I am trying to block yahoo and msn in the office and need some help...

I have recently built a robust iptables firewall only allowing out requests that we really need (eg 80, 443 etc etc) and theoretically this should do the job however yahoo and msn will go through on any port they can (including 80!)

So i have implimented a squid proxy server with the hope of blocking the IP's and/or the domain names of the services.

the problem is that I have blocked EVERYTHING that i can think of but the littles horrors still get through.

this is what i have done so far and everything APPEARS to be working.. if i browse to the IP i have selected I get an error message and same with the websites BUT msn and yahoo can still connect... any ideas?

#############################
squid.conf
#############################
mum_object_size 200 KB

#This creates 5000mb disk space with 16 first level subdirectories and 256 second level #subdirectories.
cache_dir ufs /usr/local/squid/var/cache 5000 16 256

cache_access_log /usr/local/squid/var/logs/access.log

cache_log /usr/local/squid/var/logs/cache.log

#This is the redirect program which we will use to zap the ads.
#redirect_program /usr/local/adzap/scripts/wrapzap

acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl MYDC src 192.168.0.0/255.255.255.0 #specify a name for your network
acl SSL_ports port 443 563
acl Safe_ports port 80 21 443 563 70 210 1025-65535
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT

# Banned sites and Services
acl bannedurls url_regex "/usr/local/squid/etc/url.txt"
acl bannedips dst "/usr/local/squid/etc/ip.txt"

http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny bannedurls
http_access deny bannedips

http_access allow all
icp_access allow all
miss_access allow all
cache_mgr chris@leadingside.com.my
visible_hostname proxy.leadingside.com.my
unique_hostname proxy.leadingside.com.my

#We will run squid with accelerator on
httpd_accel_host virtual
httpd_accel_port 80

httpd_accel_with_proxy on
httpd_accel_uses_host_header on
http_port 3128



#############################
url.txt
#############################
.messenger.yahoo.com
.msg.yahoo.com
.scd.yahoo.com
.sc5.yahoo.com
webcam.yahoo.com
filetransfer.yahoo.com
#############################



#############################
ip.txt
#############################
64.4.13.0/24 #MSN Messenger
#############################

QUICK UPDATE
----------------------

managed to block MSN by adding another IP into the ip.txt
207.46.104.0/24

however am not 100% if this ip will block it forever... so another way of doing it would be nice.

another way i could maybe block it is the MIME: application/x-msn-messenger because this stays constent throughout the log. what would the squid.conf line look like to block a mime?

Thanks
Chris

Howzit

I had the same problem with @ my company I was workring at try these products it will sort u them out for sure, squidguard http://www.squidguard.org/, dan gaurdian (http://dansguardian.org/), censornet (http://www.intrago.co.uk/products/censornet.php). These products r web filters and also comes with a blacklist of sites that u may block or not. I? not going to go into gr8 detail as the websites have all info needed.

hope this helps

chow

I actually got it all working without those... I will post somewhere else how i did it all so others can see more detailed cause it seems to be a problem a lot of people are trying to get around but not many helpful answers out there...

Using a Linux firewall (IPTABLES in my case), first of all you need to
have a running copy of squid which you make transparent for your local
LAN. Add this to your squid.conf:

httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on

And this to your IPTABLES:
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -A OUTPUT -j ACCEPT -m state --state NEW,ESTABLISHED,RELATED
-o eth0 -p tcp --dport 80

...where eth0 is your external interface and eth1 your internal.

Next you need to DROP or REJECT all instant messenger software ports
in you IPTABLES. The port for MSN Messenger is 1863, thus add this to
IPTABLES:

iptables -I FORWARD -p tcp --dport 1863 -j REJECT

Next, create an ACL in your squid.conf file for MSN Messenger and deny
access for it:

acl MSN-Mess dst 64.4.13.0/24 152.163.241.0/24 64.12.163.0/24
207.46.110.0/24 207.46.1.0/24 65.54.0.0/16
http_access deny MSN-Mess

That's it. Easy as pie.
You can do the same to other instant messaging software too. Here is a few acl's:

# Yahoo Messenger service
acl Yahoo-Mess dst 24.71.200.68/32 204.71.202.73/32 204.71.200.0/24
204.71.177.35/32 204.71.202.59/32 204.71.202.58/32 216.115.105.214/32
204.71.201.47/32 204.71.201.48/32 216.115.105.215/32
216.136.172.221/32 *.msg.yahoo.com
http_access deny Yahoo-Mess
# AOL and ICQ service
acl ICQ-Mess dst 64.12.200.89/32 205.188.153.121/32 205.188.179.233/32
64.12.161.153/32 64.12.161.185/32
http_access deny ICQ-Mess
# Trillian service
acl Trillian-Mess dst 66.216.70.167/32
http_access deny Trillian-Mess
"I have read this from site and i think this is the Solution for your problem so i did copy and paste for you. "

Post your final squid.conf file on serversamples.com. I have a working conf file posted that includes an acl named blocked_domains that admins can use to filter out individual domain names. You can check my squid.conf file out here: http://www.serversamples.com/view.php?sample=3

How has that worked? I'm using an OpenBSD PF firewall and block based on IP. Problem is that this blocks Windows Updates too

I was thinking of using squid to block content types:

application/x-msn-messenger
text/x-msmsgsprofile
text/x-msmsgsinitialmdatanotification

As described here for ISA setup:

http://support.microsoft.com/kb/925120
http://support.microsoft.com/?scid=k...32486&x=9&y=11

Will this work? Has anyone tried it? WIll I need to use the rejecttype.so filter (http://sites.inka.de/bigred/devel/squid-filter.html)?

Thanks!

msound, your link seems broken -- all I see is a blank page.

In the meantime, try http://pastebin.ca/.

Try this:

http://blogs.techrepublic.com.com/networking/?p=308

Works great.

Add following to squid.conf:
## Kill MSN
acl msn_mime req_mime_type -i ^application/x-msn-messenger$
acl msn_gw url_regex -i gateway.dll

http_access deny all msn_mime
http_access deny all msn_gw
## END MSN

Does the trick if you block port 1863 at gateway.

You might also want to investigate writing & displaying a custom Squid error page that tells your e'ees what has happened -- MSN is being blocked -- & why -- against company policy. It might contain a link to your AUP.