topic Re: How to block some https sites? in Firewall and Security Management https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24165#M89635 <HTML><HEAD></HEAD><BODY><P>I could not find link to that app. Would you provide please?</P></BODY></HTML> Sat, 02 Feb 2019 06:33:47 GMT Network_M 2019-02-02T06:33:47Z How to block some https sites? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24138#M89608 <HTML><HEAD></HEAD><BODY><P>I have a rule in Checkpoint, in Policy tab:</P><P></P><P>Source: host (one pc with IP)</P><P>Destination: Internet</P><P>Services &amp; Applications: denied_sites</P><P>Action: drop</P><P></P><P>denied_sites: custom site, which contains some urls.</P><P>I wrote both <A href="http://www.example.com,">http://www.example.com,</A>&nbsp;<A href="https://www.example.com">https://www.example.com</A></P><P>After installation policy, rule drops only http, but not https.</P><P>How can I make that rule worked for https too? (Without turning on https inspection)</P><P></P><P>I looked previous questions, but I didn't manage to find solution.</P></BODY></HTML> Sun, 13 Jan 2019 09:29:36 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24138#M89608 Network_M 2019-01-13T09:29:36Z Re: How to block some https sites? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24139#M89609 <HTML><HEAD></HEAD><BODY><P>Copy&amp;paste from help:</P><P></P><P><SPAN style="color: #000000;">In the<SPAN>&nbsp;</SPAN></SPAN><STRONG class="" style="color: #000000; background-color: inherit; font-weight: bold; padding: 0pt;">URL List</STRONG><SPAN style="color: #000000;">, enter the URLs.</SPAN></P><UL class="" style="color: #000000; margin-top: 3pt; margin-bottom: 0pt;"><LI class="" style="color: #000000; background-color: inherit; font-weight: normal; text-decoration: none; text-indent: 0cm; margin: 3pt 0pt 0pt; padding: 0pt;"><STRONG style="color: #ff0000;">Do not include http/https prefixes</STRONG></LI><LI class="" style="color: #000000; background-color: inherit; font-weight: normal; text-decoration: none; text-indent: 0cm; margin: 3pt 0pt 0pt; padding: 0pt;">The URL list supports the use of wild cards, for example to define the sub domains and paths of a top level domain. (<EM class="" style="color: inherit; background-color: inherit; padding: 0pt;">*.checkpoint.com/*</EM>)</LI><LI class="" style="color: #000000; background-color: inherit; font-weight: normal; text-decoration: none; text-indent: 0cm; margin: 3pt 0pt 0pt; padding: 0pt;">Select<SPAN>&nbsp;</SPAN><STRONG class="" style="color: inherit; background-color: inherit; font-weight: bold; padding: 0pt;">URLS are defined as Regular Expression</STRONG><SPAN>&nbsp;</SPAN>to define more complex domain patterns, or for greater specificity.<P class="" style="color: #000000; background-color: inherit; font-weight: normal; text-decoration: none; text-indent: 0cm; margin: 6pt 0cm; padding: 0pt;">For example, if a news site has these links:</P><P class="" style="color: #000000; background-color: inherit; font-weight: normal; text-decoration: none; text-indent: 0cm; margin: 6pt 0cm; padding: 0pt;"><EM class="" style="color: inherit; background-color: inherit; padding: 0pt;"><A class="jive-link-external-small" href="https://www.news.com" rel="nofollow">https://www.news.com</A></EM></P><P class="" style="color: #000000; background-color: inherit; font-weight: normal; text-decoration: none; text-indent: 0cm; margin: 6pt 0cm; padding: 0pt;"><EM class="" style="color: inherit; background-color: inherit; padding: 0pt;"><A class="jive-link-external-small" href="http://www.news.com" rel="nofollow">http://www.news.com</A></EM></P><P class="" style="color: #000000; background-color: inherit; font-weight: normal; text-decoration: none; text-indent: 0cm; margin: 6pt 0cm; padding: 0pt;">To allow access only to the https link, use this regular expression:</P><P class="" style="color: #000000; background-color: inherit; font-weight: normal; text-decoration: none; text-indent: 0cm; margin: 6pt 0cm; padding: 0pt;"><EM class="" style="color: inherit; background-color: inherit; padding: 0pt;">^https:\/\/.*\.news\.com</EM></P><P class="" style="color: #000000; background-color: inherit; font-weight: normal; text-decoration: none; text-indent: 0cm; margin: 6pt 0cm; padding: 0pt;"><STRONG class="" style="color: inherit; background-color: inherit; font-weight: bold; font-size: 14px; padding: 0pt;">Note:</STRONG><SPAN>&nbsp;</SPAN>The application or site URL defined by a regular expression must use the correct syntax.</P></LI></UL></BODY></HTML> Sun, 13 Jan 2019 13:07:43 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24139#M89609 HristoGrigorov 2019-01-13T13:07:43Z Re: How to block some https sites? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24140#M89610 <HTML><HEAD></HEAD><BODY><P>In addition to what <A href="https://community.checkpoint.com/migrated-users/52207">Hristo Grigorov</A>‌ said, you need to confirm what the DN of the certificate of the site you want to block is as that is what is matched.</P></BODY></HTML> Sun, 13 Jan 2019 18:08:51 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24140#M89610 PhoneBoy 2019-01-13T18:08:51Z Re: How to block some https sites? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24141#M89611 <HTML><HEAD></HEAD><BODY><P>Custom URL filtering by SNI</P><P>sk103051</P></BODY></HTML> Mon, 14 Jan 2019 02:40:52 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24141#M89611 Kosin_Usuwanthi 2019-01-14T02:40:52Z Re: How to block some https sites? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24142#M89612 <HTML><HEAD></HEAD><BODY><P>In url list, if I write *.example.com/* it gives error:</P><P>URL cannot contain the following substring: /*</P><P></P><P>Then I wrote *.example.com and it blocks only http, not https.</P><P>It cannot block https sites.</P><P></P><P>What else can be done?</P></BODY></HTML> Thu, 17 Jan 2019 06:47:12 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24142#M89612 Network_M 2019-01-17T06:47:12Z Re: How to block some https sites? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24143#M89613 <HTML><HEAD></HEAD><BODY><P>Do you mean that I should&nbsp;include full domain name of the certificate in URL list?</P></BODY></HTML> Thu, 17 Jan 2019 06:48:20 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24143#M89613 Network_M 2019-01-17T06:48:20Z Re: How to block some https sites? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24144#M89614 <HTML><HEAD></HEAD><BODY><P>Add this:</P><P></P><P>(^|.*\.)*example\.com</P><P></P><P>and make sure "URLs are defined as Regular Expression" is ticked.</P><P></P><P>But if the site is using SNI then you better follow SK mentioned bellow.</P></BODY></HTML> Thu, 17 Jan 2019 06:56:19 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24144#M89614 HristoGrigorov 2019-01-17T06:56:19Z Re: How to block some https sites? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24145#M89615 <HTML><HEAD></HEAD><BODY><P>I have tried adding this and ticked as "Regular Expression".</P><P>I added some sites, not one.</P><P>https is not blocked still.</P><P></P><P>Simple Proxies may block https, why it is so difficult in Checkpoint?</P><P>Can Checkpoint block https?</P></BODY></HTML> Thu, 17 Jan 2019 09:40:24 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24145#M89615 Network_M 2019-01-17T09:40:24Z Re: How to block some https sites? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24146#M89616 <HTML><HEAD></HEAD><BODY><P>What we experienced is that putting more than 1 line in the urls field will break the https recognition abilities.</P><P>Try to change the custom application to only one url like example\.com as a regular expression and check to see if https categorization is turned on when you do not have https inspection enabled.</P></BODY></HTML> Thu, 17 Jan 2019 09:42:54 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24146#M89616 Maarten_Sjouw 2019-01-17T09:42:54Z Re: How to block some https sites? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24147#M89617 <HTML><HEAD></HEAD><BODY><P>Whatever it says in the DN of the certificate.</P></BODY></HTML> Thu, 17 Jan 2019 18:00:42 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24147#M89617 PhoneBoy 2019-01-17T18:00:42Z Re: How to block some https sites? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24148#M89618 <HTML><HEAD></HEAD><BODY><P>How to see DN of the certificate? I could not find</P></BODY></HTML> Fri, 18 Jan 2019 03:59:30 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24148#M89618 Network_M 2019-01-18T03:59:30Z Re: How to block some https sites? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24149#M89619 <HTML><HEAD></HEAD><BODY><P><STRONG>This is certificate DN:</STRONG></P><P></P><P><IMG class="image-3 jive-image" src="https://community.checkpoint.com/legacyfs/online/checkpoint/77086_pastedImage_3.png" /></P><P></P><P><STRONG>This is certificate w/o SNI:</STRONG></P><P></P><P><IMG class="image-1 jive-image" src="https://community.checkpoint.com/legacyfs/online/checkpoint/77084_pastedImage_1.png" /></P><P></P><P><STRONG>This is certificate with SNI:</STRONG></P><P></P><P><IMG class="image-2 jive-image" src="https://community.checkpoint.com/legacyfs/online/checkpoint/77085_pastedImage_2.png" /></P></BODY></HTML> Fri, 18 Jan 2019 04:57:33 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24149#M89619 HristoGrigorov 2019-01-18T04:57:33Z Re: How to block some https sites? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24150#M89620 <HTML><HEAD></HEAD><BODY><P>How can I block <A class="unlinked">https://z1.fm</A>&nbsp;site for example?</P></BODY></HTML> Thu, 24 Jan 2019 12:16:41 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24150#M89620 Network_M 2019-01-24T12:16:41Z Re: How to block some https sites? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24151#M89621 <HTML><HEAD></HEAD><BODY><P>^https:\/\/z1\.fm</P></BODY></HTML> Thu, 24 Jan 2019 12:29:09 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24151#M89621 HristoGrigorov 2019-01-24T12:29:09Z Re: How to block some https sites? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24152#M89622 <HTML><HEAD></HEAD><BODY><P>I have checked, it does not block. Any other solution?</P></BODY></HTML> Fri, 25 Jan 2019 06:52:46 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24152#M89622 Network_M 2019-01-25T06:52:46Z Re: How to block some https sites? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24153#M89623 <HTML><HEAD></HEAD><BODY><P>I am sorry mate, no idea what is wrong. It works for me here.</P></BODY></HTML> Fri, 25 Jan 2019 07:03:03 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24153#M89623 HristoGrigorov 2019-01-25T07:03:03Z Re: How to block some https sites? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24154#M89624 <HTML><HEAD></HEAD><BODY><P>Thank you anyway mate! Then I have to write to tech.support.</P></BODY></HTML> Fri, 25 Jan 2019 07:25:01 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24154#M89624 Network_M 2019-01-25T07:25:01Z Re: How to block some https sites? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24155#M89625 <HTML><HEAD></HEAD><BODY><P>The CN of the certificate for z1.fm&nbsp;is sni.cloudflaressl.com, as shown below:</P><P></P><P><IMG __jive_id="77957" class="image-1 jive-image" src="https://community.checkpoint.com/legacyfs/online/checkpoint/77957_pastedImage_2.png" /></P><P></P><P>This means you cannot currently use the URL z1.fm to block, as we will see sni.cloudflatessl.com, at least in the manner described.</P><P>Right now, you can do one of two things:</P><UL><LI>Enable HTTPS Inspection</LI><LI>Create a signature for this site using the Application Control Signature Tool:&nbsp;<A class="link-titled" href="https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk103051" title="https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk103051">Signature Tool for custom Application Control and URL Filtering applications</A>&nbsp;</LI></UL><P></P><P>In general, we do plan to improve our support for SNI in the near future.</P></BODY></HTML> Sat, 26 Jan 2019 00:30:54 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24155#M89625 PhoneBoy 2019-01-26T00:30:54Z Re: How to block some https sites? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24156#M89626 <HTML><HEAD></HEAD><BODY><P>Ok, can we block that site by its IP addresses then?</P></BODY></HTML> Sun, 27 Jan 2019 06:21:21 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24156#M89626 Network_M 2019-01-27T06:21:21Z Re: How to block some https sites? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24157#M89627 <HTML><HEAD></HEAD><BODY><P>You can, but it's possible you will also block some legitimate sites in the process (not to mention the IP could change, being behind CloudFlare).</P><P>Is there some reason you can't use the Application Control Signature Tool to create a signature for the site?</P></BODY></HTML> Sun, 27 Jan 2019 07:55:19 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-block-some-https-sites/m-p/24157#M89627 PhoneBoy 2019-01-27T07:55:19Z