4

Here are my iptables rules to allow Squid to connect to a web server:

# Accept internally-requested input
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#http,https traffic only through Squid - nobody user
iptables -A OUTPUT -p tcp -m multiport --dports 80,443 \
    -m state -m owner --uid-owner nobody --state NEW,ESTABLISHED -j ACCEPT

Squid itself is listening 3128 port on localhost. In skype options I told it to use squid proxy and to use port 58215 for incoming connections. I added these lines for skype:

#skype incoming connections
iptables -A INPUT -p udp --dport 58215 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --dport 58215 -m state --state NEW,ESTABLISHED -j ACCEPT

But it didn't work.

Then I turned off the firewall:

iptables -P OUTPUT ACCEPT
iptables -P INPUT ACCEPT

Skype started working. So, I looked, what ports does it use:

# netstat -a -ptcp | grep skype
tcp     0    0 *:58215              *:*                     LISTEN      2944/skype
tcp     0    0 pc.home.org:56369    157.55.130.140:40031    ESTABLISHED 2944/skype
tcp     0    0 pc.home.org:54316    db3msgr5011307.ga:https ESTABLISHED 2944/skype
tcp     0    0 pc.home.org:34778    193.120.199.14:12350    ESTABLISHED 2944/skype

# netstat -a -pudp | grep skype
udp        0      0 *:58215                 *:*           2944/skype          
udp        0      0 localhost:42865         *:*           2944/skype

But when I set restrictive policy:

iptables -P OUTPUT DROP
iptables -P INPUT DROP

Skype stops working. What should I do to make it work?

user4035
  • 1,065
  • 2
  • 14
  • 35
  • I think the skype port : 2944 from your netstat command not 58215.You can check it using nmap command when you are online with skype.You can find a correct port. – supriady Jan 11 '17 at 15:47
  • @supriady No, 2944 is the PID of skype process. – user4035 Jan 12 '17 at 12:42
  • I ran skype from linux mint : tcp 0 0 *:42676 *:* LISTEN 2785/skype. I dont think you can use iptables to block skype based on port number. You should use firewall that can block application name.The result from my skype was not same port with your skype. – supriady Jan 12 '17 at 13:27

1 Answers1

2

It appears Skype uses SOCKS or HTTPS proxies. Squid is neither. For incoming connections you need to NAT incoming connections to your PC using the port specified in your Skype settings. For outgoing connections you need to open the ephemeral ports your PC uses.

Skype is not a good citizen in protected environments. If your firewall supports upnp, then Skype can use that to keep the damage to a minimum.

I've documented my findings on Firewalling Google Chat and Skype.

BillThor
  • 8,887
  • 22
  • 27