Adult site blocking

[b***@hotmail.com]

OK, so I had an experience with censorship - someone was trying to go to a particular porn site, and it said "The governent has blocked this page" or whatever. I'd like to know how this is pulled off - the router in the middle didn't only block the HTTP request, but also - *answered* it, saying that the site was blocked!! I thought routers were low level TCP/IP beasts, how are they answering HTTP requests? Or am I barking up the wrong tree? Did it get the text "The government" blah blah from a _server_ somewhere? How?


Thanks.

[Jorgen Grahn]

Post by b***@hotmail.com
OK, so I had an experience with censorship - someone was trying to
go to a particular porn site, and it said "The governent has blocked
this page" or whatever. I'd like to know how this is pulled off -
the router in the middle didn't only block the HTTP request, but
also - *answered* it, saying that the site was blocked!! I thought
routers were low level TCP/IP beasts, how are they answering HTTP
requests? Or am I barking up the wrong tree? Did it get the text
"The government" blah blah from a _server_ somewhere? How?

There is this: https://en.wikipedia.org/wiki/Deep_packet_inspection

But perhaps the DNS system had simply been subverted, so your browser
was not even /trying/ to talk to the right server.

/Jorgen

[Lew Pitcher]

On Sunday December 20 2015 12:56, in

Post by b***@hotmail.com
OK, so I had an experience with censorship - someone was trying to go to a
particular porn site, and it said "The governent has blocked this page" or
whatever. I'd like to know how this is pulled off - the router in the middle
didn't only block the HTTP request, but also - *answered* it, saying that
the site was blocked!! I thought routers were low level TCP/IP beasts, how
are they answering HTTP requests? Or am I barking up the wrong tree? Did it
get the text "The government" blah blah from a _server_ somewhere? How?

There are all sorts of ways. Here are a few:

A1) "The government" "confiscates" the porn site's domain name, and
substitutes their own, captive, IP address. User's web browser
requests 'porn.porn', and gets a government website that provides
the "blocked" notice. This is how the FBI (for instance) "confiscates"
websites.

A2) The user's DNS provider lies (for whatever reason) and substitutes their
own, captive, IP address. User's web browser requests 'porn.porn', and gets
an ISP website that provides the "blocked" notice.

B) The user's ISP implements a proxy web server and directs the user's HTTP
requests to/through it. The proxy web server detects a request for a "banned"
site, intercepts it and replies to the user with a canned "blocked" webpage.

C) Some network provider along the route performs "deep packet inspection",
and intercepts requests to a "banned" site. Instead of passing those packets
along the network, the network provider responds in kind with a
canned "blocked" webpage.

[b***@hotmail.com]

Post by Lew Pitcher
B) The user's ISP implements a proxy web server and directs the user's HTTP
requests to/through it. The proxy web server detects a request for a "banned"
site, intercepts it and replies to the user with a canned "blocked" webpage.

Is this what they call an "intercepting proxy"? How does this work? It's completely transparent to the browser, right? - it doesn't know the original web server is not what it's talking to....?

[Char Jackson]

Post by b***@hotmail.com

Post by Lew Pitcher
B) The user's ISP implements a proxy web server and directs the user's HTTP
requests to/through it. The proxy web server detects a request for a "banned"
site, intercepts it and replies to the user with a canned "blocked" webpage.

Is this what they call an "intercepting proxy"? How does this work? It's completely transparent to the browser, right? - it doesn't know the original web server is not what it's talking to....?

Transparent proxy is the term I've heard most often.
https://www.google.com/search?q=transparent+proxy

It works because it has been placed in the network path between the client
and the server. In other words, the client doesn't talk *to* the proxy; it
talks *through* it. It's transparent (invisible) to the client, and
optionally to the server, as well.