Home / server / Questions / 289010
Accepted
Hubert Kario
Asked: 2011-07-12 05:03:59 +0800 CST

Blocking Team Viewer

  • 772

I'd like to block incoming TeamViewer connections to my network, but at the same time to allow outgoing TeamViewer connections.

So that users can't connect to their work PCs with TV (circumventing domain authentication) but at the same time could connect to clients PCs to help fix problems.

Is it at all possible?

firewall teamviewer ips ids

3 Answers

  1. Best Answer

    It's impossible to block in traditional firewall. You'll need some kind of packet-analyzer.

    Or you could create a GPO that sets the following registry-key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TeamViewer\Version6\Security_AcceptIncoming REG_DWORD=0

    This disables incoming connections.

    • 4

  2. You could try to disable incoming connections on the ports Teamviewer uses. I'm sure TV uses the following ports;

    5938/tcp
80/tcp

    and maybe also 

    443/tcp
5939/tcp

    or maybe you can do something with the url TV uses for connection.

    *.teamviewer.*
*dyngate*

    dont know if you need those urls for outgoing connections but you can test that.

    • 1

  3. In most cases, the network paths that applications use are asymmetrical; that is, you can block the appropriate port on incoming traffic to prevent incoming connections, but allow traffic on that port to leave to permit outgoing ones.

    If you're working with Windows computers that are on a domain, you can use Active Directory Group Policies to configure the Windows Firewall on those computers to block the appropriate incoming ports.

    However, in the specific case of TeamViewer, they provide a client program that a user can run which connects to TeamViewer's servers and routes incoming connections along that path; thus, an incoming firewall wouldn't be sufficient. You would also need to set up a rule (either with Windows Firewall or elsewhere on your network) to block traffic going to teamviewer.com, but then your users wouldn't be able to use the tool themselves.

    In short, I don't think it'll be easy to block the TeamViewer application from accepting incoming connections, while still allowing it to start outgoing ones. What I would do in this situation is to install Wireshark on a client computer and profile the network traffic involved in both an incoming connection with the client listening, and in an outgoing connection to work on a different computer. It's possible there'll be some types of traffic that appear on only the incoming connection, which you can then block with the Windows Firewall to prevent those connections from working.

    • 0