Block MSN&Yahoo Messenger

azharmd · ‎11-03-2003

Hi ,

How can i block the yahoo and MSN messenger on PIX firewall , what are the ports and procedure if any..

Thanks

jmia · ‎11-03-2003

Hi -

To block MSN Messenger try the following:

· TCP Port 1863

· IP Range 64.4.13.0/24

So on the PIX that would equate to:

> access-list outbound deny tcp any any eq 1863

> access-list outbound deny ip any 64.4.13.0 255.255.255.0

> access-list outbound permit ip any any

> access-group outbound in interface inside

For Yahoo:

Blocking Yahoo Messenger is not as easy as blocking other pieces of software. You see, Yahoo has their servers seperated out across various IPs, and you can't just do a range block, for risk of making parts of Yahoo disappear from your users browsers. So, to block Yahoo Messenger, you must block these 2servers by DNS address, not range,

DNS names:

cs.yahoo.com

scsa.yahoo.com

Regards - Jay.

bfl1 · ‎11-03-2003

This will help block several of the IM's:

AOL Instant Messenger

Prevet File Transfers:

TCP 5190

IM images TCP 4443

Disable all together

block login.oscar.aol.com on ALL ports.

MSN

Prevent File Transfers, disable incoming/outgoing TCP 6891

Prevent Audio/Video conferencing, block UDP 13324 and 13325

Prevent Applicaiton sharing block TCP 1503

Disable altogether deny access to hosts in the msgr.hotmail.com subdomain and block TCP 1863

ICQ

Prevent file transfers, block TCP 3574

Disable file sharing images, block TCP 7320

Disable ICQ completely, deny access to loign.icq.com on TCP 5190

jackson.lancaster · ‎11-13-2003

You say that you need to block yahoo messenger by dns name. You imply this can be done on a PIX. If you know the secret of setting up a PIX acl based on host/domain name please let me know. We are evaluating PIX vs. Sidewinders now and this is the ONE feature the Sidewinder has over the PIX that may keep us from switching.

bfl1 · ‎11-14-2003

You would nslookup the dns name and use the IP. You can't use DNS to resolve names - you can only create "host" entries with the "name" command. From a security point of view, not using dns resolution on the PIX is a good thing, IMHO.

rshedlow · ‎11-20-2003

You're correct in that the PIX cannot restrict based on domain name. An alternative would be to blackhole IM domains/hosts e.g., login.oscar.aol.com, by having internal/dmz dns entries for them which direct traffic to a null0 interface somewhere.