Re: [fw-wiz] Instance Messengers and Firewalls

From: Kevin Sheldrake (kev_at_electriccat.co.uk)
Date: 08/28/04

  • Next message: Paul D. Robertson: "Re: [fw-wiz] Off-Topic: Memo of Understanding for Using an Ethical Hacker" 
    To: suren@intotoinc.com, "firewall-wizards@honor.icsalabs.com" <firewall-wizards@honor.icsalabs.com>
Date: Sat, 28 Aug 2004 11:17:48 +0100

    I believe most IM software can be forced to tunnel connections over HTTP.
    This has the distinct advantage that port management in the firewall is
    unnecesary (save for a stateful outbound tcp/80). AMSN, for instance,
    will connect, chat and receive files over this method. The downside is
    that HTTP (or more specifically, port 80) is being abused by the IM
    software. Search the RFC index for TCP/IP over HTTP for more info on why
    this is bad practice.

    If you have to allow IM software, putting them over HTTP is probably the
    best of a bunch of bad things that you could do.

    Kev

    > Hi,
    > MSN, AOL and ICQ Messengers came long way and they traverse
    > through NAT/NAPT devices smoothly. IMs make use of 'Address Binding'
    > (Section 3.1, rfc 3022) features of NAT devices to support Peer to
    > Peer functionality, such as Audio/Video etc..
    >
    > But, they are not as friendly for Firewalls. Since the destination
    > IP and Port of peer are unknown at the time of configuration of
    > firewall policies, Administartor may be forced to allow all
    > connections to all ports. This is not good for security perspective.
    > If the firewalls have Application intelligence of these protocols,
    > they could only open temporary holes to allow data conenctions of
    > these IMs. These protocols are proprietary and ever changing and it
    > is also observed some times, they go for encrypting the data.
    > So, firewalls can't be trusted to have support for new IMs
    > immediately.
    >
    > These IMs have configuration for SOCKS5, which is meant for
    > authenticated firewall traversal. But, it seems that these IMs
    > did not implement UDP related commands of SOCKS5. SOCK5 proxies
    > can't be used for this purpose. Is my understading right?
    >
    > Is there any other way to allow IMs without allowing all
    > outbound connections?
    >
    >
    > Thanks,
    > Suren
    > www.intoto.com
    >
    >
    > _______________________________________________
    > firewall-wizards mailing list
    > firewall-wizards@honor.icsalabs.com
    > http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
    >
    > 

    -- 
Kevin Sheldrake MEng MIEE CEng CISSP
Electric Cat (Bournemouth) Ltd
_______________________________________________
firewall-wizards mailing list
firewall-wizards@honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
  • Next message: Paul D. Robertson: "Re: [fw-wiz] Off-Topic: Memo of Understanding for Using an Ethical Hacker"

    Relevant Pages

    • Re: Activesync / Airsync - Alternative Ports
      ... Setup a reverse HTTP proxy. ... Another idea is to use the PPTP capabilities of a Windows Server to allow ... Satellite - Cisco Firewall - Exchange Server ... So on the server side you would configure the port 80 to redirect to ...
      (microsoft.public.pocketpc.activesync)
    • Re: suggestions on router w/firewall
      ... a simple packet filtering firewall should process HTTP ... > is received on port 21 by the same rules that would be used for FTP. ... A simple packet filter type of firewall cannot do that, ...
      (comp.security.firewalls)
    • Re: [SLE] SuSEfirewall2 and games
      ... ethernet card. ... So the request comes in via eth1 to port 80 and it gets blocked. ... I even tried using http and https in the FW_ line. ... firewall it worked just fine. ...
      (SuSE)
    • Re: After frontpage connected to remote will not transfer files wh
      ... The Netgear router incorporates a firewall that could be blocking HTTP ... HTTP publishing requires port 80 be opened for traffic in both ... >I was able to load everything at another wireless location and ...
      (microsoft.public.frontpage.client)
    • Re: Activesync / Airsync - Alternative Ports
      ... If you wanted to throw hardware at it, you could probably setup a firewall ... on your side to reroute the requests for 80 and 443 to another port, ... Seems like http is hardcoded to go to 80 for Airsync. ...
      (microsoft.public.pocketpc.activesync)