QQ plugging solution on vroqq

Since not all LAN connection methods are proxy (in fact, almost a slightly larger LAN is not a proxy, it is quite necessary to find a set of router-side control methods. Many organizations (such as US) use lower-level routers to connect networks in different CIDR blocks. The number of restriction rules allowed by SOHO routers is not large.

The following is my own solution. The basic idea is: 1. Common port blocking; 2. Key Server IP address blocking; 3. Combination of inbound and outbound data blocking.

The current operation proves that no one can break through this blocking.

1. Domain Name Filtering;

All incoming and outgoing data packets containing the following domain names are discarded:

QQ. com tencent. COM

Ii. packet filtering;

Outbound filtering: (use eight rules)

1. All packets sent from UDP4001-4009 ports of all Intranet IP addresses are discarded.

2. All packets sent from Port 8000 of All Intranet IP addresses are discarded.

3. All packets whose destination IP address is 218.18.95.220 are discarded.

4. All packets whose destination IP address is 61.144.238.145 are discarded.
　
5. All packets whose destination IP address is 61.141.194.227 are discarded.

6. All packets whose destination IP address is 218.17.209.23 are discarded.

7. All packets whose destination IP address is 218.18.95.153 are discarded.

8. All packets whose destination IP address is 218.18.75.171 are discarded.

Inbound filter: (use 6 rules)

1. All packets sent from the outside to the internal network with the destination port as the UDP4000-4009 are discarded.

2. All packets sent from outside to the internal network with the target port 433 are discarded.

3. All packets sent from the external network to the destination port UDP8000 in the internal network are discarded.

4. All packets sent from 218.18.95.220 (port 80) to the Intranet port 80 are discarded.

5. All packets sent from 218.18.95.220 (port 443) to intranet port 443 are discarded.

Article entry: csh responsible editor: csh