* RE: rules for skype
2005-05-01 22:00 ` Taylor, Grant
@ 2005-05-01 22:31 ` Seferovic Edvin
2005-05-01 23:43 ` Mogens Valentin
` (2 subsequent siblings)
3 siblings, 0 replies; 8+ messages in thread
From: Seferovic Edvin @ 2005-05-01 22:31 UTC (permalink / raw)
To: netfilter
DEVIL_MODE = 1;
You can stop it by blocking incoming high ports ;)
DEVIL_MODE = 0;
Why should you block all incoming high ports? Hm.. maybe you want to allow
only web traffic that comes and goes through a squid proxy ;)
Regards,
Edvin Seferovic
-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Taylor, Grant
Sent: Montag, 02. Mai 2005 00:00
To: netfilter@lists.netfilter.org
Subject: Re: rules for skype
> iptables -A FORWARD -p tcp --dport SKYPEPORT -j ACCEPT
<devilish @^*% eating grin> He, Skype does not have a port (per say).
</devilish @^*% eating grin>
Skype will use just about any port that it can use (all the standards you
would think for internet traffic) to connect to any ""super node that it can
connect to. unfortunately what qualifies as a Super Node is any node /
computer that is running Skype that is directly connected to the internet
with out a firewall that would inhibit other systems from connecting
directly to it. Do a Google for "Skype Protocol" and see what you find. I
have a PDF on it at the office that I'd be happy to send you. (If you want
this PDF I'll find the URL to it and post it to the list or email
individually as I don't think the list would like a PDF sent to it.) The
only way that I've heard to even slow down Skype is to force it to pass
through a proxy, beyond that nothing, that I have heard of or read about,
will stop it.
Grant. . . .
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: rules for skype
2005-05-01 22:00 ` Taylor, Grant
2005-05-01 22:31 ` Seferovic Edvin
@ 2005-05-01 23:43 ` Mogens Valentin
2005-05-02 1:32 ` Daniel Lopes
2005-05-02 6:14 ` Taylor, Grant
2005-05-02 6:16 ` rules for skype (URL in this one) Taylor, Grant
3 siblings, 1 reply; 8+ messages in thread
From: Mogens Valentin @ 2005-05-01 23:43 UTC (permalink / raw)
To: Taylor, Grant; +Cc: netfilter
Taylor, Grant wrote:
>> iptables -A FORWARD -p tcp --dport SKYPEPORT -j ACCEPT
>
>
> <devilish @^*% eating grin> He, Skype does not have a port (per say).
> </devilish @^*% eating grin>
>
> Skype will use just about any port that it can use (all the standards
> you would think for internet traffic) to connect to any ""super node
> that it can connect to. unfortunately what qualifies as a Super Node is
> any node / computer that is running Skype that is directly connected to
> the internet with out a firewall that would inhibit other systems from
> connecting directly to it.
No wonder, since Skype is based upon the methods as used for Kazaa.
Damn thing to deny too, as is many other sharing apps...
AFAIR I found it slightly easier blocking such using ipchains explicit
in/out/forward rules, than with iptables and ESTABLISHED,RELATED rules.
> Do a Google for "Skype Protocol" and see
> what you find. I have a PDF on it at the office that I'd be happy to
> send you. (If you want this PDF I'll find the URL to it and post it to
> the list or email individually as I don't think the list would like a
> PDF sent to it.) The only way that I've heard to even slow down Skype
> is to force it to pass through a proxy, beyond that nothing, that I have
> heard of or read about, will stop it.
Mind adding me to that list? If so, thanks a lot!
--
Kind regards,
Mogens Valentin
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: rules for skype
2005-05-01 23:43 ` Mogens Valentin
@ 2005-05-02 1:32 ` Daniel Lopes
0 siblings, 0 replies; 8+ messages in thread
From: Daniel Lopes @ 2005-05-02 1:32 UTC (permalink / raw)
To: netfilter
Mogens Valentin schrieb:
> Taylor, Grant wrote:
>
>>> iptables -A FORWARD -p tcp --dport SKYPEPORT -j ACCEPT
>>
>>
>>
>> <devilish @^*% eating grin> He, Skype does not have a port (per say).
>> </devilish @^*% eating grin>
>>
>> Skype will use just about any port that it can use (all the standards
>> you would think for internet traffic) to connect to any ""super node
>> that it can connect to. unfortunately what qualifies as a Super Node
>> is any node / computer that is running Skype that is directly
>> connected to the internet with out a firewall that would inhibit other
>> systems from connecting directly to it.
>
>
> No wonder, since Skype is based upon the methods as used for Kazaa.
> Damn thing to deny too, as is many other sharing apps...
> AFAIR I found it slightly easier blocking such using ipchains explicit
> in/out/forward rules, than with iptables and ESTABLISHED,RELATED rules.
>
>> Do a Google for "Skype Protocol" and see what you find. I have a PDF
>> on it at the office that I'd be happy to send you. (If you want this
>> PDF I'll find the URL to it and post it to the list or email
>> individually as I don't think the list would like a PDF sent to it.)
>> The only way that I've heard to even slow down Skype is to force it to
>> pass through a proxy, beyond that nothing, that I have heard of or
>> read about, will stop it.
>
>
> Mind adding me to that list? If so, thanks a lot!
>
Mhm Kazaa can be blocked by IPP2P for example. But Skype´s payload is
encrypted what makes it way more difficult or impossible. But what about
NUFW doesn´t it authenticate upon application? I would like to receive a
copy of that PDF too please :).
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: rules for skype
2005-05-01 22:00 ` Taylor, Grant
2005-05-01 22:31 ` Seferovic Edvin
2005-05-01 23:43 ` Mogens Valentin
@ 2005-05-02 6:14 ` Taylor, Grant
2005-05-02 6:16 ` rules for skype (URL in this one) Taylor, Grant
3 siblings, 0 replies; 8+ messages in thread
From: Taylor, Grant @ 2005-05-02 6:14 UTC (permalink / raw)
To: netfilter
> ... I have a PDF on it at the office that I'd be happy to
> send you. (If you want this PDF I'll find the URL to it and post it to
> the list or email individually as I don't think the list would like a
> PDF sent to it.)...
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: rules for skype (URL in this one)
2005-05-01 22:00 ` Taylor, Grant
` (2 preceding siblings ...)
2005-05-02 6:14 ` Taylor, Grant
@ 2005-05-02 6:16 ` Taylor, Grant
3 siblings, 0 replies; 8+ messages in thread
From: Taylor, Grant @ 2005-05-02 6:16 UTC (permalink / raw)
To: netfilter
> ... I have a PDF on it at the office that I'd be happy to
> send you. (If you want this PDF I'll find the URL to it and post it to
> the list or email individually as I don't think the list would like a
> PDF sent to it.)...
The URL is http://www.cs.columbia.edu/~library/TR-repository/reports/reports-2004/cucs-039-04.pdf
Grant. . . .
P.S. Sorry for the double post. VNCing to the office and control keys don't work the best.
^ permalink raw reply [flat|nested] 8+ messages in thread