Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Community Member

Block MSN&Yahoo Messenger

Hi ,

How can i block the yahoo and MSN messenger on PIX firewall , what are the ports and procedure if any..



Re: Block MSN&Yahoo Messenger

Hi -

To block MSN Messenger try the following:

· TCP Port 1863

· IP Range

So on the PIX that would equate to:

> access-list outbound deny tcp any any eq 1863

> access-list outbound deny ip any

> access-list outbound permit ip any any

> access-group outbound in interface inside

For Yahoo:

Blocking Yahoo Messenger is not as easy as blocking other pieces of software. You see, Yahoo has their servers seperated out across various IPs, and you can't just do a range block, for risk of making parts of Yahoo disappear from your users browsers. So, to block Yahoo Messenger, you must block these 2servers by DNS address, not range,

DNS names:

Regards - Jay.

Community Member

Re: Block MSN&Yahoo Messenger

This will help block several of the IM's:

AOL Instant Messenger

Prevet File Transfers:

TCP 5190

IM images TCP 4443

Disable all together

block on ALL ports.


Prevent File Transfers, disable incoming/outgoing TCP 6891

Prevent Audio/Video conferencing, block UDP 13324 and 13325

Prevent Applicaiton sharing block TCP 1503

Disable altogether deny access to hosts in the subdomain and block TCP 1863


Prevent file transfers, block TCP 3574

Disable file sharing images, block TCP 7320

Disable ICQ completely, deny access to on TCP 5190

Community Member

Re: Block MSN&Yahoo Messenger

You say that you need to block yahoo messenger by dns name. You imply this can be done on a PIX. If you know the secret of setting up a PIX acl based on host/domain name please let me know. We are evaluating PIX vs. Sidewinders now and this is the ONE feature the Sidewinder has over the PIX that may keep us from switching.

Community Member

Re: Block MSN&Yahoo Messenger

You would nslookup the dns name and use the IP. You can't use DNS to resolve names - you can only create "host" entries with the "name" command. From a security point of view, not using dns resolution on the PIX is a good thing, IMHO.

Community Member

Re: Block MSN&Yahoo Messenger

You're correct in that the PIX cannot restrict based on domain name. An alternative would be to blackhole IM domains/hosts e.g.,, by having internal/dmz dns entries for them which direct traffic to a null0 interface somewhere.

CreatePlease to create content