[FW-1] blocking msn and yahoo messenger

[Leonardo Boulton <lboulton@FW1-NOSPAMCYBERTECHPROJECTS.COM>]

I've tryed to block the msn and yahoo messenger with a FireWall-1 NG (FP1
and FP2).

First let's talk about the MSN Messenger: I saw the logs and found the port
1863 tcp. I bolcked it explicitly with a rule. Then I noticed that if the
messenger cann't connect through the port, it trys through port 80 (http),
to a server: something.msgr.hotmail.com.
So, my next move was to create a resource (wich I think is created wrong
because it doesn't work). I created a URI resorce named Hotmail, that blocks
http, selected PUT and GET, only checked transparent mode (i think the
mistake is there) for wildcards, and specified the host: *.msgr.hotmail.com,
path: *, query: *.
Then added a rule above the internet access rule. The source is the Proxy,
destination any, service http->hotmail.

I tested my procedure on an FP2 first, on a separate firewall that's not
conected. I mean, I tested it with just one machine and i thought it
worked!!. Afterwards I did the same thing with an NG FP1 firewall that is
connected to an Internal LAN. My sorprise was that the resource blocks
almost every http conection.

With the Yahoo messenger is even worse. It first tryes conecting through the
port 5050 wich I blocked, then tries via http, and if it is blocked aswell,
it goes for the telnet.... i have no idea how to block something like that.
Imagine if the user selects that he or she is behind a firewall on the
preferences!!!.

Napster was the same thing, it tested one port, if it was blocked, it tried
another one, and another one, until it finds an open port.

Any suggestions to block these two popular messengers?... I imagine this is
a well known topic, since it is in vogue here.

Thanks a lot.

Leonardo Boulton

Network Security Engineer
CyberTech Projects
web:    www.cybertechproject.com
email:  lboulton@cybertechprojects.com
phone:  (cel:    (msn id: leoboulton@hotmail.com
Caracas, Venezuela

=================================================
To set vacation, Out Of Office, or away messages,
send an email to LISTSERV@lists.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================