Skype and smoothwall

[Sheridan]

I know its an old problem, but I haven't found any recent solutions to this. Is there any way to allow the skype windows based program through smoothwall?

 

I'vw whitelisted the skype sites, but I see a load of 407 and 503 errors going to a raft of https ip addresses. Even if I allow the category of https sites with ip addresses I get the same.

 

Ideally I'd want staff to be be able to use skype but it looks like a mess to try and sort out. Looking at the firewall logs the pc we're testing on is hammering it on 80/443/37957 and lots of high ports so does it even work with a proxy properly?

Edited November 22, 2016 by Sheridan

[free780]

I found I had to define the port as 443 using the reg key. See https://download.skype.com/share/business/guides/skype-it-administrators-guide.pdf .

[Sheridan]

Never seen that guide before, thanks!

 

Can I ask what reg key you set, to make sure I'm doing the same thing?

[free780]

I did this

Windows Registry Editor Version 5.00

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Skype\Phone]

"DisableVersionCheck"=dword:00000001

"DisableSupernode"=dword:00000001

"ProxySetting"="HTTPS"

"ProxyAddress"=":"

 

Think I just did it manually as it was just for 1 user. Is it a big deployment? If so you can use the GPO method.

[Sheridan]

I did this

Windows Registry Editor Version 5.00

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Skype\Phone]

"DisableVersionCheck"=dword:00000001

"DisableSupernode"=dword:00000001

"ProxySetting"="HTTPS"

"ProxyAddress"=":"

 

Think I just did it manually as it was just for 1 user. Is it a big deployment? If so you can use the GPO method.

 

Its only for a handful of users so not a big problem. Still can't get it to connect though, even logged in as an admin. Oddly though it seems to work on a couple of W10 machines, but not W7!

[Sheridan]

What a nasty little program skype is, it just scatters requests across http/s/ips all over the place. I don't think there is a realistic way I can get smoothwall to allow it through, without basically removing filtering and https inspection!

[robyholmes]

Can you not use Skype For Business then allow it to communicate with Skype users? Although I've got problems getting Skype For Business out I don't think its as bad as Skype.

[free780]

Its VoIP uses random ports using UDP. Its not great via a proxy. I think interception will kill it. You may just have to allow through your firewall.

[Sheridan]

Its VoIP uses random ports using UDP. Its not great via a proxy. I think interception will kill it. You may just have to allow through your firewall.

 

Yeah its a pretty odd little program, even when specifying a proxy it heads off to the firewall, as well as the proxy.

[Rob_D]

As it was explained to me, skype uses a (sort of) distributed P2P model, whereby any machine running skype can be use to route traffic (or something to that effect), so it could try to connect to/through virtually any computer on the internet.

The only way we've been able to get around it on SmoothWall is to set up a single "Skype" computer that bypasses all the filtering, but this was a couple of years back, so SW might have found a better way to get around it.

[5tu]

The only way I got it to work was to create a DO NOT INSPECT HTTPS rule for all addresses containing an IP address (yes, I know) and apply it to the very few users that use Skype in our school.

[Sheridan]

As it was explained to me, skype uses a (sort of) distributed P2P model, whereby any machine running skype can be use to route traffic (or something to that effect), so it could try to connect to/through virtually any computer on the internet.

The only way we've been able to get around it on SmoothWall is to set up a single "Skype" computer that bypasses all the filtering, but this was a couple of years back, so SW might have found a better way to get around it.

 

Yeah it uses its own grubby little protocol. The only way around is I'll allow traffic from the individual PC through the firewall when the Skype session is on. Smoothwall I think are of the same attitude that it needs unsafe rules opening for temporary use.

Edited November 24, 2016 by Sheridan