DNS to block google talk

DNS to block google talk
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
DNS to block google talk Julian Dragut 08-10-2006
Posted by Julian Dragut on August 10, 2006, 2:32 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi,

I'm trying to block google talk by using the dns lookup to
chatenabled.mail.google.com to return 127.0.0.1, but I don't want to block
any other google services/sites.

Creating and maintaining a primary zone is out of the scope, secondary zone
won't transfer to my server (duh) and I was wondering is there are other
options down there ....

Thanks

J



Posted by Roger Abell [MVP] on August 10, 2006, 3:07 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Most of the time such IP spoof blockage is effected via the hosts file,
as it takes priority in the Windows resolver over DNS resolution.
Now, that is not a centralize approach, but implemented on each client
with NTFS to prevent their changing it. However, as mail.google.com
is not your zone your only other choice is to define a privately accessed
primary zone and populate it with what is needed (which of course you
would have to guess and otherwise work out . . . and then wait for it to
need alterations, new records, changed IPs, etc. . . . a total mess).

The real solution is filtering at your network edge.

--
Roger Abell
Microsoft MVP (Windows Server : Security)


> Hi,
>
> I'm trying to block google talk by using the dns lookup to
> chatenabled.mail.google.com to return 127.0.0.1, but I don't want to block
> any other google services/sites.
>
> Creating and maintaining a primary zone is out of the scope, secondary
> zone won't transfer to my server (duh) and I was wondering is there are
> other options down there ....
>
> Thanks
>
> J
>



Posted by Julian Dragut on August 10, 2006, 3:46 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Thanks Roger,

I cannot use neither ISA nor the PIX firewall for specific reasons. I would
like to play with the host file at a central location rather than all the
users on the network, but a host file on a DNS server doesn't seem to be
doing too much.
Any more ideas?

Thanks,

J
> Most of the time such IP spoof blockage is effected via the hosts file,
> as it takes priority in the Windows resolver over DNS resolution.
> Now, that is not a centralize approach, but implemented on each client
> with NTFS to prevent their changing it. However, as mail.google.com
> is not your zone your only other choice is to define a privately accessed
> primary zone and populate it with what is needed (which of course you
> would have to guess and otherwise work out . . . and then wait for it to
> need alterations, new records, changed IPs, etc. . . . a total mess).
>
> The real solution is filtering at your network edge.
>
> --
> Roger Abell
> Microsoft MVP (Windows Server : Security)
>
>
>> Hi,
>>
>> I'm trying to block google talk by using the dns lookup to
>> chatenabled.mail.google.com to return 127.0.0.1, but I don't want to
>> block any other google services/sites.
>>
>> Creating and maintaining a primary zone is out of the scope, secondary
>> zone won't transfer to my server (duh) and I was wondering is there are
>> other options down there ....
>>
>> Thanks
>>
>> J
>>
>
>



Posted by karl levinson, mvp on August 10, 2006, 8:20 pm
If you were  Registered and logged in, you could reply and use other advanced thread options


> Thanks Roger,
>
> I cannot use neither ISA nor the PIX firewall for specific reasons. I
> would like to play with the host file at a central location rather than
> all the users on the network, but a host file on a DNS server doesn't seem
> to be doing too much.
> Any more ideas?

From a google search, it sounds like the preferred way to block is to to
some sort of TCP/IP filtering rules to block connections to talk.google.com
on TCP port 5222 and/or 443. If you can't use your firewalls [not sure why
not], you can also do that at routers, at the hosts via IPSec, etc.



Posted by karl levinson, mvp on August 10, 2006, 8:18 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> Hi,
>
> I'm trying to block google talk by using the dns lookup to
> chatenabled.mail.google.com to return 127.0.0.1, but I don't want to block
> any other google services/sites.
>
> Creating and maintaining a primary zone is out of the scope, secondary
> zone won't transfer to my server (duh) and I was wondering is there are
> other options down there ....

So you can't create a new zone called chatenabled.mail.google.com on your
DNS servers? I used to do that with oscar.aol.com to block AIM and it
worked just fine, without breaking AIM functionality. We had our own
internal DNS servers, and they were set up as forwarders for anything they
couldn't resolve themselves.

Sorry, the best ways to do this are to create a DNS zone, or block the IP
addresses for those hosts at your firewall, or use a proxy server that can
block. If you're restricted from doing those things, then you're being
restricted from using your central network and security devices to do what
they were intended to do, and you'll have to consider something not
centralized and less than optimal, like hosts files, IPSec filter rules on
all the clients via AD Group Policy or a script file, etc.



Similar ThreadsPosted
Is this the right group to talk about EFS? March 24, 2008, 1:52 am
New Google Toolbar August 10, 2006, 10:50 am
Forgot What You Searched For? Google Didn't... January 21, 2006, 1:08 am
Hacking Google Search June 6, 2006, 9:38 pm
incorrect google search September 7, 2006, 7:04 pm
Google toolbar and web security December 10, 2006, 2:50 pm
How did Google Know my System ws infected? February 2, 2007, 1:12 pm
block skype January 5, 2006, 3:22 am
Block Keywords April 25, 2006, 3:01 pm
BLOCK SKYPE July 10, 2006, 9:42 am

The site map in XML format XML site map

Contact Us | Privacy Policy