PDA

View Full Version : How to block IM clients?

overmind
September 3rd, 2009, 17:47
Hello,

Do you know a proper way in FreeBSD to block IM clients/traffic, so users from LAN to not be able to use Yahoo Messenger, MSN, Skype or AOL?

For example with Yahoo Messenger if I block destionation port 5050, it will use https and still it will work. I assume other IM clients works the same way.

Any idea/tip from where should I start.
(blocking multiple subnets for IM servers is not a good way sice those are changing)

thank you and best regards
graudeejs
September 3rd, 2009, 18:15
two words: packet filter
overmind
September 3rd, 2009, 18:24
I need to do Layer7 filtering ?
graudeejs
September 3rd, 2009, 18:26
you can block ports/IP's used to connect to servers
Alt
September 3rd, 2009, 19:51
Haha Layer3 filtering ftw
overmind
September 3rd, 2009, 21:28
A client IM will use https if destination port is blocked. So Layer3 will not work, if I block https i broke functionality of https for LAN clients and some use https.
DutchDaemon
September 3rd, 2009, 21:33
Even if you manage to block all IM applications, people will still move to web-based IM, like MSN Webmessenger, Yahoo Webmessenger and ICQ2GO. Less functionality maybe, but still IM.
Alt
September 3rd, 2009, 21:37
You can divert them to squid so this "non-really-https" will drop.
Or you can install proxy and forbid direct connects..
Maybe it is possible at L7 with PF but i dunno...
DutchDaemon
September 3rd, 2009, 22:00
Intercepting https will break all https ..
overmind
September 3rd, 2009, 22:20
@DutchDaemon - For web based IM I intend to use some content filter (like dans guardian).

Is still not clear to me how to do it on Layer7, but I'm doing some research and I'll post the results. I think it might be possible with ipfw+snort but I am not sure.
SirDice
September 4th, 2009, 08:01
Or you can install proxy and forbid direct connects..
This would be the solution. Don't use a SOCKS proxy as you can pretty much proxy everything over it. Use a HTTP proxy. Forbid any workstation from accessing the Internet directly, force all of them through the proxy. Filter on the proxy based on URL.
hydra
September 4th, 2009, 12:04
- block the IM ports on the firewall
- force the users to use a proxy and filter out the most used chat webs (like meebo)

Not a 100% solution, however it blocks the most users.