How to Block IRC/MSN/P2P/yahoo mess etc. Pix 515 Please Help

[Guest_imported]

Hello

Could someone help me block the above. I don't want to add a whole range accesslists etc, is this the only way??. Is it possible to just remove a fixup protocol? Why dosen't the pix come configured everything blocked and then build your policy up from what you do need?

Thanks in advance!!

Pix Newbie!!

 

[rubbaninja]

Just permit what ports you want and deny everything else.

 

[yizhar]

HI.

Yes, as rubbaninja wrote - this is the way.

Here is a sample to start with:

access-list frominside permit udp any any eq 53
access-list frominside permit tcp any any eq 53
access-list frominside permit tcp any any eq 80
access-list frominside permit tcp any any eq 443
access-list frominside permit tcp any any eq smtp
access-list frominside permit tcp any any eq ftp
etc...
access-list frominside in interface inside

This will not block all P2P applications, but will give you a good head start.

And, you will need to test it, so add these also:

logging on
logging buffer 4

And view the log:
show log

Or better use PDM logging and/or SYSLOG server which can give you few more options.

Look for traffic blocked by the access list frominside and see if you need to open additional ports.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[Guest_imported]

Yizhar

I have installed the access-list and also bound them to a access-group as told. At the moment I'm still able to connect to msn but I do see hits on the access-list deny 1863 when i connect to msn. Do I have to block some other ports also??

Thanks in advance.

 

[Guest_imported]

Messaging / Chat Application ports:

MSN Messenger Service TCP Port 1863

AOL Instant Messenger (AIM) TCP Port 5190

IRC TCP Port 194

 

[yizhar]

HI.

Many newer P2P programs are firewall aware, and some of them can adopt to different session, including using port 80 .

Here are some optional solutions:
* Use a proxy server and only allow it to go out.
* Block P2P applications that use ports like 80 (which you want to leave open), by blocking ip addresses of servers.

Also search this forum. That issue has been discussed several times and you can find here more info about it.

Bye


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[aciscorouter]

We have done the same here at our company but what we've done is blocked access to the subnets that the MSN, Morpheus, ICQ, and other P2P servers use. ICQ uses predefined ports... B-) =====================
hack4free@hotmail.com
=====================