easy

Yeah, it's Draconian.  I had a CEO that believed it should be wide open 
for everyone's "enrichment".  I was the MIS Manager and seeing gross 
abuse.  If I had reported the abuse, he would have been pissed at me AND 
then done a knee-jerk thing like block ALL web access.  So I sent out 
periodic emails reminding coworkers "keep it on your own time and 
content appropriate to a professional workplace."  It was also a small 
(100-ish person) company, and I didn't want to be the "a$$hole" that 
narced out anyone or forced stricter rules.  About 10% of the users 
ignored this and spent as much as half their workday (on the clock) 
surfing for porn or other complete BS.  One QC Manager who already lost 
the respect of his underlings was spending the whole afternoon, EVERY 
afternoon surfing porn.  I finally confronted him, and he was freakin' 
clueless!  "Well, I'm an adult.  I'll look at anything I want to" he 
said.  "Dude!  It's not about morality.  I look at T&A myself 
occasionally.  BUT NOT AT WORK FOUR HOURS A DAY ON THE CLOCK!"

We had an hourly guy that manned the shipping & receiving office, and 
packaged outgoing product.  He used to just have a dumb-terminal in the 
office, and when he didn't have stuff to do would sweep the area, 
inventory & order packing supplies, help with cycle counting or other 
inventory duties, etc.  The he got a PC.  Boom!  Every spare moment he 
was surfing for NASCAR garbage.  I believe in the old McDonald's 
restaurant policy:  "If you got time for leanin', you've got time for 
cleanin'."

>> I really wonder how much of the US and global 
>> economic recession is due to time spent surfing.
> 
> Compared to the numbers traded around in the derivates, futures and
> housing market, so close to zero that it you would need an electron
> microscope to find it.

Well, this company found itself in bankruptcy and dissolved a whole 
business unit.  There were many problems there, but labor costs were a 
big component;  and lots of people were pissing away 20 - 50% of their 
time web surfing.

> Do you remember the world before Google, Wikimedia and co? When
> you had to spend hours searching through a library of books and
> journals just to find out about one topic. Assuming that you even

Yup.  42 now and had dialup web access as far back as 1992.  I'm a 
Wikipedia *junkie* and while I've absorbed lots of useful info, it has 
mainly greatly improved my NTN Trivia scores at the bars  :)

> ps. Did you use your company email account for this email?
> Is that allowed in your company's AUP?

Yup.  But I'm sitting at home on a Sunday, and I'm on the IPCop list 
because I hope to implement it at the office in the next couple weeks. 
We have no AUP, but one employee who probably spends over 50% of his day 
web surfing.

-RW

John Edwards wrote:
> On Sun, Apr 19, 2009 at 10:10:45AM -0400, Rob wrote:
>   
>> Fransiska Ike wrote:
>>     
>>> I've tried everything I could think of, BOT, AdvProxy etc, but no success.
>>>       
>> If you're in a business environment, the FIRST thing you need is an 
>> official policy in Acceptable Use, signed off on by all employees. 
>>     
>
> Generally that is a good idea. Otherwise everybody is left to make
> assumption on what is allowed and what is not, and those assumptions
> will be different.
>
> But be aware that some people might use the Internet during their
> lunch break, when you are not paying them to work. It could be a
> good way to relax and come back to work refreshed, or it might be
> potentially dangerous if they use VDU equipment throughout the day.
>   
Just because they're on their lunch break doesn't mean that their 
surfing doesn't have an impact on everyone else.  If they're using some 
bandwidth intensive app/site during the time, everyone else may be 
negatively impacted while they are trying to do real work.

On Sun, Apr 19, 2009 at 03:47:55PM -0400, Haute SubZero wrote:
> John Edwards wrote:
<snip>
>> But be aware that some people might use the Internet during their
>> lunch break, when you are not paying them to work. It could be a
>> good way to relax and come back to work refreshed, or it might be
>> potentially dangerous if they use VDU equipment throughout the day.
>
> Just because they're on their lunch break doesn't mean that their  
> surfing doesn't have an impact on everyone else.  If they're using some  
> bandwidth intensive app/site during the time, everyone else may be  
> negatively impacted while they are trying to do real work.

True. But most web browsing is relatively low bandwidth these
days, compared to video/music downloads and P2P file sharing.


-- 
#---------------------------------------------------------#
|    John Edwards   Email: john@...    |
|                                                         |
| A. Because it breaks the logical sequence of discussion |
| Q. Why is top posting bad ?                             |
#---------------------------------------------------------#

John Edwards wrote:
> On Sun, Apr 19, 2009 at 03:47:55PM -0400, Haute SubZero wrote:
>   
>> John Edwards wrote:
>>     
> <snip>
>   
>>> But be aware that some people might use the Internet during their
>>> lunch break, when you are not paying them to work. It could be a
>>> good way to relax and come back to work refreshed, or it might be
>>> potentially dangerous if they use VDU equipment throughout the day.
>>>       
>> Just because they're on their lunch break doesn't mean that their  
>> surfing doesn't have an impact on everyone else.  If they're using some  
>> bandwidth intensive app/site during the time, everyone else may be  
>> negatively impacted while they are trying to do real work.
>>     
>
> True. But most web browsing is relatively low bandwidth these
> days, compared to video/music downloads and P2P file sharing.
>
>
>   
Obviously you haven't been to our office lately. :)

On Sun, Apr 19, 2009 at 02:16:39PM -0400, Rob wrote:
> John Edwards wrote:
>>> If you're in a business environment, the FIRST thing you need is an  
>>> official policy in Acceptable Use, signed off on by all employees. 
>>
>> Generally that is a good idea. Otherwise everybody is left to make
>> assumption on what is allowed and what is not, and those assumptions
>> will be different.
>
> It would be nice to think that everyone in a work place is an adult with  
> good judgment and discipline, but unfortunately it's not the case.  I  
> think it's also reasonable to grant professional office employees more  
> leeway than the "grunt" workers.  But in many environments they both  
> have PCs wide open to them.

Why leave the PCs "wide open" to people you don't trust?

You should restrict their user accounts access to your network
as well as limiting access to the Internet.


>> But be aware that some people might use the Internet during their
>> lunch break, when you are not paying them to work. It could be a
>> good way to relax and come back to work refreshed, or it might be
>
> There are things that have no place in a work environment.  Period.  On  
> or off the clock.  Porno is rampant on the 'net

That is *NOT* what I meant by "relax" and "refreshed".

<snip some increasing off topic (and off colour) anecdotes>


-- 
#---------------------------------------------------------#
|    John Edwards   Email: john@...    |
#---------------------------------------------------------#

On Sun, Apr 19, 2009 at 04:23:33PM -0400, Haute SubZero wrote:
> John Edwards wrote:
> <snip>
>> True. But most web browsing is relatively low bandwidth these
>> days, compared to video/music downloads and P2P file sharing.

> Obviously you haven't been to our office lately. :)

Well, obviously.


But seriously, most lines ADSL these days have a 10-to-1 or
20-to-1 dowload to upload ratio. And when the upload is
saturated that kills the Internet download speed as requests
and ACKs can't get through.

I've found the main causes of upload saturation are P2P (which
can be blocked or action taken with the user), outgoing emails
with large attachments (which be bandwidth throttled), or a spam
generating virus/trojan.

If you are finding that your download is regularly being max'ed
out then unless you are on a very slow line I think it is more
likely to be a video/music site such as Youtube rather than just
HTML web pages.


-- 
#---------------------------------------------------------#
|    John Edwards   Email: john@...    |
#---------------------------------------------------------#

John Edwards wrote:
> On Sun, Apr 19, 2009 at 04:23:33PM -0400, Haute SubZero wrote:
>   
>> John Edwards wrote:
>> <snip>
>>     
>>> True. But most web browsing is relatively low bandwidth these
>>> days, compared to video/music downloads and P2P file sharing.
>>>       
>
>   
>> Obviously you haven't been to our office lately. :)
>>     
>
> Well, obviously.
>
>
> But seriously, most lines ADSL these days have a 10-to-1 or
> 20-to-1 dowload to upload ratio. And when the upload is
> saturated that kills the Internet download speed as requests
> and ACKs can't get through.
>
> I've found the main causes of upload saturation are P2P (which
> can be blocked or action taken with the user), outgoing emails
> with large attachments (which be bandwidth throttled), or a spam
> generating virus/trojan.
>
> If you are finding that your download is regularly being max'ed
> out then unless you are on a very slow line I think it is more
> likely to be a video/music site such as Youtube rather than just
> HTML web pages.
>
>
>   

I wasn't aware we were restricting the conversation to DSL.  I thought 
it was a more general business use discussion, and many (most?) 
businesses of any size at least in this area are running of something 
more substantial and usually symmetrical.  We happen to be on a 3Mb/s 
multiple T1 configuration for now.  That's changing shortly, in great 
part because of the same issues being discussed here.  Management's 
distaste for restricting access means that everyone is doing whatever 
that want whenever they want and it is impacting other business 
functionality.

Yes, youtube, etc., are primary culprits, but since generic 'browsing' 
quite frequently winds up with links to any number of these sites it is 
hard for me to say that general surfing isn't a problem.  It really is 
harder to segregate than it might appear on the surface.

First of all, thank you folks for setting up a discussion for my issue. I
really appreciate it.

Well, the problem lies there on their surfing behaviour. When they use
Facebook, they will usually spend a hour chatting, gossiping, playing games
on that site. If they do that after office hours, I don't complain. If they
do on office hours, where's the productivity then? I won't touch news sites
like Detik (my local site) or Search Engines like Google, but a distraction
like Facebook is a big no, including a bandwith killer like Youtube and
Friendster (Facebook is also being one).

I don't know why Facebook is so addicting, since I don't have any account
there, but this issue has reached my CEO ears and so I need to do something
fast.

I even allow Yahoo Messenger, MSN, Trillian etc -without webcam/streaming-
to run here on my office. I think I am generous enough to allow people to
chat with their friends on an office hour, but they take my generousity
falsely. AUP doesn't exist formally on my company though, just an
oral/written warning for the offender on the past.

On a side note, bandwith is expensive here in Indonesia although I am using
unlimited package (US$ 70/month). My download speed is around 300kbps (on a
peak hour, around noon), and 500 kbps (on an off hour, around afternoon),
while the upload rate is.... 150 kbps max. Spread it accross 35 clients and
3 servers, you'd get the picture why I want to kill Facebook on a peak hour.

Then after Facebook, Twitter and mailing list remain to be banned. :)

As for Twitter, I only need to ban it via Banish, and for the mailing
list... I think I have to delete it (email from mailing list) on my email
server before it reaches my clients' mailbox. Should be enough that way.

So far so good. After I banned Facebook completely, the bandwith usage has
been diminishing significantly. The Facebook users here are around 6 person
or so. 6 out of 35, a small number and insignificant, but the bandwith they
used excess 10% of a total daily usage. Heck, the photos posted on Facebook
are a real pain, and those users love to click from page to page just to see
their friends' photos... I don't know if the widgets (for games etc) consume
the larger amount of bandwith compared to the photos then.

People just won't (don't like to) listen a good advice. :( If they had,
there was no need for me to do this ban.
---
You don't need a reason to help people.
http://bloggingwithsuccess.net


On Mon, Apr 20, 2009 at 4:52 AM, Haute SubZero <sub0hero@...> wrote:

>  I wasn't aware we were restricting the conversation to DSL.  I thought
> it was a more general business use discussion, and many (most?)
> businesses of any size at least in this area are running of something
> more substantial and usually symmetrical.  We happen to be on a 3Mb/s
> multiple T1 configuration for now.  That's changing shortly, in great
> part because of the same issues being discussed here.  Management's
> distaste for restricting access means that everyone is doing whatever
> that want whenever they want and it is impacting other business
> functionality.
>
> Yes, youtube, etc., are primary culprits, but since generic 'browsing'
> quite frequently winds up with links to any number of these sites it is
> hard for me to say that general surfing isn't a problem.  It really is
> harder to segregate than it might appear on the surface.
>
>
>
>
> ------------------------------------------------------------------------------
> Stay on top of everything new and different, both inside and
> around Java (TM) technology - register by April 22, and save
> $200 on the JavaOne (SM) conference, June 2-5, 2009, San Francisco.
> 300 plus technical and hands-on sessions. Register today.
> Use priority code J9JMT32. http://p.sf.net/sfu/p
> _______________________________________________
> IPCop-user mailing list
> IPCop-user@...
> https://lists.sourceforge.net/lists/listinfo/ipcop-user
>