microsoft proxy server v2.0

Posted on 2002-05-27
Medium Priority
Last Modified: 2012-06-27
I use MS proxy server and it works fine. I know how to block sites using our firewall. But the socks proxy is more complicated. users access sites note through http but through tcp or udp ports. How can i find out which ports they are using so i can block these using my firewall.


Question by:sedatriza
LVL 23

Expert Comment

by:Tim Holman
ID: 7038762
Set up full logging on your firewall so you can get an idea of what's going through, then after about a week or so tighten things down, advise your users there's a new firewall and start letting only specific ports through.
Usually you'd let out ports 80 http, 443 https, 53 DNS, 25 SMTP, and let NOTHING in (unless you have internal servers, in which case identify the protocols they use and allow these through)

Author Comment

ID: 7038775
thanks for that.
error in my original question it's winsock and not socks

i can see user activity in the winsock windows and can see these entries in the log files. But it does not tell me which port they are using. I could tighten things down and gradually release them. it would be handy to know what ports are being used.



Accepted Solution

buyer earned 600 total points
ID: 7039041
All that should be in the log files. Goto http://rr.sans.org/incident/proxy.php
for descriptions on the logs and whats in them.
Increase Security & Decrease Risk with NSPM Tools

Analyst firm, Enterprise Management Associates (EMA) reveals significant benefits to enterprises when using Network Security Policy Management (NSPM) solutions, while organizations without, experienced issues including non standard security policies and failed cloud migrations


Expert Comment

ID: 7039056
Oh yeah, if you are looking for the source port then MS Proxy doesnt log that (At least Im 95% sure that it doesnt).
LVL 13

Expert Comment

ID: 7118032
Users will access sites through ports. HTTP uses TCP port 80, SMTP TCP port 25, DNS lookups UDP port 53, etc...

Blocking websites through MS Proxy would be quite a time consuming task.  Also, I believe you'd have to use the Proxy server as a firewall (i.e. have a direct connection to the net).  If you do have a reasonable firewall in place, it'd be easier to restrict access using Global groups.

i.e. create groups called Web granted (ports 80 and 443 - HTTP and HTTPS), FTP granted (port 21), etc... and place users in these groups to allow them access.  Then modify your fireweall to allow the Proxy server outbound access to these service rather than individual machines.

This is a good way of bolting down internet access with minimal admin overhead.  If a user requires, say, FTP access, simply place them in the relevant group.

If you want to block specific sites, I would look into a specific content filtering solution - some can be quite cheap if all you require is a URL database.  It'll also save you a lot of work maintaining a list of blocked sites, especially as a lot of these questionable sites constantly change their DNS to get around filtering packages.

Expert Comment

ID: 8623940
Administrative Action - Force Accepted.

Community Support Moderator @Experts Exchange

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

This blog will spread awareness about Dropbox. We have given the statements based upon our experience. Along with this, there is a section of some new plans that should be added in Dropbox this year. This will make the storage service enhanced from …
The Super Bowl is just days away. Millions of advertising dollars will be spent in just a few hours to drive people to websites around the globe. Optimizing your site in anticipation of a big event like this (and the traffic surges that follow) will…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
This video Micro Tutorial shows how to password-protect PDF files with free software. Many software products can do this, such as Adobe Acrobat (but not Adobe Reader), Nuance PaperPort, and Nuance Power PDF, but they are not free products. This vide…

607 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question