Blocking IMs

Blocking IMs

[Sameer Gurung]

IS there a way i can block yahoo chat and instant
messenger and msn from only specific clients from the
network..... the clients get their ip address from a
dhcp server.... 
Any help would be appreciated

=====


________________________________________________________________________
Yahoo! India Matrimony: Find your life partner online
Go to: http://yahoo.shaadi.com/india-matrimony

Re: Blocking IMs

[Ashutosh Naik]

On Thu, 5 Aug 2004 07:07:38 +0100 (BST), Sameer Gurung 
<sameersworld@yahoo.co.in> wrote:

> IS there a way i can block yahoo chat and instant
> messenger and msn from only specific clients from the
> network..... the clients get their ip address from a
> dhcp server....
> Any help would be appreciated
>


If U know the IP Addresses of the CLients, then a simple one for Yahoo IS

/sbin/iptables -A OUTPUT -s <Source_IP> -p tcp --destination-port 5050 -j 
DROP


Check the Port number on which the MSN Server Listens

Regards
-- 
Ashutosh Naik

Re: Blocking IMs

[Askar Ali Khan]

Hi,

If you are running a route/firewall then you have to do things in
FORWARD that is...

## Droping all yahoo related ports voice, messaging, gaming
iptables -I FORWARD -o ppp0 -s IpOfClient -p tcp -m multiport --dport
5000,5001,5100,5050,11999 -j DROP

# Replace -o ppp0 with your out interface, if you have different then ppp0 
  for example -o eth0

##Droping MSN packets
iptables -I FORWARD -o ppp0 -s IpOfClient -p tcp --dport 1836

However if you are doing some transparent proxing, for example if you
are running squid on the same machine that is the firewall/router
machine then replace FORWARD with OUTPUT

iptables -I OUTPUT -o ppp0 -s IpOfClient -p tcp -m multiport --dport
5000,5001,5100,5050,11999 -j DROP

##Droping MSN packets
iptables -I OUTPUT -o ppp0 -s IpOfClient -p tcp --dport 1836

Regards
Askar

On Thu, 5 Aug 2004 07:07:38 +0100 (BST), Sameer Gurung
<sameersworld@yahoo.co.in> wrote:
> IS there a way i can block yahoo chat and instant
> messenger and msn from only specific clients from the
> network..... the clients get their ip address from a
> dhcp server....
> Any help would be appreciated
> 
> =====
> 
> 
> ________________________________________________________________________
> Yahoo! India Matrimony: Find your life partner online
> Go to: http://yahoo.shaadi.com/india-matrimony
> 
>

Re: Blocking IMs

[Alejandro Flores]

	Ops,
	There's a typo in the MSN port. 
	MSN port is 1863.
iptables -I FORWARD -o ppp0 -s IpOfClient -p tcp --dport 1863 -j REJECT

Regards,
Alejandro


> Hi,
> 
> If you are running a route/firewall then you have to do things in
> FORWARD that is...
> 
> ## Droping all yahoo related ports voice, messaging, gaming
> iptables -I FORWARD -o ppp0 -s IpOfClient -p tcp -m multiport --dport
> 5000,5001,5100,5050,11999 -j DROP
> 
> # Replace -o ppp0 with your out interface, if you have different then ppp0 
>   for example -o eth0
> 
> ##Droping MSN packets
> iptables -I FORWARD -o ppp0 -s IpOfClient -p tcp --dport 1836
> 
> However if you are doing some transparent proxing, for example if you
> are running squid on the same machine that is the firewall/router
> machine then replace FORWARD with OUTPUT
> 
> iptables -I OUTPUT -o ppp0 -s IpOfClient -p tcp -m multiport --dport
> 5000,5001,5100,5050,11999 -j DROP
> 
> ##Droping MSN packets
> iptables -I OUTPUT -o ppp0 -s IpOfClient -p tcp --dport 1836
> 
> Regards
> Askar
> 
> On Thu, 5 Aug 2004 07:07:38 +0100 (BST), Sameer Gurung
> <sameersworld@yahoo.co.in> wrote:
> > IS there a way i can block yahoo chat and instant
> > messenger and msn from only specific clients from the
> > network..... the clients get their ip address from a
> > dhcp server....
> > Any help would be appreciated
> > 
> > =====
> > 
> > 
> > ________________________________________________________________________
> > Yahoo! India Matrimony: Find your life partner online
> > Go to: http://yahoo.shaadi.com/india-matrimony
> > 
> >
> 

Re: Blocking IMs

[Nate Turnbow]

You can always use dns to stop IM I found blocking ports not to be effective since IM clients will use port 80 to get out if the standard ports are blocked.  I found the best way was to add a dns entry for the server or cluster that hosts the IM then redirect those requests to localhost.


$ORIGIN msgr.hotmail.com.
$TTL 1h
@       IN      SOA    xxx.xxx.com. hostmaster.xxxxxx.com. (
                       2002101301           ; Serial
                       1h                   ; Refresh
                       1h                   ; Retry
                       1w                   ; Expire
                       15m )                ; Minimum TTL

@                       IN      NS      xxx.xxx.com.
@                       IN      NS      xxx.xxx.com.

@                       IN      A       127.0.0.1
*                       IN      A       127.0.0.1