topic Re: Blocked Porn is getting through! in Firewall and Security Management

Blocked Porn is getting through!

Moudar — Mon, 29 Apr 2024 14:31:37 GMT

As you can see the web page www.superporn.com only as an example, many other porn websites bypassing the same!

was blocked only for 2 logs and then it was accepted all the way!

I wonder why would that happen

The blocking rule is app/url rule:

as you can see above sex and pornography are blocked, but still can be accessed. I have tested 3 different computers and all got some drops by that rule but then they could bypass it!?

Any ideas?

Re: Blocked Porn is getting through!

Chris_Atkinson — Mon, 29 Apr 2024 14:55:14 GMT

Atleast part of the answer is in the log output provided.

QUIC traffic is allowed in your environment and this cannot be inspected.

For now you can block it and it will force it to use HTTPS instead.

Re: Blocked Porn is getting through!

the_rock — Mon, 29 Apr 2024 14:57:32 GMT

Just add custom category *superporn* and that will fix it, for sure.

Andy

Re: Blocked Porn is getting through!

the_rock — Mon, 29 Apr 2024 16:09:09 GMT

K, I was wrong, wont be first or last time lol

@Chris_Atkinson is 100% right. I tested in the lab and as soon as I added quick udp and quic protocol to be blocked, worked as expected, just restarted my browsers and page was blocked, but BEFORE I added quick in the rule below, it was allowed.

Andy

Re: Blocked Porn is getting through!

Moudar — Mon, 29 Apr 2024 20:06:54 GMT

what about all other websites that use Quic protocol? If I block it ?

Re: Blocked Porn is getting through!

the_rock — Tue, 30 Apr 2024 01:20:31 GMT

You need to make an exception in https policy.

Re: Blocked Porn is getting through!

Moudar — Tue, 30 Apr 2024 06:33:38 GMT

what if HTTPS inspection is not active. How to check if our appliance is able to do it or not?

The porn websites still open through HTTPS.

I did add QUIC protocol to the blocked list as you mentioned but now porn websites are using HTTPS instead!

Re: Blocked Porn is getting through!

emmap — Tue, 30 Apr 2024 06:39:51 GMT

Do you have 'Categorise HTTPS sites' enabled in the URLF blade settings?

If you aren't doing HTTPS inspection, the gateway can't see the HTTP header to see the URL in it, so we have to rely on the CN in the cert. I don't know how many porn sites put their full URL in the cert but you might have to check and see what it says if it's still getting through.

Re: Blocked Porn is getting through!

Tom_Hinoue — Tue, 30 Apr 2024 06:52:00 GMT

By any chance the issue is occurring only on Chrome/Edge browser just recently?

We have a similar issue with HTTPS categorization since last week right after the Chrome/Edge version was upgraded to 124, where TLS1.3 handshake is not detected by URL Filtering, and sites are somehow not blocked. This does not occur with Firefox or other browsers.

The issue didn't occur in Chrome ver.123
Usually HTTPS categorization should work with TLS1.3, but somehow its not working since the browser update.

As a workaround, we have disabled the following option in chrome, and sites are able to be blocked by the access policy as before.

chrome://flags or edge://flags
-> TLS 1.3 hybridized Kyber support

I saw some discussions on other forums, that this parameter is affecting URL/content filtering for other vendors like Fortinet and SonicWall.

https://www.reddit.com/r/sysadmin/comments/1carvpd/chrome_124_breaks_tls_handshake/
https://www.sonicwall.com/support/knowledge-base/websites-randomly-gets-blocked-or-allowed-with-no-changes-made-after-browser-upgrades-v124/240422222041287/

Any other people experiencing a similar issue?

Re: Blocked Porn is getting through!

emmap — Tue, 30 Apr 2024 07:03:44 GMT

According to the TLS support SK, TLS 1.3 is only supported in HTTPS Inspection when the gateway is running in User Space (USFW)

TLS SK: https://support.checkpoint.com/results/sk/sk178505

USFW SK: https://support.checkpoint.com/results/sk/sk167052

So enabling USFW might be worth a test for you.

If you're not doing HTTPS Inspection and just doing Categorise HTTPS sites, TLS 1.3 should work in all current versions. https://support.checkpoint.com/results/sk/sk163515

Re: Blocked Porn is getting through!

Moudar — Tue, 30 Apr 2024 08:05:03 GMT

I think you have right here:

I tested Firefox and all porn websites are blocked.

Tested also Edge and Chrome and both are allowing porn websites

Edge version: 124.0.2478.51

Chrome version: 124.0.6367.92

Re: Blocked Porn is getting through!

Moudar — Tue, 30 Apr 2024 08:06:50 GMT

What if our appliance (6500) does not support USFW?

Re: Blocked Porn is getting through!

emmap — Tue, 30 Apr 2024 08:12:15 GMT

All 6000 appliances support USFW and should be enabled by default in current versions. The commands to double check are in the SK there.

Re: Blocked Porn is getting through!

Moudar — Tue, 30 Apr 2024 08:21:10 GMT

it is enabled!

Should I add something to the blocked list?

Re: Blocked Porn is getting through!

Moudar — Tue, 30 Apr 2024 09:12:53 GMT

Here are my firewall stats:

Accelerated conns/Total conns : 161/53539 (0%)
LightSpeed conns/Total conns : 0/53539 (0%)
Accelerated pkts/Total pkts : 27688409458/30831725989 (89%)
LightSpeed pkts/Total pkts : 0/30831725989 (0%)
F2Fed pkts/Total pkts : 3143316531/30831725989 (10%)
F2V pkts/Total pkts : 145057135/30831725989 (0%)
CPASXL pkts/Total pkts : 1297843673/30831725989 (4%)
PSLXL pkts/Total pkts : 24911653523/30831725989 (80%)
CPAS pipeline pkts/Total pkts : 0/30831725989 (0%)
PSL pipeline pkts/Total pkts : 0/30831725989 (0%)
QOS inbound pkts/Total pkts : 0/30831725989 (0%)
QOS outbound pkts/Total pkts : 0/30831725989 (0%)
Corrected pkts/Total pkts : 0/30831725989 (0%)

what is the recommended mode? KSFW or USFW

We are running KSFW today

Re: Blocked Porn is getting through!

Chris_Atkinson — Tue, 30 Apr 2024 09:14:25 GMT

The issue will likely persist to a degree if you don't also handle the QUIC traffic.

Re: Blocked Porn is getting through!

Chris_Atkinson — Tue, 30 Apr 2024 09:21:28 GMT

It's not specific to the sites rather QUIC more broadly, there is an SK that describes the need to mitigate this (see sk108202 / sk112249 / sk111754).

In R82 and above we will introduce support for QUIC / HTTP3 inspection.

Re: Blocked Porn is getting through!

Moudar — Tue, 30 Apr 2024 09:20:56 GMT

I did blocked QUIC:

Re: Blocked Porn is getting through!

Tom_Hinoue — Tue, 30 Apr 2024 09:21:27 GMT

We only have HTTPS categorization enabled on R80.20.XX and R81.10.XX on locally managed SMB firewalls.
The issue does resolve with latest Chrome version if we enable Full SSLINS, but the majority of our customers do not use SSL Inspection.

Btw, there is no way to enable USFW on Gaia Embedded currently(I believe its not supported...) Force setting kernel parameters did not work for us either.

As I mentioned, this issue does not occur on TLS1.3 handshakes in the old Chrome/Edge version 123, I'm assuming the behavior changed in version 124 which the site could not be detected by URLF blade for some reason, unless we disable the problematic option in the browser.

I'm not sure if this behavior is something to be reviewed on the browser side (like a bug?), or something firewall vendors may need to follow to support the default behavior on the new chrome/edge version...

Re: Blocked Porn is getting through!

shais — Tue, 30 Apr 2024 09:29:39 GMT

The recommendation in that case is USFW.

In general, we recommend USFW over KMFW