Blockpost plug-in ( AKA "Untrusted Zone")

[Dmut]

This thread is about Blockpost for Outpost v1.
If you are looking for Blockpost for Agnitum Outpost v2.x then click here.

---------------------------------------------------

ATTENTION: READ FOLLOWING README FILE VERY CAREFULLY BEFORE USING BLOCKPOST PLUGIN

Blockpost plug-in ( AKA "Restricted Zone")

THIS SOFTWARE BELONG TO ME AND OFFICIALLY UNSUPPORTED BY AGNITUM.

If you have a question regarding that plug-in, please post it on Official Agnitum Forum in Plug-in Developers area.

This plug-in provided "Restricted Zone" feature, i.e. every IP-packet and every higher protocols packet: ICMP, TCP, UDP, HTTP, etc. from or to IP address in "Restricted Zone" list would be dropped/rejected.

This plug-in has maximum possible priority in OP packet processing algorithm, that's means: higher than "Trusted application", "Trusted Zone", etc. No one from your application, including operation system, could be able to send or receive any IP data and higher from or to host included in "Restricted Zone".

How to install:
1) Shutdown your outpost, paranoids may also plug off network/modem cable before shutdown OP.
2) Run "Blockpost.exe" and follow instructions.
3) Load Agnitum Outpost manually or restart operation system to load it automatically.
4) When Blockpost has been installed successfully, you will see new plug-in in outpost's left panel.
IMPORTANT: install will overwrite all blockpost plugin files, including your own customized blockpost.lst

How to uninstall:
1) Click "Start/Programs/Agnitum/Blockpost plug-in uninstall" or use Windows "Add/Remove Programs" applet.
IMPORTANT: uninstall will delete all blockpost plugin files, including your own customized blockpost.lst

Known issues and limitations:

- When OP going to shutdown, plug-in store it's configuration saving all list of "Untrusted IP's" to "blockpost.lst", every time erasing and creating that file again, so any manual changes to that file when plug-in is loaded will be discarded.

- Plug-in log window store only 30 last events and did not save events on the disk. This is my own way to fix Oupost logger engine problem.

- Some of blocked packets are appear in OP "Allowed" log, do not worry, that's GUI bug, and those packets are really blocked.

- When plug-in properties displayed, button "Cancel" do the same as "OK", i.e. it confirm new configuration.

Sources included. Project files compatible with MS VS 6.0 and MS VS .NET ( VC++ 7.0 )

Feedback and bug reports are strongly appreciated, please use this forum http://www.agnitum.com/forum/forumdi...?s=&forumid=56

Look at the latest post in this thread TO DOWNLOAD BLOCKPOST

You may look at pages, created by Stephen (RISC OS)(thank you friend ) here, very usefull guide about Outpost and plugins, including third-party plugins.

[Dmut]

new version
History of changes:

02.04.2002
+Block list maximum records number increased to 5000, cashing algorythm implemented
+Now symbolic host name in "blockpost.lst" resolving to all IP addresses.

[Dmut]

Good news!
To install plug-in on W98/ME box, just ignore step (3) about inst.bat.
I tested it, everything fine. Thanks to Mikhail and Anatoly from Agnitum.

[Dmut]

New version:
History of changes:
08.04.2002
+Some errors fixed in "plug-in properties" dialog

[Dmut]

13.04.2002
+Some errors fixed with invalid IP-addresses handling, code optimized
+maximum numbers of blocking IP increased to 20000

[Dmut]

25.05.2002
+bug with "gethostbyname" under w9x/me fixed (Thanks to muchod)

Following bugs are not fixed yet:
1) Viewing plug-ins properties via toolbar icon or "options/plug-ins setup/setting" menu is crashing OP, use
right-click on plug-in name to open submenu, than select "properties".
2) Some of blocked packets are still showing in OP "Allowed" log, do not worry, it's really blocked.
3) Log window is not updating in real-time. To see changes, click to another OP log window, then to plug-in log again.
window.
4) 2nd column name in log window is not displayed.

[Dmut]

20.06.2002
+fully automatic setup with uninstall feature, created on NSIS engine
Thanks goes to muchod, Lithp, RISC OS for testing and tips

IMPORTANT: after installation please read "...\Outpost Firewall 1.0\Plugins\Blockpost\readme.txt" "

[Dmut]

2002.07.10 version 0.2
changes, (+) new feature, (!) bug fix:

+subnet mask support
example: 192.168.0.0/255.255.255.0 will block 192.168.0.0-192.168.0.255
small explanation, how it works for those, who understand C lang:
if (( packet_IP & subnet_mask )==( block_IP & subnet_mask ))
block_packet();

+new very flexible IP's list format, import from old format supported as well.
Address line format:

1. IP[/subnet],host[#comment] - without spaces, except in comment field
2. IP[/subnet][#comment] - without spaces, except in comment field
3. host[#comment] - without spaces, except in comment field

Remarks:

1. when saving blockpost.lst, plugin storing all lines in (A) format
2. one line in (B) format produce one line in (A) format
3. one line in (C) format could produce many lines in (A) format
4. lines in (C) format are re-resolved when plugin starting
5. when plugin found two lines in (A) fomat with the same IP/subnet, it will load only first one.

Examples:

1. www.yahoo.com#this is comment
2. 192.168.0.1,test_host
3. 192.168.0.0/255.255.255.240#blocking from 192.168.0.1 to 192.168.0.15
4. 64.58.76.176,www.yahoo.com#test

+manual rebuild function - plugin will re-resolve all hosts in list and add their IPs.
!warning: extremely slow feature - it's makes many DNS requests.
about 5-10 seconds for EVERY line, 1 day for 10000 entries host list
prepare yourself for a cup or two of coffee ;-)
rolling character in status bar will indicate plugin progress

+import list from text file, blockpost.lst format

+export list to text file, blockpost.lst format

+new user interface - multiple selection, hot-key bindings.

+search function, specify pattern in address line,
search starts from next focused item in list, so if you want to search again, just hit "FIND" or Alt-F
if search success, item will be showed as focused.

+edit fuction - use right-click on list item - it's will appears in address line in (A) format
!attention: when editing host name or comment - delete old item before inserting new one,
because plugin check for IP/subnet dublication.

+log format improved, host name and comments columns added.

! OP crash when plugin properties displayed fixed, columns names in blockpost log displayed correctly, real-time log update working fine, thanks to David AKA Muchod, who found that recompiling plugin under VC6 fix all those issues.

! Uninstall script fixed

! Kernel plug-in small error fixed

You may want to use free great application designed to do resolving job - NS Batch, for preparing block lists.
See examples of such lists here, thanks RISC OS

Look at cool screenshot of new version

after installation please read readme.txt and history.txt from "...\Outpost Firewall 1.0\Plugins\Blockpost\"

[Dmut]

07.08.2002

• max hosts number increased to 40000
• "current number of hosts / max number of hosts" indicator
• speed improved (a little)
• sorting feature (case incensitive ) in "untrusted hosts" list:
  first click on header will sort in ascending order
  second click on header will sort in descending order
• right button double click select all items in list
• uninstall script fixed

Blockpost's configuration lists available here. Thanks to Stephen ( RISC OS )

[Dmut]

08.08.2002

• Critical error in 2002_08_07 version fixed, thanks to Jack Benny, RISC OS

DOWNLOAD BLOCKPOST

[Dmut]

if someone here using Secuties Personal Firewall ( it's OP licenced clone for german market ), here is Blockpost for Secuties FW.
PS: it's exact 08.08.2002 version with different installation script and it will not work with original Agnitum Outpost.
DOWNLOAD BLOCKPOST FOR SECUTIES FIREWALL

[Dmut]

Here is another IP's list for blockpost from user Nick_R:

If you would like to avoid having companies like RIAA to detect you when sharing or using P2P programs, just import this list into the Blockpost plug-in.

http://www.outpostfirewall.com/forum...?threadid=6120

[Dmut]

Here is my NSI (NullSoft Installation System) script for installing blockpost. It can be easily adapted to installing any plugin for OP v1. Use it carefully and first of all please read NSIS manual pages and don't ask me a qustions "why it's not working". This script ( with small modifications, of course, I used to create installation for Blockpost, SuperStealth and Muchod used for his HTTPLog plugin.