Blocking Hotspot Shield In

Blocking HOTSPOT SHIELD in Mikrotik

Filed under: Mikrotik Related — Tags: hotspot shield, hotspotshield — Syed Jahanzaib / Pinochio~:) @ 4:51 PM

5 Votes

Last Updated: 6th JANUARY, 2015 / 16:10pm

Assalam Va Alaekum, I was receiving many complains from few network operators of being annoyed by an proxy application name HOTSPOT SHIELD which you can use to create tunnel between you and the ‘unknown’ location and then you can bypass all filtering of your local network and can do all the ‘dirty work’ which is normally blocked in general networks. Also usage of such tools results in blacklisting your or your Internet service provider public IP. It is a very common application here in Pakistan to open the Youtube or VOIP (which are banned here officially). So I have done some lab testing for Mikrotik and found following IP Block lists and few ports which are used by HOTSPOT SHIELD. [but still you need to monitor via TORCH tool that what IP addresses pool HS is using and keep adding them in the list]

/ip firewall address-list

add address=157.56.106.0/24 disabled=no list=hotspotshield_zaib





























# Now create Rules to block above address list and additional ports

/ip firewall filter

add action=drop chain=forward comment="Block_Hotspot_Shield_Addresses_(test phase_zaib)" disabled=no src-address-list=hotspotshield_zaib

add action=drop chain=forward comment="Block_Hotspot_Shield_Ports_(test phase_zaib)" disabled=no dst-port=990,179,105,706,5245,3451,15009 protocol=tcp

After applying rules, Hotspot Shield stopped connecting. .

Note: It was observed that it is almost impossible to block it 100% but with above method, I got 99% success. Its impossible to block all the proxy tools/apps as there are thousands of them. but with some smart configuration you can only minimize the chances of there utilization. Make sure you use OPENDNS and if you have static public IP address, then create account and block all the proxy / anonymizer category. Make sure to forcefully redirects all the DNS traffic to your own dns server which should be using opendns or some filtering mechanism to block or POISON the BAD sites. Also it was noted that I ahve used some large IP blocks like /8 or /16 (rather the just /24) because hotspot shield have thousands of IP addresses/blocks which it uses. So it is quite possible that some valid content also gets DROPPED/BLOCKED which falls in same subnet. More Tests would be required then by using any capturing tool or mikrotik own tool called TORCH. Example of torch in MT.

Its still under testing and will post some confirmed reports after few days. It is requested that you if have List of IP addresses which are used by HSS or other proxy, post details in comments or email me.

Blocking Hotspot Shield In

Documents

Transcript of Blocking Hotspot Shield In