topic Re: Is there a way to block an app or process to access the Internet in General Topics

Is there a way to block an app or process to access the Internet

flachance — Tue, 29 Aug 2023 18:01:14 GMT

Is there a way with either the gateway or the endpoint client to block an app or process to access the Internet?

We don't want to restrict the app from running but we don't want it to access the Internet.

Francis

Re: Is there a way to block an app or process to access the Internet

Tal_Paz-Fridman — Tue, 29 Aug 2023 18:10:47 GMT

You can use the Application Control and URL Filtering blades on the Security Gateway.

In Rulebase add the relevant application to the Services & Applications column:

Re: Is there a way to block an app or process to access the Internet

the_rock — Tue, 29 Aug 2023 18:18:42 GMT

Yes Francis, as @Tal_Paz-Fridman said, you can use app control/urlf for this. I can show you in my R81.20 lab where I have dedicated ordered layer just for this.

Andy

Re: Is there a way to block an app or process to access the Internet

flachance — Wed, 30 Aug 2023 12:13:57 GMT

Yes our problem is it's some small/obscure app that is not part of Checkpoint applications list

Re: Is there a way to block an app or process to access the Internet

Tal_Paz-Fridman — Wed, 30 Aug 2023 12:44:11 GMT

For that you can create a custom application using the URLs it uses

Re: Is there a way to block an app or process to access the Internet

the_rock — Wed, 30 Aug 2023 13:42:43 GMT

As @Tal_Paz-Fridman said, thats your best bet, for sure. As a matter of fact, I did the same in my lab and few customers and works 100% of the time.

Below is example in my R81.20 lab.

Andy

Re: Is there a way to block an app or process to access the Internet

flachance — Tue, 05 Sep 2023 14:45:46 GMT

hmmm ok. But this feels more like URL filtering. You'd have to know where the app might try to connect to which is not our case unfortunately

Re: Is there a way to block an app or process to access the Internet

RS_Daniel — Tue, 05 Sep 2023 15:17:21 GMT

Hello,

Yes, there is. I think both fw and endpoint can do it, but if you have endpoint much better. You can use Application Control blade and you two options, terminate the app when it starts to run, or terminate the app when it tries to connect to network.

https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Harmony-Endpoint-Admin-Guide/Topics-HEP/Configuring-Application-Control-Policy.html

On firewall it is also possible, you can use the option provieded before (yes it is more like URL filtering feture). Or you can create a custom signature for specific application.

https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Harmony-Endpoint-Admin-Guide/Topics-HEP/Configuring-Application-Control-Policy.html

On both cases you must know where the app might tries to connect (If not, how could the firewall know what it has to block?). If you do not know you can always take some traffic captures and check.

Regards