Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
franctorres
Participant
Jump to solution

Best Practices Against Ultrasurf

Hi mates good day do you have any advices to block ultrasurf, I have a costumer who can´t control the use of this app.

Regards 

1 Solution

Accepted Solutions
iesnoz
Participant

Hi

Yes, we finally got it, some guys in form support team in Checkpoint Spain helped us, but to be honest, I don't remember the specific solution... We passed the homologation with several changes activated and then deactivated because were interferring in the normal behaviour of our product (based on Checkpoint engine using the API). I remember that was not necessary to activate HTTPS inspection, that we modified Ultrasurf recommended settings to "Any" (check the png attached). The problem mainly was that Ultrasurf was trying high ports nad always found one available to connect, with "Any" or customizing to "high ports" for TCP and UDP it worked.

 
 

 

 

View solution in original post

0 Kudos
10 Replies
the_rock
Legend
Legend

Below is all you would find if searching for it in dashboard, so I assume thats best you can use to block it. Otherwise, you would have to block any IP / fqdn's related to it, which is not really viable solution.

Screenshot_1.png

Andy

 

0 Kudos
Wolfgang
Authority
Authority

Don‘t forget you need a license for ApplicationControl, enabled ApplicationControl on the relevant policy and a rule to block the traffic 😀

the_rock
Legend
Legend

Yes sir, correct 🙂

0 Kudos
Chris_Atkinson
Employee Employee
Employee

Is HTTPS inspection enabled and are Critical Risk & Anonymizers categories blocked per: sk112249: Best Practices - Application Control ?

CCSM R77/R80/ELITE
0 Kudos
iesnoz
Participant

Hello Chris

 

I have the same problem as @franctorres, I am in the middle of an homologation of the product and all the test with ultrasurf fail, it always connnects, even activating Anonymizer and Critical Risk categories, and Ultrasurf and Ultrasurf Chrome extension applications. In the log the GW drops some connections, but finally it connects.

0 Kudos
MikeB
Advisor

Hi @iesnoz , you managed to get ultrasurf blocked?? Is it necessary to activate HTTPS Inspection for Anonymizers category??

0 Kudos
the_rock
Legend
Legend

Guys, I have really good lab with https inspection enabled (yes its R81.20, but I dont think version matters), so if you need me to test this with any specific ultrasurf category/site, please let me know.

Andy

0 Kudos
iesnoz
Participant

Hi

Yes, we finally got it, some guys in form support team in Checkpoint Spain helped us, but to be honest, I don't remember the specific solution... We passed the homologation with several changes activated and then deactivated because were interferring in the normal behaviour of our product (based on Checkpoint engine using the API). I remember that was not necessary to activate HTTPS inspection, that we modified Ultrasurf recommended settings to "Any" (check the png attached). The problem mainly was that Ultrasurf was trying high ports nad always found one available to connect, with "Any" or customizing to "high ports" for TCP and UDP it worked.

 
 

 

 

0 Kudos
Sorin_Gogean
Advisor

Hello  @franctorres and @iesnoz ,

 

@franctorres, you didn't provided extra details about your setup, therefore we have to guess things.

CheckPoint can block applications with the help of "ApplicationControl blade" but that only without other modules like "HTTPS Inspection blade" doesn't do miracles.

 

@iesnoz , you say that there were some packets blocked even you had the AppControl in use, but can you show the logs so we see what was allowed and what was blocked? Could it be that it was allowed on HTTPS while HTTP was blocked? as I was reading some papers, Ultrasurf tries HTTP then some HTTPS connections in order to build the SSL tunnel .

 

Ty,

0 Kudos
iesnoz
Participant

Sorry, but I don't have those logs, we were in a hurry and we just talked by phone with Checkpoint support to pass and I have checked emails and documents and found nothing related 😞

But I remember everything was blocked, HTTPS and and HTTP, and "Categorize HTTPS sites" was activated.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events