Allowing Skype through Smoothwall

[foofighterjim]

As per the title; we are currently trying to get Skype to work, having read some previous posts here from 4 or 5 years ago I was hoping things may have moved on. Unfortunately I'm hitting the usual brick wall, I have allowed skype.com but then see a multitude of blocked IP addresses on the live web filter when trying to use Skype. Allowing these IP address doesn't seem to help as different addresses appear, I am presuming this is due to the P2P nature of Skype, I have even tried the browser based beta and still have the same problem.

 

Has anyone successfully got Skype working?

[foofighterjim]

[BFCIT]

Hi Foofighterjim,

 

We are also Smoothwall users, Skype is very hit and miss for us. Sometimes it spins around and connects, other times we just get the 'skype cant connect' message.

 

I have tried two alternative methods with a lot more success:

 

1) Make the source IP an exception from the filter and change the proxy settings on the source computer in line with this exception. This works 90% of the time for us and enables a decent connection with Skype.

 

2) Use Skype Beta (web browser version)

 

Hope this is helpful. Fortunately we only use Skype on rare occasions and as such I am in a position to overlook the process and give them unfiltered access via smoothwall and then simply disable it afterwards.

[foofighterjim]

Hi Foofighterjim,

 

We are also Smoothwall users, Skype is very hit and miss for us. Sometimes it spins around and connects, other times we just get the 'skype cant connect' message.

 

I have tried two alternative methods with a lot more success:

 

1) Make the source IP an exception from the filter and change the proxy settings on the source computer in line with this exception. This works 90% of the time for us and enables a decent connection with Skype.

 

2) Use Skype Beta (web browser version)

 

Hope this is helpful. Fortunately we only use Skype on rare occasions and as such I am in a position to overlook the process and give them unfiltered access via smoothwall and then simply disable it afterwards.

 

Yes, what I was thinking of doing was create a new location for the laptop and just allow everything through just for the time it is being used (not ideal but at least it will be supervised whilst in use). I did try the Beta but saw the same issues in the web filter logs as when we used the application i.e. loads of IP addresses being denied.

[Rob_D]

We do the same sort of thing, set up a laptop that bypasses filtering an make sure staff know not to leave it where the kids can use it.

 

The problem, as I understand it, is that skype uses peer-to-peer mesh networking (for calls) so there's no simple set of URLs/IP Addresses that can be unblocked. You would theoretically have to create a policy that includes the IP address of every skype user (No, all of them).

One of the least understood points about Skype is that it doesn't use direct connections. When two people speak on Skype, the data doesn't run straight from one caller's device to the other. In fact, it doesn't simply run from one caller to Skype and then from Skype to the receiver of the call. All computers logged in to Skype are connected in a peer-to-peer network, which runs in the same way as those used for both legal and illegal file sharing. Whenever you make a call, the data is routed through a combination of Skype users' computers to find the most efficient path. As a result, Skype itself drastically reduces the amount of data flowing into and out of its own equipment, cutting its costs.

Edited January 15, 2016 by Rob_D

[bossman]

@foofighterjim

 

I have managed to sort by doing the following:

 

1. Create a user account specifically for Skype usage which has its proxy settings to allow for transparent authentication in SW, this user account is only allowed to login once across the network at anytime, it is a controlled account which the staff only have access when required and can be monitored (Safeguarding) SLT are made aware of its usage and Staff have to justify its use to SLT.

 

2. List of URLs to unblock and also have No https inspection:

 

Skype allowed and No HTTPS inspection:

 

go.skype.com

smetrics.skype.com

login.skype.com

a.config.skype.com

secure.skypeassets.com

secure.skype.com

api.mcr.skype.com

apps.skype.com

apps.skypeassets.com

pipe.skype.com

b.config.skype.com

api.skype.com

 

3. Set reserve IP address for the particular workstation in DHCP that is required for the Skype usage and make that exception in Smoothwall.

 

It works well, is controlled and has a Skype usage policy.

 

Hope this helps

[foofighterjim]

Sounds like quite a bit of work but as I was getting nowhere with my allow everything rule I will give it a shot, thanks!

[mgeddes]

Hi,

 

I'm trying to unblock Skype for all users (staff and students). I've added the list of URLs to No HTTPS Inspection and still having issues making calls to outside the network. Within the network calls can ring and connect. When a call from outside in is made there is no ringing but if you know the call is happening you can connect but you can't call out. HTTPS IPs are whitelisted and HTTP IPs are allowed.

 

Anyone had any success yet?