topic Re: URLF Regular Expression in General Topics

URLF Regular Expression

GigaYang — Mon, 06 Jan 2025 18:25:13 GMT

Hello everyone,
We have a website control requirement as follows:

https://www.example.com (Permit)
https://www.example.com/forum/popular/buzz?tab=popular(Block)

I plan to control it through HTTPS Inspection + URLF.

So I wrote a Regular Expression as follows:
\.example\.com\/forum\/popular\/buzz?tab=popular

But the result is a failure. Please tell me how to modify it.

Thanks

Re: URLF Regular Expression

the_rock — Mon, 06 Jan 2025 18:29:01 GMT

Hey @GigaYang

I would make sure rule to block comes first, or if you are allowed, send me actual sites directly and Im happy to test in the lab.

Andy

Re: URLF Regular Expression

GigaYang — Mon, 06 Jan 2025 19:03:14 GMT

https://www.cmoney.tw/forum/popular/buzz?tab=popular

Re: URLF Regular Expression

the_rock — Mon, 06 Jan 2025 19:05:54 GMT

So you want to do below?

block -> https://www.cmoney.tw/forum/popular/buzz?tab=popular

allow -> https://www.cmoney.tw

Right?

Andy

Re: URLF Regular Expression

GigaYang — Mon, 06 Jan 2025 19:13:55 GMT

Hi Rock,

Yes, we need it.

Re: URLF Regular Expression

the_rock — Mon, 06 Jan 2025 19:15:15 GMT

Will test it shortly and let you know.

Andy

Re: URLF Regular Expression

Lesley — Mon, 06 Jan 2025 19:16:32 GMT

Sometimes if you use regular expression it can impact gateway performance.

Make sure when you are done with the changes and pushed them to the firewall, to run a HCP health check.

Any incorrect configured expressions that could cause high load are listed in this report.

Re: URLF Regular Expression

GigaYang — Mon, 06 Jan 2025 19:20:13 GMT

Hi Lesley,

Thank you for your reminder.

Re: URLF Regular Expression

the_rock — Mon, 06 Jan 2025 20:07:35 GMT

Hm, cant seem to block it, though I even made sure its not bypassed in inspection policy. Let me keep trying/

Andy

Re: URLF Regular Expression

Timothy_Hall — Tue, 07 Jan 2025 01:54:45 GMT

Try this:

\.example\.com\/forum\/popular\/buzz\?tab\=popular

"=" is significant to regular expression matching for assignment and needs to be quoted. "?" is significant as well and although you don't strictly need to quote it with a "\" to make it work, doing so may improve performance slightly. If it still doesn't match try toggling the checkbox "URL is a regular expression" on the custom site/app object.

Edit: clarified what ? matches based on Bob's post

Re: URLF Regular Expression

the_rock — Mon, 06 Jan 2025 20:31:42 GMT

I have a feeling it could be something with that site, cause every single time, no matter what "flavors" I try, it shows bypassed in https inspection, but so many different countries...Korea, Taiwan, USA...AND, on top of that, always different categories too. Though I blocked in in url layer and also inspected in https inspection policy.

Andy

Re: URLF Regular Expression

Timothy_Hall — Mon, 06 Jan 2025 20:42:09 GMT

Assuming my alternate regex does not work and it always seems to Bypass anyway, I suppose it is possible that this server falls into the implied HTTPS Inspection exceptions. Try disabling it but be warned this will break a lot of stuff in a production environment:

https://support.checkpoint.com/results/sk/sk98655

Also I assume you are not using the Check Point-provided bypass object in your HTTPS Inspection policy, it could be in there too:

https://support.checkpoint.com/results/sk/sk163595

Re: URLF Regular Expression

the_rock — Mon, 06 Jan 2025 20:41:22 GMT

Just tried that too in the lab as regular expression as well, no joy...

Re: URLF Regular Expression

GigaYang — Mon, 06 Jan 2025 20:53:13 GMT

I have try that. It can block the URL. 😀

Re: URLF Regular Expression

GigaYang — Mon, 06 Jan 2025 20:53:51 GMT

Hi Rock,

Thanks for your kindly help.

Re: URLF Regular Expression

the_rock — Mon, 06 Jan 2025 20:55:42 GMT

No worries, happy it worked for you! Maybe I did the wrong syntax in the lab.

Andy

Re: URLF Regular Expression

Bob_Zimmerman — Mon, 06 Jan 2025 21:11:17 GMT

? in a regular expression should match the previous element (typically a character, but can be a character class or a group) 0 or 1 times. For example, "https?" would match http or https. If you want to match a literal question mark in the input, you definitely need to escape the question mark in the expression (or put it in a character class, or replace it with a dot).

Re: URLF Regular Expression

the_rock — Mon, 06 Jan 2025 22:19:48 GMT

Would you mind sharing exact syntax you used? I would like to test it in the lab...not having much luck with ones Im trying.

Andy

Re: URLF Regular Expression

the_rock — Mon, 06 Jan 2025 22:48:35 GMT

Never mind @GigaYang , I got it. It was being bypassed on financial services, as soon as I removed that, it was blocked. I just used below:

\.cmoney\.tw\/forum\/popular\/buzz\?tab\=popular

Cheers,

Andy

Re: URLF Regular Expression

Timothy_Hall — Tue, 07 Jan 2025 01:50:24 GMT

Got it, thanks for the clarification!