topic Re: restrict outbound https traffic from going to web mail portals in AI Network Firewall

restrict outbound https traffic from going to web mail portals

Daniel_Kavan — Fri, 03 Oct 2025 19:24:38 GMT

Hi mates,

Is there a way to restrict outbound https traffic from going to web mail portals. We want to allow users to use https, but we don't want them to send email. Also, would outbound https inspection be needed?

Re: restrict outbound https traffic from going to web mail portals

the_rock — Fri, 03 Oct 2025 21:59:28 GMT

Im thinking one rule to allow port 443 and another to block 25?

Andy

Re: restrict outbound https traffic from going to web mail portals

PhoneBoy — Fri, 03 Oct 2025 22:14:15 GMT

You would have to block specific webmail portals to do that, which would most likely require HTTPS Inspection.

Re: restrict outbound https traffic from going to web mail portals

Bob_Zimmerman — Fri, 03 Oct 2025 22:23:28 GMT

Not necessarily. As long as Manage & Settings > Blades > Application Control > Categorize HTTPS Websites is enabled, URL Filtering should work. Then as long as you have a services contract for the firewall, you can add a rule to block the "Email" category.

TLSv1.3 with encrypted SNI throws a wrench into this, but it should be possible to block that in various ways, including via Group Policy.

Re: restrict outbound https traffic from going to web mail portals

the_rock — Sat, 04 Oct 2025 16:37:20 GMT

I would say this is pretty good AI answer : - )

Andy

*********************

🔐 Why HTTPS Inspection Is Often Necessary

Webmail portals (like Gmail, Outlook Web Access, Yahoo Mail) use HTTPS encryption, which hides the full URL path and content from traditional firewalls. Without HTTPS inspection, you can only see the domain name (e.g., mail.google.com) — not the full URL (e.g., mail.google.com/inbox) or user actions.

Without HTTPS Inspection: You can block domains like mail.google.com, but you can't block specific actions like sending emails or accessing attachments. [techdocs.b...oadcom.com]
With HTTPS Inspection: You decrypt the traffic temporarily, inspect it, and re-encrypt it. This allows:
- Full URL filtering
- Content inspection (e.g., blocking uploads)
- More granular control over user behavior [www.cloudflare.com], [sslinsights.com]

✅ Best Practices for Blocking Webmail Access

Here’s how to implement this securely and effectively:

1. Enable HTTPS Inspection (SSL/TLS Interception)

Use a firewall or secure web gateway that supports SSL inspection.
Deploy a trusted root certificate to user devices to avoid browser warnings.
Limit inspection to high-risk categories (e.g., webmail, social media) to reduce privacy concerns. [sslinsights.com]

2. Use URL Filtering

Block known webmail domains (e.g., mail.google.com, outlook.live.com, mail.yahoo.com) using domain-based filtering. [techdocs.b...oadcom.com]
Use category-based filtering to block “Webmail” or “Email” categories in your firewall or proxy settings. [knowledgeb...tworks.com]

3. Apply Application Control

Use App-ID or similar technology (e.g., Palo Alto, Fortinet, Cisco) to detect and block webmail applications based on behavior, not just URLs. [knowledgeb...tworks.com]

4. Whitelist Essential HTTPS Sites

Allow HTTPS traffic to trusted business-critical domains.
Avoid blanket HTTPS blocking — instead, use a “default deny” policy with specific allow rules. [securemyorg.com]

5. Monitor and Log

Enable logging for blocked attempts to access webmail.
Review logs regularly to identify bypass attempts or misconfigurations.