Skype is a proprietary voice-over-ip (VoIP) protocol based on peer-to-peer (p2p) technology. It requires a vast number of open ports for communication - a security nightmare. For professional IP telephony you might want to take a look at SIP based solutions instead. SIP is a standardised open VoIP protocol and with DEFENDO's integrated SIP proxy it is easy to set up.

The Skype protocol requires a lot of ports for communication. All these ports are used within a very short period of time which triggers DEFENDO's portscan protection. Further connections will be dropped temporarily. As the Skype client continues with its connection attempts the problem will persist and the corresponding PC will loose its Internet connectivity. The same problem will occur if Skype is configured to use an HTTP(S) proxy. You will have to use DEFENDO's SOCKS proxy if you need Skype.

First of all it has to be deliberated about whether a userspecific configuration of the SOCKS proxy is prefered or if it is sufficient to identify the Skype clients by IP address and grant access to the whole network or individual workstations.

Global configuration

Global SOCKS rules apply to all users no matter if they authenticate themselves or not. Configure the rules at "Modules > More Proxies > SOCKS proxy".

Userspecific configuration

The userspecific rules will apply after successfull authentication of the corresponding user. Each DEFENDO user who is member of group system-proxy can have his own set of SOCKS rules. Hence the SOCKS rules for Skype have to be added for each individual user who needs to use Skype. Add userspecific rules below "System > User administration > Users" by selecting the user and clicking on tab "SOCKS proxy".

Skype requires very liberal SOCKS rules. You need to add rules for both, TCP and UDP. The only restriction you may impose is the source IP. Skype uses no defined port range or servers which could be used to narrow the rules down. The rules can either be applied as userspecific or global rules.

The Skype client has to be configured to use the SOCKS proxy. All settings can be applied below "Actions > Options > Connections". Select SOCKS5 as proxy protocol and enter DEFENDO's IP as "Host". The SOCKS proxy listens on port 1080. If you configured the SOCKS rules per user on DEFENDO, you will also have to enable user authentication.

Now you should be able to connect to the Skype network through the SOCKS proxy. As all connections are now tunneled to the SOCKS server there shouldn't be any more portscan related issues.