How to block all servers of a service? For example, you want to block all of roblox, as roblox has a different server for its website and for its various games, etc.When I run ping www.roblox.com, I get:
Save the document, then close. Access to the domain www.roblox.com will be routed to the IP address 0.0.0.0, which doesn't exist. Incidentally, this is the method used by Spybot Anti-Beacon, the anti-Windows-10-surveillance tool.
Even just creating the default rules under Executable and Windows Installer will stop most of your problems in their tracks. They disallow running from the Appdata folder (probably how your users are getting around the limitations of a standard user).
The OS is windows 11, and I teach a class and host esports using the same computers. I have full local admin control, but lack any filtering hardware, policies, etc. There is some filtering already on the network for social media platforms, but otherwise gaming was left unchecked.
Also, you need not create explicit deny rules. AppLocker takes a whitelisting approach and if anything you will need to create a few rules to allow some things (legit software that runs in APPDATA for instance).
Hello Pi Hole Community,
I "successfully" installed Pi Hole a few days ago, it also kinda works now but it doesn't block the Roblox site.
I blocked both roblox.com and rbxcdn.com with both wildcards in it.
We're having difficulty connecting to a VPN as soon the machine is on the other side of a router, and I was wondering if this might help? So I'm pretty keen to hear a proper description of what "Edge Traversal" does!
From what I can gather, this flag allows firewall rules to apply to traffic that has been encapsulated by, for example, an IPv6 to IPv4 tunnel originating outside the border of the network. As patents often are, this one is written in such a generic manner as to apply to any different type of tunneling protocol, from what I can tell.
The payload of this encapsulated traffic would be opaque to the any firewall at the network on the other end of the tunnel. Presumably, these encapsulated packets would be passed through unfiltered to the internal host where the other end of the tunnel terminated. That host would receive the traffic, pass it through its own firewall, decapsulate the traffic (if allowed by its own firewall), and pass the decapsulated packets back its firewall. When the packet travels thru the firewall the second time (after decapsulation), it has an "this packet traversed the network edge" bit set such that only rules with the "edge traversal" bit also set will apply to the packet.
This basically permits a host-based firewall to have different rules for traffic that came in via a tunnel thru the local network's firewall, as opposed to traffic that was just sent unencapsulated by a tunnel directly through the local network's firewall.
I wonder if the iptables "mark" functionality would be prior art to this patent? It certainly seems like it does a very similiar thing, albeit in an even more generic fashion (since you can write user-land code to "mark" packets for virtually any reason if you want to ).
An older post, but still worth adding to. It seems that in Windows Server 2012, this item simply means "allow packets from other subnets". At least that is the behavior I have observed. We have two offices connected with an IPSec VPN. The VPN connects the two routers, so as far as the Windows computers are concerned, it's simply traffic between two different private subnets. With the setting "Block Edge Traversal" Windows will not allow connections from the other subnet.
The Edge Traversal option controls whether unsolicited traffic from Teredo (and maybe other tunneling software) is allowed. The documentation for IPV6_PROTECTION_LEVEL socket option explains this: -us/windows/win32/winsock/ipv6-protection-level
Whenever you try to visit a website classified as unsafe, the website is blocked and a warning is displayed in your browser. The warning contains information such as the page URL and the detected threat.
This option is available on Mac and Windows computers. Some websites can be dangerous, so only sites that you fully trust should be added to this list. To add a safe website to the Exceptions list, select one of the following:
I have been getting intrusion attempts "zyxel command injection cve-2023-28771" for the last week that Norton has been blocking. I'm not using any zyxel products. How do I stop these attacks from continuing? They are becoming more frequent.
Thanks for your informative reply. These attacks started out daily about a week ago but they are getting more frequent for me. Yesterday, I got 2 and today I already got 3. I have since blocked the IPs that they are coming from but from reading your post, it is just a temporary solution.
I also do not have any Zyxel products and have found the same information you have while looking for help online. I don't even have a router. Just a modem that I use to connect online. I think it would be a good idea for you to update your router's firmware, even though it isn't a Zyxel.
To the poster who told me there's nothing I can do and since Norton is blocking the intrusion attempts, I have nothing to worry about, I have to disagree with you. About 5 years ago I experienced something similar. I was getting a virus attack that became more and more persistent. Norton was blocking them all but it was using so much of my computer's resources that my computer became so slow that it was unusable. I ended up having to get a new PC.
@TinaH @skeeterj ebersole This command injection issue will come from a "botnet" where the sender will have the ability to use different IP addresses that have already been compromised. Below I linked the issues that were patched yesterday with the MS June release. There are tons of related issues this botnet could be looking for to exploit. Have you guys patched? Please review:
Can either of you provide and post a screenshot from your Norton history where this is blocked? Make sure you select "more options" in the right hand details area and get that screenshot for us to review. Here is how to post a screenshot:
One of the first things I did when I started getting these attacks was contact my ISP technical support. I thought that since I'm not even using a router, just a modem that they provide for me, that the modem might be the culprit. The person I spoke with assured me that that's not how a modem works and they don't use anything Zyxel on their network. He said the problem was with the PC and they couldn't help me with that.
Your question about whether there was any Zyxel software that was installed in the past and has since been removed on my PC makes me wonder. My PC is an off-lease refurbished one that I bought from a local computer shop. I've had it for 5 years and never had any problems with it until now. How would I find out what was installed in the past but has since been removed? I'm afraid I'm not very tech savvy.
Your ISP may have given you the old snowball answer about the modem they provide you with. Can you tell us what the manufacturer of your modem is and what model it is? That information should be on the router itself and visible. I would like to look up a few things to possible determine if your modem is the actual attack vector.
As far as determining what software has been installed and removed on your devices, that is basically fishing for a needle in a haystack. Conversely, software most times leave rogue files that can be removed if done properly, it should state what the software was and used for when it is detected for removal. I often suggest using CCleaner to declutter a hard drive of files that are just taking up space and can cause issues down the road over time when left. You can get a "free trial" at the link below. Please let us know what you find so we can help further.
2. I am tempted to hit "STOP NOTIFYING ME" so I don't see these notifications every ten minutes, but then I'm concerned that I might miss an important notification about this issue. Would you select "STOP NOTIFYING ME"?
I have formatted my PC and reinstalled Windows twice (the attacks also started to happen on my brand new laptop that has Norton installed in it after I connected it to the network), called my ISP and they confirmed that they do not use Zyxel equipment and haven't noticed any malicious activity. I do not have any own router (broadband is part of rent and distributed invidually through Ethernet from central cabinet to all apartments), so I called my maintenance service as suggested by ISP and they checked and confirmed that they too do not use any Zyxel equipment and have not received yet any complaints about this type of issue and according to them there's no possibility that the attack could spread from any other apartment.
I'm personally running out of options and that makes this quite a stressful situation. Only reports online at the moment about this kind of issue are few and pretty much Norton product related, so is there a chance that this is a recent bug in a Norton product?
I sent a mail to the ISP tied to the attacking IP in Ukraine recently so hopefully they take action and the attacks will stop eventually. I'm so sick and tired of this. 20+ attacks yesterday, 20+ and counting today.
Just to add to the list, I am also experiencing these attacks from the same IP as above. Has been going on multiple times a day for the past week. It has happened to both computers in my home (one on WiFi on a router and one wired directly to my modem). I have no Zyxel products, nor does my ISP as far as I'm aware. Norton has successfully blocked the intrusion attempts on both PCs, and scans from both Norton and Malwarebytes have detected nothing on either computer. Happy to provide any additional information that may help.
Do any of you NOT have NAT transition enabled on your modem / routers firewall settings? If so enable it and reboot the modem or router. Additionally, IF your ISP does NOT require IPV6 to be enabled disable it as well.
d3342ee215