From owner-freebsd-pf@FreeBSD.ORG  Mon Sep 11 12:22:33 2006
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
X-Original-To: freebsd-pf@freebsd.org
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 7B1AB16A492
	for <freebsd-pf@freebsd.org>; Mon, 11 Sep 2006 12:22:33 +0000 (UTC)
	(envelope-from rkramer@mweb.com)
Received: from mwbmarshal.mweb.com (mwbmarshal.mweb.com [196.2.141.6])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 13F6143D49
	for <freebsd-pf@freebsd.org>; Mon, 11 Sep 2006 12:22:31 +0000 (GMT)
	(envelope-from rkramer@mweb.com)
Received: from mwbfes1.mweb.com (Not Verified[196.2.141.73]) by
	mwbmarshal.mweb.com with NetIQ MailMarshal 6.0 Service Pack 1
	(v6, 0, 3, 28) id <B450555020000>; Mon, 11 Sep 2006 14:22:26 +0200
Received: from MWBEXCH.mweb.com ([196.2.141.75]) by mwbfes1.mweb.com with
	Microsoft SMTPSVC(6.0.3790.211); Mon, 11 Sep 2006 14:22:26 +0200
X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable
Date: Mon, 11 Sep 2006 14:22:26 +0200
Message-ID: <39DC135F7F0571489196E0B6F5D58B4A01B26FE2@MWBEXCH.mweb.com>
In-Reply-To: <39DC135F7F0571489196E0B6F5D58B4A01B26FDF@MWBEXCH.mweb.com>
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Thread-Topic: Block Skype with PF
Thread-Index: AcbVltQ9/VjnVLYVRsW9bojKAN4K2wAAM6lQAAFVpbA=
From: "Rudi Kramer" <rkramer@mweb.com>
To: <freebsd-pf@freebsd.org>
X-OriginalArrivalTime: 11 Sep 2006 12:22:26.0989 (UTC)
	FILETIME=[F17F15D0:01C6D59C]
Subject: RE: Block Skype with PF
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 11 Sep 2006 12:22:33 -0000

Hey Greg,

I found this article which should help a bit.

http://www.net-
security.org/dl/articles/Blocking_Skype.pdf#search=3D%22net%20squid%20sky=
p
e%20blocking%22
 =20

Rudi


-----Original Message-----
From: owner-freebsd-pf@freebsd.org [mailto:owner-freebsd-pf@freebsd.org]
On Behalf Of Greg Armer
Sent: 11 September 2006 01:35 PM
To: freebsd-pf@freebsd.org
Subject: Block Skype with PF

Good day list,

I was just wondering if any of you have a running 'receipe' using PF
that can block Skype.

What I have found out is the following:

- Skype picks a random port to use when it is installed
- It can switch over to port 80 / 443 if a firewall is too restrictive
- It appears UDP ports above 1024 are used aswell

So what I was thinking of doing is blocking all outgoing UDP above port
1024, and trying to identify and block the port 80 / 442 traffic with=20
squid and a transparent proxy.

Does anyone have any better solutions to this which do not involve
expensive layer 7 inspection hardware ?

Many thanks for your comments / ideas.

Regards,

--
Greg Armer

_______________________________________________
freebsd-pf@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to "freebsd-pf-unsubscribe@freebsd.org"