topic Re: URL Filtering for hosted services in Firewall and Security Management

URL Filtering for hosted services

Moe_89 — Wed, 24 Apr 2019 16:06:38 GMT

Checkmates,

Can URLF work for websites/services published through Checkpoint ? For example, A web server hosted behind Checkpoint is published as abc.com on the internet. Can URLF policies be enforced on inbound traffic so that akamai, tor or any anonymizers can be blocked from accessing the hosted website.

Re: URL Filtering for hosted services

PhoneBoy — Wed, 24 Apr 2019 16:17:06 GMT

If you want to block traffic coming from TOR addresses, this doesn't require URL Filtering. See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk103154
I'm curious what the use case is for blocking traffic from Akamai IPs since they usually serve as a cache.
I guess if they use a particular User Agent to reach your site, you could create an Application Control signature to check for that and block on it.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk103051
Note this will require using HTTPS Inspection if the site is available via HTTPS.

Re: URL Filtering for hosted services

Moe_89 — Wed, 24 Apr 2019 16:51:53 GMT

Hi Dameon,
Thanks for your response. Akamai is just used as an example. We would want to block mainly anonymizers, TOR etc. We see many requests originating from servers trying to access content of the published site which we would like to block.

Not sure if creating one custom application signature would suffice because the site may be browsed from everywhere on the internet.

Re: URL Filtering for hosted services

PhoneBoy — Fri, 26 Apr 2019 17:13:15 GMT

In that case, it's best to block by IP and not use App Control/URL Filtering.

The SK I referred to previously is a starting point, another possible approach is: http://opendbl.net/#checkpoint.html

Re: URL Filtering for hosted services

Wolfgang — Fri, 26 Apr 2019 18:53:15 GMT

Mubarizuddin_Mo,

beside the recommendations of Dameon and following your original question.

Yes, URLF works too from external to internal webservers. It works in all directions.

We are using this to control access to some special URL-pathes on our webservers. To allow only special sources to special pathes.

Wolfgang