How to setup iptables rules to allow skype

iptablesskypesquid

Here are my iptables rules to allow Squid to connect to a web server:

# Accept internally-requested input
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#http,https traffic only through Squid - nobody user
iptables -A OUTPUT -p tcp -m multiport --dports 80,443 \
    -m state -m owner --uid-owner nobody --state NEW,ESTABLISHED -j ACCEPT

Squid itself is listening 3128 port on localhost. In skype options I told it to use squid proxy and to use port 58215 for incoming connections. I added these lines for skype:

#skype incoming connections
iptables -A INPUT -p udp --dport 58215 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --dport 58215 -m state --state NEW,ESTABLISHED -j ACCEPT

But it didn't work.

Then I turned off the firewall:

iptables -P OUTPUT ACCEPT
iptables -P INPUT ACCEPT

Skype started working. So, I looked, what ports does it use:

# netstat -a -ptcp | grep skype
tcp     0    0 *:58215              *:*                     LISTEN      2944/skype
tcp     0    0 pc.home.org:56369    157.55.130.140:40031    ESTABLISHED 2944/skype
tcp     0    0 pc.home.org:54316    db3msgr5011307.ga:https ESTABLISHED 2944/skype
tcp     0    0 pc.home.org:34778    193.120.199.14:12350    ESTABLISHED 2944/skype

# netstat -a -pudp | grep skype
udp        0      0 *:58215                 *:*           2944/skype          
udp        0      0 localhost:42865         *:*           2944/skype

But when I set restrictive policy:

iptables -P OUTPUT DROP
iptables -P INPUT DROP

Skype stops working. What should I do to make it work?

Best Answer

It appears Skype uses SOCKS or HTTPS proxies. Squid is neither. For incoming connections you need to NAT incoming connections to your PC using the port specified in your Skype settings. For outgoing connections you need to open the ephemeral ports your PC uses.

Skype is not a good citizen in protected environments. If your firewall supports upnp, then Skype can use that to keep the damage to a minimum.

I've documented my findings on Firewalling Google Chat and Skype.

Related Question