Re: blocking chat and instant messaging?
From: x y (jamescagney90210@excite.com)Date: 07/17/02
- Next message: Vic Russell: "Hotmail unavailable behind firewall"
- Previous message: PRegan: "Problem with SEF7.0 Upgrade from 6.02"
- In reply to: Stan: "blocking chat and instant messaging?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "x y" <jamescagney90210@excite.com> Date: Wed, 17 Jul 2002 08:21:23 -0400
"Stan" <kompwiz@-R-E-M-O-V-E-lycos.com> wrote in message
news:3D337F66.CD9CF97D@-R-E-M-O-V-E-lycos.com...
> Hi!
>
> I'm setting up a Netscreen-25 firewall. My client is requesting that the
> chat and instant messaging be blocked. However, after some research, it
> appears to me that this is not possible without some kind of an
> application-layer firewall (proxy server or whatever). As long as
> there's at least one outbound port is open, the IM programs will find a
> way to function. Am I wrong?
You are correct that filtering packets on port number and IP address is
theoretically not 100% secure, but it is more effective than you describe
it. The IP addresses used could change, but in reality don't change very
often. Not all IM clients currently scan other well-known ports to attempt
a connection, and those that do [such as AOL AIM] don't check every port,
just some of them.
You could also add a dummy empty DNS domain on your internal DNS server
representing the domain or host name used to connect to IM, such as
oscar.aol.com [in combination with using packet filtering on the firewall to
force all clients to use your DNS server for internet browsing]. You may
want to download new versions of the major chat clients when new versions
are released to confirm that nothing has changed. Also a company policy
including some sort of reprimand or punishment may help, because IM chat is
likely to be discovered sooner or later.
Hopefully you've already set up rules on your firewall to block all outbound
ports except those that are needed for business purposes, and you've locked
down other ports such as possibly SMTP TCP 25 and DNS TCP/UDP 53 so that
only pre-approved machines can use them, not every machine on the network.
- Next message: Vic Russell: "Hotmail unavailable behind firewall"
- Previous message: PRegan: "Problem with SEF7.0 Upgrade from 6.02"
- In reply to: Stan: "blocking chat and instant messaging?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
