Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Here are my iptables rules to allow Squid to connect to a web server:

# Accept internally-requested input
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#http,https traffic only through Squid - nobody user
iptables -A OUTPUT -p tcp -m multiport --dports 80,443 \
    -m state -m owner --uid-owner nobody --state NEW,ESTABLISHED -j ACCEPT

Squid itself is listening 3128 port on localhost. In skype options I told it to use squid proxy and to use port 58215 for incoming connections. I added these lines for skype:

#skype incoming connections
iptables -A INPUT -p udp --dport 58215 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --dport 58215 -m state --state NEW,ESTABLISHED -j ACCEPT

But it didn't work.

Then I turned off the firewall:

iptables -P OUTPUT ACCEPT
iptables -P INPUT ACCEPT

Skype started working. So, I looked, what ports does it use:

# netstat -a -ptcp | grep skype
tcp     0    0 *:58215              *:*                     LISTEN      2944/skype
tcp     0    0 pc.home.org:56369    157.55.130.140:40031    ESTABLISHED 2944/skype
tcp     0    0 pc.home.org:54316    db3msgr5011307.ga:https ESTABLISHED 2944/skype
tcp     0    0 pc.home.org:34778    193.120.199.14:12350    ESTABLISHED 2944/skype

# netstat -a -pudp | grep skype
udp        0      0 *:58215                 *:*           2944/skype          
udp        0      0 localhost:42865         *:*           2944/skype       

But when I set restrictive policy:

iptables -P OUTPUT DROP
iptables -P INPUT DROP

Skype stops working. What should I do to make it work?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

It appears Skype use SOCKS or HTTPS proxies. Squid is neither. For incoming connections you need to NAT incoming connections to your PC using the port specified in your Skype settings. For outgoing connections you need to open the ephemeral ports your PC uses.

Skype is not a good citizen in protected environments. If your firewall support upnp, then Skype can use that to keep the damage to a minimum.

I've documented my findings on Firewalling Google Chat and Skype.

share|improve this answer
    
Skype allows https proxying –  user4035 Sep 10 '13 at 13:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.