0

I run a firewall on a central router. Recently, several users want to use Skype. Since firewalling Skype virtually means to switch the firewall off, I consider to allow users to temporarily punch holes for their system. Since the users have no accounts on the router, I consider using Kerberos for authentication and authorization.

The router is a Debian Squeeze box, with minimal configuration, i.e. no web-server, database or similar gimmicks.

Does anyone know an existing solution, which could be used for that purpose? Or does anybody know easy to use and well documented frameworks in say Perl, Python, C, C++, ... making the set-up of a Kerberos authenticated Client and Server application really simple?

Lars Hanke
  • 281
  • 2
  • 15
  • 1
    It should be possible to permit people to use Skype without completely opening the firewall. If you want to permit this for a limited set of users, why not require those users to setup a VPN, and then firewall the VPN clients differently? – Zoredache Nov 04 '13 at 21:15

1 Answers1

1

You could use a UPNPD daemon to open ports on demand. Some daemons such as miniupnpd will build restrictive rules which only open the ports to the requesting server. The daemon will adjust your iptables firewall by maintaining rules in a couple of chains.

I investigated Firewalling Google Chat and Skype. I found that Skype is not designed to play well with firewall restrictions. Each user needs an incoming port forwarded to their device. Additional ports are required for each connection. However, it is not necessary to shut the firewall down to use Skype. Other than the incoming port for each user, you will need to enable outgoing connections on the ephemeral ports for the devices being used. Incoming restrictions can be quite tight.

I was able to get miniupnpd working with a Shorewall firewall by adding the required chains in the start configuration file.

BillThor
  • 27,354
  • 3
  • 35
  • 69
  • It's actually not that bad. Skype works well behind NAT, but you have to open outgoing connections from any unprivileged port to any unprivileged port anywhere. And since it's all encrypted there is no hope for a conntrack module. – Lars Hanke Nov 05 '13 at 19:03