Printable View
hi techies,
I ve a problem here with blocking Yahoo and MSN chat programs on my uncles Router (netgear 614) which only allows me to block particular sites and ports. i was unable to block the services using IPchains and particular ports used by the services. Can i get some guidance on how to block the services on Netgear RP 614 Router ps.
thnx
Dishtools
Both are hard to block since they can be reconfigured to avoid the firewall.
What I do is block the initial connections on their standard ports and create an IDS rule to alert me of the activity. Oh, prior to that I made sure I scared the bejeebers out of the users as to what I would do if I catch them..... Seems to work.....
Remember: there are some administrative problems for which there are no technological solutions..... ;)
Both will be very problematic as they use port 80 and unpriv ports for authentication/communication. But it's NOT impossible...just takes work.
Believe you me, I went through all of this a year ago at home with my teenage daughters. I finally was able to block AOL, Yahoo, and MSN, but with a mixture of several things. I just don't think a Netgear will do it for you, but someone may prove me wrong...
For AOL, using IPTables I blocked port 5190 in and out, and anything going to login.oscar.aol.com, and then I also added any website aol had where you could download AIM into squidGuard (works with squid proxy server, all of this runs on Linux) so that I could block any attempt to download the client. All the kids would get was a nice little page that said...go away....
For Yahoo I blocked every IP address Yahoo was known to use for messenger services using IPTABLES. I also blocked port 5050 in and out. I don't have the list of ip's handy, but I could post later on if you want. I also add all associated web sites for yahoo messenger to squidGuard for the same reasons as AIM above....
Now....MSN was the tough part. No matter what I tried, I had the hardest time blocking it. The thing that did the trick for me was a squid.conf entry that goes like this:
acl kids src 192.168.0.10/255.255.255.255
acl msnmessenger req_mime_type ^application/x-msn-messenger$
http_access deny kids msnmessenger
Then, on your network, you have to force your user browsers through your proxy cache, either by browser config, or by transparent proxy (I chose the latter using IPTABLES).
Worked like a charm.
interesting
thnx for the reply guys.. I m trying to block it for my Uncle (same reason Teenage daughter).
can you ps post the IPs to block so that I may try them. Nothin so far seems to work. It s home network so it doesnt has any Networking Equipment except the Netgear Router. SO my best bet is to work on IP tables and ports. I would really appreciate if some one could post the list of ports which I should allow for the normal functioning (HTTP,FTP etc.)and block all the other ports so that user may only surf the net, download but be unable to do anything else.
thnx
Dishtools
Ok....here's an outtake of a source file for my iptables script...Yahoo by far takes up the most space......obviously the envars and such will be different but you're most interested in the ports and ip's.....
#
#
# Chat System Blocks
#
# AOL
#$IPT -A SHUN -d 64.12.161.153 -j BAD_IP
#$IPT -A SHUN -d 64.12.161.185 -j BAD_IP
#$IPT -A SHUN -d 64.12.200.89 -j BAD_IP
#$IPT -A SHUN -d 205.188.179.233 -j BAD_IP
# Block Yahoo Messenger
#
# Yahoo Music
#$IPT -t filter -A OUTPUT -p tcp -s 192.168.100.0/24 -d 0/0 --dport 1755 -j $STOP
#
#$IPT -t filter -A OUTPUT -p tcp -s 192.168.100.30/32 -d 0/0 --dport 5050 -j $STOP
#$IPT -t filter -A OUTPUT -p udp -s 192.168.100.30/32 -d 0/0 --dport 5050 -j $STOP
# cbs.yahoo.com
$IPT -A SHUN -d 204.71.202.58 -j BAD_IP
# msg1.edit.vip.sc5.yahoo.com
$IPT -A SHUN -d 216.136.225.238 -j BAD_IP
# dl1.yahoo.com thru dl4.yahoo.com
$IPT -A SHUN -d 204.71.201.134 -j BAD_IP
$IPT -A SHUN -d 204.71.201.141 -j BAD_IP
$IPT -A SHUN -d 204.71.200.36 -j BAD_IP
$IPT -A SHUN -d 204.71.200.37 -j BAD_IP
# p1.msg.yahoo.com thru p5.msg.yahoo.com
# p7.msg.yahoo.com thru p18.msg.yahoo.com
$IPT -A SHUN -d 204.71.202.79 -j BAD_IP
$IPT -A SHUN -d 204.71.202.78 -j BAD_IP
$IPT -A SHUN -d 204.71.202.57 -j BAD_IP
$IPT -A SHUN -d 204.71.202.56 -j BAD_IP
$IPT -A SHUN -d 204.71.202.136 -j BAD_IP
$IPT -A SHUN -d 204.71.202.138 -j BAD_IP
$IPT -A SHUN -d 204.71.202.26 -j BAD_IP
$IPT -A SHUN -d 204.71.200.86 -j BAD_IP
$IPT -A SHUN -d 204.71.200.153 -j BAD_IP
$IPT -A SHUN -d 216.115.105.112 -j BAD_IP
$IPT -A SHUN -d 216.115.105.113 -j BAD_IP
$IPT -A SHUN -d 216.115.105.114 -j BAD_IP
$IPT -A SHUN -d 216.115.105.115 -j BAD_IP
$IPT -A SHUN -d 204.71.202.84 -j BAD_IP
$IPT -A SHUN -d 216.115.107.252 -j BAD_IP
$IPT -A SHUN -d 216.115.107.253 -j BAD_IP
$IPT -A SHUN -d 216.115.107.254 -j BAD_IP
# old cs[1-9].msg.yahoo.com ips...kept just for the heck of it
$IPT -A SHUN -d 204.71.202.119 -j BAD_IP
$IPT -A SHUN -d 204.71.200.55 -j BAD_IP
$IPT -A SHUN -d 216.115.107.146 -j BAD_IP
$IPT -A SHUN -d 204.71.200.57 -j BAD_IP
$IPT -A SHUN -d 204.71.201.100 -j BAD_IP
$IPT -A SHUN -d 204.71.202.59 -j BAD_IP
$IPT -A SHUN -d 204.71.202.58 -j BAD_IP
$IPT -A SHUN -d 204.71.200.54 -j BAD_IP
$IPT -A SHUN -d 216.115.105.57 -j BAD_IP
# Block messenger.yahoo.com
$IPT -A SHUN -d 216.109.116.177 -j BAD_IP
$IPT -A SHUN -d 216.136.232.153 -j BAD_IP
$IPT -A SHUN -d 66.163.172.51 -j BAD_IP
$IPT -A SHUN -d 216.109.116.176 -j BAD_IP
# Block MSN using Squid
# Note: You can try blocking all inbound/outbound to ports 6891:6901 and 1080
# but I don't believe that works anymore.
MSN seems to be the hardest for everyone to block. It took some hardcore configuration for us to keep out staff from using MSN. However, the easiest route that we took was to disable SOCKS 5 in the logon script. So far, no one has proved they needed SOCKS to do their Job. Some of the women in the office wear sandles anyway :)
Fraggin: Do me a favor...... give me the text from the script that disables the socks.... I'm sure some others will appreciate it too.... ;)
fanningp and fraggin,
Just a thought guys, Would it be possable for you to post your information as a Tutorial?
cheers
Alternate idea would be to just disable all ports on the client computer, and set up a LAN http proxy that only accepts incoming connections on port 80. just configure the used browser to use that proxy, and then disable reconfiguring of browser by non-administrator users. That way any rouge applications at all will not be able to gain any internet acces, and, most likely, the user(s) will not know how to tunnel the AOL or Yahoo! Instant Messenger services through the proxy, and even if they do, you can configure it to search for the login string and have it just dismiss the traffic.
I'll check tomorrow and follow up after I talk with the admin that disabled SOCKS.
Had to check so I could get some sleep:
At the moment, we are using ISA to block SOCKS. Sorry that I said that it was a script. Bad information, you caught me, busted :( .....
But, what we had in place was a script that pointed people to the firewall before we implemented ISA. The part that blocked SOCKS went something like this:
# SOCKS: establishing a connection
ipchains -A output -i $EXTERNAL_INTERFACE -p tcp -y \
-s $IPADDR \
-d $ANYWHERE $SOCKS_PORT -j REJECT
# SOCKS incoming connection
ipchains -A input -i $EXTERNAL_INTERFACE -p tcp -y \
-d $IPADDR $SOCKS_PORT -j DENY
I hope this gives you an Idea, If not, let me know and I'll put more of the rule here.......
Once again, Sorry that I said it was a Logon Script.
However, there is an app out there call socksdis.exe that will disable socks or you can do it manually be renaming the SOCKS.CNF file, but I don't know what this will cause..........
Man, Now I feel like I'm really not helping much at all..........
"anything going to login.oscar.aol.com"
I used the same method with ISA and it worked well, I originally blocked the default port but the program outsmarted me and swerved to a different port.
Same thing also worked in blocking access to GoToMyPC, I just found out what IP it authenticates through via their FAQS and blocked it as well. Something very disturbing about a program that can be installed and give remote access to anyone that has the password.......even worse is it uses port 80 and is built to go through the firewall (supposedly for zero config ease, I see it as a security breach/hole that needs to be closed).
well guys ... my problem still remains unresolved. I think i ll change the Router and go for some better one so that i can learn more about the Networking.
thnx
Sorry it took so long to reply....I'm headin' to northern Wisconsin this weekend and taking my laptop so if I have free time I'll see if I can cook up a tutorial on what I did.
Cheers.
With regard to installing apps, don't forget that at least Yahoo has a java based chat client that you can run from the web. You just click the link and it runs the java applet for chat. You SHOULD be able to block access from the java client easily though, as I think it has to run on a particular port and can't be modified (to my knowledge anyway) to work on port 80 or whatnot.
1) What is SOCKS and why do we not need it, and why does it block msn?
2)What is ISA for that mater :p
3)What if one had a proxy server, and firewall bloks all trafik not comming from the proxy server. Would this block programs that uses port 80 to try to pass the firewall.
I gues it depends if the proxy server is able to detect non http trafic.
One nasty program is the one talked about in this forum, where a client contacts a third party server through port 80, right through the firewall. And the third party server relays im & other services.
source:Quote:
When an application client needs to connect to an application server, the client connects to a SOCKS proxy server. The proxy server connects to the application server on behalf of the client, and relays data between the client and the application server. For the application server, the proxy server is the client.
http://www.socks.permeo.com/AboutSOC...KSOverview.asp
I had the same problem but with the addition of Kazaa...
I posted a FAQ on Tek-Tips.com on how to block them from a server but not through the router. I am pasting it here in case it helps:
If you have been searching for a cheap effective means of blocking this type of software then here is your answer. I blocked Yahoo, Kazaa and all those other programs that port roam (such applications can change the port so the blocking of a specific static port(s) is of no use).
This will also work on programs like Wingate for which their is no port to block because it routes traffic.
1)Goto www.sysinternals.com, get and install pstools on a server or machine that will be scanning as stated below (doesn't have to be a server).
2)Create a batch script similar to:
@ ECHO OFF
:loop
REM All of the following is one line do NOT hit enter
REM The ^ is a shortcut for a more statemet.
for /F %%a in ('net view ^| find "\\" ') do pslist %%a | find "ypager" /I && pskill %%a ypager >> d:\shutdownlog.txt && psloggedon %%a >> d:\shutdownlog.txt && shutdown -r -t 60 -m "This computer has found that you are using Yahoo Instant Messenger. You have been reported and the computer will be rebooted. Your account will be suspended." -f %%a
REM You can hit enter now
goto loop
3) For each program your going to block you need to add:
for /F %%a in ('net view ^| find "\\" ') do pslist %%a | find "process name" /I && pskill %%a process name >> d:\shutdownlog.txt && psloggedon %%a >> d:\shutdownlog.txt && shutdown -r -t 60 -m "Message you want offender to see." -f %%a
So if I was going to block Yahoo AND Kazaa then my script would look like:
@ECHO OFF
:loop
for /F %%a in ('net view ^| find "\\" ') do pslist %%a | find "ypager" /I && pskill %%a ypager >> d:\shutdownlog.txt && psloggedon %%a >> d:\shutdownlog.txt && shutdown -r -t 60 -m "This computer has found that you are using Yahoo Instant Messenger. You have been reported and the computer will be rebooted. Your account will be suspended." -f %%a
for /F %%a in ('net view ^| find "\\" ') do pslist %%a | find "kazaa" /I && pskill %%a kazaa >> d:\shutdownlog.txt && psloggedon %%a >> d:\shutdownlog.txt && shutdown -r -t 60 -m "This computer has found that you are using Kazaa. You have been reported and the computer will be rebooted. Your account will be suspended." -f %%a
goto loop
4) Run the batch script and have fun.
Now what this script does is it basically will do a net view and get the computer names. Then it does a pslist (downloaded from sysinternals) and looks for the ypager process (Yahoo Instant Messenger). If it finds it then it kills the process and writes to the shutdownlog file. You can end it there if you want but I go a step further becasue I want to know who did it. So a psloggedon will be done on that computer and written to the log so I know know the users login name and the TIME (I do this to dispute or support their excuses for example if they were not their at the TIME of the offense). You can end it their also but I work in a school and I am serious about installing this junk so I run pshutdown (I renamed the file to shutdown) on the machine with the message and a 60 second time delay which lets them know they have been busted and shutsdown the machine.
Now you run the batch file and every now and then look at the shutdown log to see who you have snared. Now you have all the information you need and if you want you can goto the specific computer and pull up the ownership of the illegal software and print the screen. Take all that to their boss.
I work in a college environment with about 800 students and their accounts get disabled when they install software like this.
Now where did I put my CD for Quake :)
Please note that this has only been tested on server operating systems running windows. This includes Windows XP, NT 4 w/sp6 and Windows 2000 Advanced Server. This is meant for networks not single machines. The server scans all the workstations on the network.
Have fun!!!
Bill
To block all other traffic and only allow HTTP or FTP traffic, you should only allow tcp port 80 (for web), tcp port 23(FTP) , and udp port 53(DNS, to resolve the urls). All other traffic/ports should be blocked.
You should only set this on your inside interface.
As long as your PC is connected to the router/firewall to access to the internet, and you have all this access-list set on your router/firewall, you have effeciently block Yahoo messenger, AOL.
But that's a very large restriction on genuine ports....