Access List (ACL) to Block Russian and Chinese Nets From Routers

I see people asking if there are premade ACL's to block Chinese and Russian nets from their edge routers. Since I spent so much time creating entries for them based on information received from http://www.ipdeny.com/ipblocks/ i decided to share them. They are in the attached Word Docs.
There are alot of entires but since it is in a standard ACL it should not tax your routers too greatly.
Sean Odom
Sybex/Wiley Cisco Author

Well, I'd rather not tax the IPS even further for something that the edge router should be capable taking care of. Especially since the source of the traffic should be denied at the closest managed point.
If you do not want this traffic coming inbound, closest for some would be the edge router. Others may only have their firewall as the closest manageable point.
Suggestion to those that do not manage their edge router would be to compile a list such as the one listed above. Then send it to your provider requesting they place it on this router. Of course this may become a double edge sword in a sense. If there is legit traffic from one of these source IP addresses that you identify down the road, it might be a hassle to get the block resolved.
Or, you can also apply these right there on your firewall as well.
Thank you for providing this list!

Similar Messages

Layout in Arabic, Russian and Chinese. Exporting text from a PDF

I am laying out long documents in Arabic, Russian and Chinese. The text has been provided as a PDF when I copy and paste this into Indesign it comes up as boxes question marks and other characters having nothing to do with the text I am trying to layout. I have set the typeface to the Myriad Arabic and the Arabic dictionary still nothing resembling Arabic or any language for that matter. Same with Chinese and Russian. Any suggestions on how to get the text in from the PDF where it is the actual language. Appreciate any help with this. Thank you.

Thanks for the callout, Ellis
Soooo, KK: you are in for a world of hurt. The intials "WP" at the beginning of these fonts means that the text came out of WordPerfect. Doing multilingual layouts in WP was annoying, but possible. It was developed in the pre-Unicode world where every single method of complex-script layout was a dirty hack. If you like knowing All of the Nerdy Dirty Details, I can tell you how it worked, but suffice it to say that trying to harvest non-Latin-script text from WP and repurpose it for use in InDesign is just pure pain. The WordPerfect-specific codepages were never really supported anywhere outside of WP.
That being said, I have a script laying around somewhere for conversion of WP-Cyrillic into Unicode. (Actually, I think it does Windows CP 1251, but that works just as well.) But that is only one out of forty-five languages? And the Chinese has been rasterized? And the PDFs were originally generated by Distiller 3? If you have any choice, it's time to walk away. If you don't have any choice, I really hope you are billing hourly. My experience in this area (painfully extensive) is that it will cost three to five times as much to extract the text as it would to have a translation professional rekey the text, and then to have a second translation professional review the rekeyed text looking for typos.
Russian OCR is pretty damn good these days, but Chinese OCR is hit-or-miss. I have never seen good Arabic OCR - doesn't mean it's not out there, but I couldn't help you find it. But chances that all 45 languages have reliable OCR available, and that the result of said OCRing will not need to be reviewed by someone who knows the language, are basically nil.

Using SQL*Loader to Load Russian and Chinese Characters

We are testing our new 11.2.0.1 database using Oracle Linux 6. We created the database using the AL32UTF8 NLS Character set. We have tried using sqlldr to insert a few records that contain Russian and Chinese characters as a test. We can not seem to get them into the database in the correct format. For example, we can see the correct characters in the file we are trying to load on the Linux server, but once we load them into a table in the database, some of the characters are not displayed correctly (using SQL*Developer to select them out).
We can set the values within a column on the table by inserting them into the table and then select them out and they are correect, so it appears the problem is not in the database, but in the way sqlldr inserts them. We have tried several settings on the Linux server to set the NLS_LANG environment to AMERICAN_AMERICA.AL32UTF8, AMERICAN_AMERICA.UTF8, etc. without success.
Can someone provide us with any guidance on this? Would really appreciate any advice as to what we are not getting here.
Thanks!!

The characterset of the database does not change the language used in your input data file. The character set of the datafile can be set up by using the NLS_LANG parameter or by specifying a SQL*Loader CHARACTERSET parameter. I suggest to move this question to the appropriate forum: Export/Import/SQL Loader & External Tables for closer topic alignment.

Russian and Chinese Flash movies - general advice needed please

Hi all -
This is a plea for some general 'jumping off' advice. I am an experienced Flash developer but now have a request to convert an existing xml-fed movie into both Russian and Chinese. I speak neither of these languages so we have had the content of the movie translated by a professional translation service.
The movie contains both png/jpgs with embedded text - created in Fireworks and also (for the bulk of the content) external xml files. I still need to be able to develop in an English environment - so purchasing a full version of Flash/Fireworks in Russian/Chinese would be folly. How should I go about this? If it is a matter of fonts - where should I get them from? And are there any considerations to be met with regards the xml files? Basically, I would really appreciate some general advice on this subject as it is completely new ground for me.
Much obliged,
Hugh

Thank you. Having the airports all in proximity was the key and, of course, I eventually found the same advice in an apple help file. I set the new AExtreme up as WDS main with an ethernet disk for backups and music. An old AExtreme as WDS remote serves the Cube by ethernet and a usb printer. An AExpress as WDS remote serves one stereo. The other AExpress is WDS relay serving another stereo and helping the network reach the office where the last old AExtreme is WDS remote with another USB printer. The 3 mac laptops are happy. I have yet to try any PCs.

Block japanese and chinese characters in a string

Hi,
I need to check a string whether it contains only Alphabets, Numbers and special characters. Requirement is to block Japanese and chinese characters . If possible let the know the logic through which this can be achieved.
Your assitance will be appreciated.
Thks in advance

Hi.
If sy-langu NE 'JA' or sy-langu NE 'ZH'.
Write your logic here as per your requirement.
Endif.
Regards.
Jay
Edited by: Jay on Jan 6, 2009 5:47 AM

Process blocked sales and distribution documents from the SAPoffice inbox

Hi,
I know VKM1/VKM3 can be used to release order.
And SAP help shows we can process blocked sales and distribution documents from the SAPoffice inbox. Could anyone tell me how?
I can use output type KRML to send a mail to SAPoffice inbox, but don't know how to release blocked sales orders in the SAPoffice inbox.
Many Thanks
Jean

Hello Jean,
Release the blocked document directly via mail received:
- After carry out the step 4 in note 677377, you will be able to
release the blocked document directly by:
Display the SAP office mail recieved;
Menu: Document -> Execute;
Then you will be redirected to transaction vkm3, with the blocked
document number defaulted on that screen;
Unfortunately, it is not possible to direct your mails to Outlook
and release the document from VKM3.
Best regards,
Lela

Virtual telnet/downloadable access lists: acl authorization denied error

Hello,
has someone else experienced the same "issue" as described below ? And can someone (Cisco ?) tell whether this is by design, and if so, what the reasoning is behind this ?
We use virtual telnet for user authentication, when users need to pass traffic through a PIX, and use downloadable access-lists after successful authentication.
When a user authenticates himself, an error message appears in the virtual telnet window: "error: acl authorization denied".
And the PIX log shows:
109005: Authentication succeeded for user 'user1' from <workstation-IP>/2066 to <virtual-telnet-IP>/23 on interface inside
109015: Authorization denied (acl=#ACSACL#-IP-PIX_ACL-421492f3) for user 'user1' from <workstation-IP>/2066 to <virtual-telnet-IP>/23 on interface inside
This error message disappears when we add telnet access for the virtual telnet-IP@ in the downloadable access-list on the Cisco ACS. I could not find any reference to this configuration quirk in any document.
Now, with or without the error, the user can use virtual telnet and everything permitted
in the downloadable acl without any problem (so why post an error message then ?).
thanks

Try to disable authorization and see if this error stops

Downloadable Access-list (ACL) on 440x/WiSM

I need a wireless solution where an Access-list is downloaded / refered to on a per-user or per-group basis in order to do filtering.
Does unified wireless (aka airespace) support this.
To make it worse - is it support while using H-REAP AP's.
TIA.
Anders

You can configure ACS 4.0 to return an ACL name after the user authenticates, and ensure that the ACS also returns the Tunnel Type attributes which tell which VLAN to use.

Fed up with blocked emails and blacklisted IPs from Verizon

Have been struggling with blocked emails and getting no help from Verizon. When sending emails via Outlook, most are rejected whether we create them or just forward them. Sometimes we get a spam notice, but most of the time they just disappear. Have contacted Verizon support and they have changed the outgoing port number with no improvement. They blame the signature block we attach to emails, but removing doesn't seem to improve anything. They say we can't contact the spam people except by email, but that doesn't seem to get any response. Meanwhile, the IPs that Verizon assigns us are on the blacklist. Verizon says this has nothing to do with the problem, but I have to think that it does. Would appreciate some help!

Verizon doesn't control the blacklist at Spamhaus. The outbound spam filter has been implemented along with other measures as part of an effort to prevent that type of block for Verizon IP addresses, but until spammers are wiped from the planet, blacklisting is going to happen.
To get off of the list, you have 2 options:
Appeal to Spamhaus to remove your IP here. Since you have a dynamic IP address, you will have to do this every time you get a blacklisted IP.
-OR-
You can get a static IP address from Verizon. This is the best solution for most businesses.
If a forum member gives an answer you like, give them the Kudos they deserve. If a member gives you the answer to your question, mark the answer as Accepted Solution so others can see the solution to the problem.
"All knowledge is worth having."

Can you block contacts and/or numbers from your phone?

Is there a way to block callers and /or block someone's texting?

this is a work around, but so far it works...
download a silent ring tone, import it to I Tunes and sync it to your phone. I found one online by searching for silent ringtone
pick a number you want to block (in my case it was a telemarketer) and add them into your contacts as UNWANTED CALLER.
set the ring tone to SILENT RING TONE, vibration notice to NONE
you can also set the text tone to none and vibration to NONE
now you can add other numbers to the same contact when they call just add to existing contact, choose UNWANTED CALLER and save it.
This does not keep them from being able to call, but your phone does not notify you when they are calling.
Good Luck!
Tv Engineering

My iPhone was stolen and I need to access my information including contacts, texts and camera roll from icloud urgently via my desktop computer...how do I do this?

I am not able to figure out how to access this information from my desktop, is this possilbe?
Thanks

Was your iPhone or iPad stolen? You posted in the iPad forum.
These links may be helpful.
How to Track and Report Stolen iPad
http://www.ipadastic.com/tutorials/how-to-track-and-report-stolen-ipad
Reporting a lost or stolen Apple product
http://support.apple.com/kb/ht2526
Report Stolen iPad Tips and iPad Theft Prevention
http://www.stolen-property.com/report-stolen-ipad.php
How to Find a Stolen iPad
http://www.ehow.com/how_7586429_stolen-ipad.html
Oops! iForgot My New iPad On the Plane; Now What?
http://online.wsj.com/article/SB10001424052702303459004577362194012634000.html
 Cheers, Tom

Always Access Denied when choosing Automatically Enrol and Retrieve Certificates from MMC

I am using 2008 R2 Certificate Services to issue certs across multiple forests (although don't let that muddy the waters).
I have a need to issue certificates for use with s/ldap, so I have duplicated the Kerberos cert and removed all Intended Purposes other than Server Authentication and configured appropriate security to allow Domain Controllers/Domain Admins to enrol.
The certificate also requires CA Manager Approval.
Everything looks good - I am able to enrol for the cert via the MMC, the request goes into pending, and I am then able to issue the cert. However, when I go back into the MMC on the Server that requested the cert and choose All Tasks | Automatically
Enrol and Retrieve Certificates, I choose the pending cert and then get Access Denied.
On the issuing Server, I get an Event 21 in the App Log:
Active Directory Certificate Services could not process request 8466 due to an error: Access is denied. 0x80070005 (WIN32: 5). The request was for CN=server.domain.com.
On the Server that requested the cert, I get an Event 9:
Certificate enrollment for Local system was denied by servername\Issuing CA when retrieving the pending request for a SecureLDAPCertificate certificate with request ID 8466.
The strange thing is, if I follow this procedure but using the certsrv website, it works fine and I can install the certificate.
What am I missing? Or is this one of those random quirks of AD CS?
Any help is appreciated.

Hi,
Thanks for posting in Microsoft TechNet forums.
According to the error messages you provided, this can be a permission issue.
The method of Autoenrollment for a certificate depends on an Active Directory. Considering using Certsrv website was successful, the problem can be that the requester does not have enough permission to access the certificate template in Active Directory
To autoenroll a certificate template, a user or computer must belong to a security group that is assigned the read,enroll,and autoenroll permissions.
Only groups that are assigned these permissions are enabled for autoenrollment.
Could you please answer the following questions for us so that we can troubleshoot the issue more effectively?
Are the issuing CA server and the requesting CA in the same forest/domain?
regards
Ted

Access-list block range of hosts

cisco 2600 router with wic1-adsl card
I'm having difficulty creating an access-list that will block a range of specified internet ip's but allow evrything else. Google finds loads of acl's showing how to permit a range but nothing about how to deny.
In the past I've been able to deny a host using:
access-list 105 deny   ip any host A.B.C.D. but that only blocks one host and not a range (unless you have loads of entries)
My reason for this is to block baiduspider.com from accessing my server. Baidu uses a large range of ip's but so far they're confined to 123.125.*.*, 61.135.*.* and 220.181.*.*
I tried:
access-list 10 deny   123.125.0.0 0.0.0.255
access-list 10 deny   220.181.0.0 0.0.0.255
access-list 10 deny   61.135.0.0 0.0.0.255
access-list 10 permit any
all web traffic comes via the adsl-wic card in the router so I put:
ip access-group 10 out
into the dialer0 config but this didn't work.
thanks for any help.

it looks like I've done it. I was using the wrong subnet mask.
I changed the access list to:
access-list 10 deny   A.B.0.0    0.0.255.255 and from that moment baidu disappeared from the web log.

We can figure this standard access list

We can figure this standard access list that's important remember that we use a standard access list want to block all traffic or permit all traffic from a particular
source or destination let's take a look at this machine right here that is IP address say
640-554 we want to stop him from going into the Ethernet interface I'm the ad man he made me midsummer block callers traffic he can get out anymore maybe this is even the internet out
here we know people like their Internet access so to get back at them I'm a block it what I can do is I can use deny statement in my access list access list
one did not .
http://640-554cisco.com/

Hi Suresh,
ad 1) according to the documentation ( http://docs.oracle.com/cd/E28280_01/doc.1111/e26692/securityacls.htm#BEIIHJAH )
"At least one of the following must be true for a user to be granted a particular permission:
The user's name appears in the xClbraUserList metadata field with the appropriate permission.
The user belongs to a group that appears in the xClbraAliasList metadata field with the appropriate permission.
The user is part of an Enterprise role that appears in the xClbraRoleList metadata field with the appropriate permission."
meaning that OOTB a user will be granted both Read permission as per user-granted permissions and RWD as per group-granted permissions (resulting into RWD because at the same level a union operation is used).
I'd say that conceptually, the group assignment should not be used in your use-case, because you don't want to assign permissions to group's users, do you? You could create new groups, or use assignment of permissions per user.
ad 2) check this: http://docs.oracle.com/cd/E28280_01/doc.1111/e26692/securityacls.htm#BEIIDCGD
Using ACLs, regardless User or Group Access Lists, always impacts the performance. And, it is difficult to maintain. From the information at the link you may understand how it is implemented - basically, the execution of the query will be affected by: a) how many items have to be evaluated b) the length of strings (xClbraUserList, xClbraAliasList) to be evaluated.

Access List - cisco 2600- HELP

Hi,
i want ask we, if the access list are bi-directional or it are one-directional?
If i want negate "LAN A" (eth1) to go in "LAB B" (eth0) which acl i must use and then "LAN B" can go to "LAN A"?
Thanks

Emanuele
When applied on an interface access lists are uni-directional. You can apply an access list inbound on the interface and apply an access list outbound on the interface if you want a bi-directional effect.
I am not sure that I understand what you are trying to accomplish. I think that I understand that you do not want LAN A to send to LAN B. I am not clear if you want LAN B to be able to send to LAN A, which it sort of sounds like. The problem with this is how to differentiate something coming from LAN A to LAN B which is a response to something that originated from LAN B versus something originated from LAN A. For TCP connections you can use the established concept in the access list, but there is not a good way to handle UDP, ICMP, etc.
If you do not want either subnet to communicate with the other then I suggest that you write 2 access lists. The first access list would deny traffic with a source in LAN A and a destination in LAN B and would permit other traffic. This access list would be applied outbound on LAN A interface. The second access list would deny traffic with a source in LAN B and a destination in LAN A and would permit other traffic. This access list would be applied outbound on LAN B interface. If you do this I do not see a need for an inbound filter on either interface.
If I have not understood your question correctly please clarify what you are attempting to accomplish.
HTH
Rick

Access List (ACL) to Block Russian and Chinese Nets From Routers

Similar Messages

Maybe you are looking for