Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

blocking yahoo messenger based on The order in which Yahoo Messenger scans for available ports is:

   1. port 5050
   2. port 80
   3. All available ports

is impossible,"its better disconnect internet :)"

the other way is to block yahoo messenger service addresses, like:

scs.msg.yahoo.com
scsa.msg.yahoo.com
scsb.msg.yahoo.com
scsc.msg.yahoo.com

and or these ip's like this:

/sbin/iptables -A OUTGOING -d 63.216.136.22 -j DROP
/sbin/iptables -A OUTGOING -d 66.135.224.142    -j DROP
/sbin/iptables -A OUTGOING -d 66.136.175.132    -j DROP
/sbin/iptables -A OUTGOING -d 66.163.168.105    -j DROP
/sbin/iptables -A OUTGOING -d 66.163.172.117    -j DROP
/sbin/iptables -A OUTGOING -d 66.163.173.76 -j DROP
/sbin/iptables -A OUTGOING -d 66.163.173.77 -j DROP
/sbin/iptables -A OUTGOING -d 66.163.173.78 -j DROP
/sbin/iptables -A OUTGOING -d 66.163.173.203    -j DROP
/sbin/iptables -A OUTGOING -d 66.163.175.128    -j DROP
/sbin/iptables -A OUTGOING -d 66.163.178.78 -j DROP
/sbin/iptables -A OUTGOING -d 204.71.200.36 -j DROP
/sbin/iptables -A OUTGOING -d 204.71.200.37 -j DROP
/sbin/iptables -A OUTGOING -d 204.71.201.134    -j DROP
/sbin/iptables -A OUTGOING -d 204.71.201.141    -j DROP
/sbin/iptables -A OUTGOING -d 216.136.173.172   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.173.179   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.175.132   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.175.142   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.175.143   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.175.144   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.175.145   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.175.145   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.175.226   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.224.134   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.224.142   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.224.213   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.224.213   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.224.214   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.225.12    -j DROP
/sbin/iptables -A OUTGOING -d 216.136.226.117   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.226.118   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.226.209   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.226.210   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.227.168   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.233.129   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.233.130   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.233.131   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.233.133   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.233.135   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.233.148   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.233.151   -j DROP
/sbin/iptables -A OUTGOING -d 216.136.233.152   -j DROP

but, in new version of yahoo messenger i can connect.

is any other way to block yahoo messenger? or is fault in my above solutions?

share|improve this question
    
You could also stop the installer from being downloaded/installed, then you don't need to worry about it being used :) –  AliGibbs Mar 1 '11 at 17:14

2 Answers 2

iptables -A OUTPUT -p TCP -d 0/0 --dport 5050 -j REJECT

This will reject requests on port 5050 going to any ip, please try it and let me know if it works for you

From what i read yahoo can use the http port aswell and i belive a fine way to catch it on the http would be having squid working on it.

You could block these aswell.

iptables -A FORWARD -p TCP --dport 5000:5100 -j REJECT
iptables -A FORWARD -p TCP -d scsa.yahoo.com -j REJECT
iptables -A FORWARD -p TCP -d cs.yahoo.com -j REJECT
iptables -A FORWARD -p TCP -d scsa.msg.yahoo.com -j REJECT
iptables -A FORWARD -p TCP -d messenger.yahoo.com -j REJECT
iptables -A FORWARD -p TCP -d scs.msg.yahoo.com -j REJECT
iptables -A FORWARD -p TCP -d scsb.msg.yahoo.com -j REJECT
iptables -A FORWARD -p TCP -d scsc.msg.yahoo.com -j REJECT

If yahoo messenger then tries to adapt itself picking up any other port you would need to start your firewall having a DROP ALL rule and then openning what you actually need, For example:

Let's say your network is 192.168.1.0/24, the bellow rule will block it:

iptables -A INPUT -s 192.168.1.0/24 -j DROP -p tcp -i eth0
iptables -A INPUT -s 192.168.1.0/24 -j DROP -p udp -i eth0

From here you would create what you want to permit, for example:

#allow only http traffic
iptables -I INPUT -s 192.168.1.0/24 -j ACCEPT -p tcp -i eth0 --dport 80
#allow only https traffic
iptables -I INPUT -s 192.168.1.0/24 -j ACCEPT -p tcp -i eth0 --dport 443

Then if you have squid acting for http, https requests, etc. You would redirect it to squid, from squid you would filter http/s and any other related application from accessing the internet from that network.

You could aswell use squid with squidguard.

share|improve this answer
    
ok, i should test it. –  haw3d Aug 29 '10 at 15:09

why not just give those hostnames a bogus IP (either via CNAME or A) in DNS rather than dropping the packets. seems like it would be less of a load on your firewall (and fewer rules).

share|improve this answer
1  
i say it's not working. you thinking of firewall performance !!!! –  haw3d Aug 29 '10 at 14:41
    
giving those particular hostnames non-routable IPs would solve your problem and reduce load on your systems. –  Devnull Aug 30 '10 at 13:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.