topic Re: URL Filtering RegEx in Firewall and Security Management

URL Filtering RegEx

rbergstrom — Mon, 08 Feb 2021 11:48:56 GMT

I want to block a URL in application layer. I have https inspection on.

I've made a Application/Site list with "URL's are defined as Regular Expression" and added some sites to it, but I'm struggling to figure out how I would write this URL in RegEx form:

http://lexin.nada.kth.se/lexin/#main=4;

I've tried many different ways but it still not working. Other sites working.

I looked at https://regex101.com/ and I got a match on my expressions but it is still not working.

Thank you

Rikard

Re: URL Filtering RegEx

PhoneBoy — Wed, 10 Feb 2021 16:28:02 GMT

What version/JHF level?
What precise regexes have you tried?

Re: URL Filtering RegEx

rbergstrom — Thu, 11 Feb 2021 08:48:11 GMT

Hi!

we are running r80.40 take 87.

I have tried

.lexin.nada.kth.se/lexin/#main=4;

.lexin.nada.kth.se\/lexin\/#main=4;

.lexin.nada.kth.se/lexin/*main*4*

.lexin.nada.kth.se/lexin/.main.4.

.lexin.nada.kth.se\/lexin\/.main.4;

.lexin.nada.kth.se\/lexin\/*main*4;

and so on. I think the #or the = causing the problem because this url works just fine: .lexin.nada.kth.se/lexin/bildtema-survey.html

Re: URL Filtering RegEx

G_W_Albrecht — Thu, 11 Feb 2021 09:03:54 GMT

Why not block entire http://lexin.nada.kth.se/ ?

Re: URL Filtering RegEx

rbergstrom — Thu, 11 Feb 2021 09:23:09 GMT

We want to reach all the pages on that site except

.lexin.nada.kth.se/lexin/#main=4; and

.lexin.nada.kth.se/lexin/bildtema-survey.html

Re: URL Filtering RegEx

G_W_Albrecht — Thu, 11 Feb 2021 09:59:21 GMT

Use

http:\/\/lexin\.nada\.kth\.se\/lexin\/\#main=4;

Re: URL Filtering RegEx

rbergstrom — Thu, 11 Feb 2021 10:01:26 GMT

I will try this. Thank you for the help!

/Rickard

Re: URL Filtering RegEx

G_W_Albrecht — Fri, 12 Feb 2021 11:58:54 GMT

And did it work as needed ?

Re: URL Filtering RegEx

Bob_Zimmerman — Fri, 12 Feb 2021 15:43:47 GMT

Minor note: this will only match HTTP. The site is available via HTTPS, and the expression above won't match it. If you change the opening to this:

https?:\/\/

it should match both HTTP and HTTPS.

Re: URL Filtering RegEx

G_W_Albrecht — Fri, 12 Feb 2021 20:17:52 GMT

Very true !

Re: URL Filtering RegEx

G_W_Albrecht — Mon, 15 Feb 2021 10:54:21 GMT

So the complete solution is:

https?:\/\/lexin\.nada\.kth\.se\/lexin\/\#main=4;

Re: URL Filtering RegEx

rbergstrom — Mon, 15 Feb 2021 14:48:53 GMT

Hi,

Sorry for the late reply, I have not had the opportunity to test until today.

It did not work as needed. I have a block rule with this regex but I can still reach the site. See attached screenshot. Is it possible for you to try this in a lab?

I tried both http and https.

/Rickard