Best Practices Against Ultrasurf

[franctorres]

Hi mates good day do you have any advices to block ultrasurf, I have a costumer who can´t control the use of this app.

Regards 

[the_rock]

Below is all you would find if searching for it in dashboard, so I assume thats best you can use to block it. Otherwise, you would have to block any IP / fqdn's related to it, which is not really viable solution.

 

Andy

[Wolfgang]

Don‘t forget you need a license for ApplicationControl, enabled ApplicationControl on the relevant policy and a rule to block the traffic 😀

[the_rock]

Yes sir, correct 🙂

[Chris_Atkinson]

Is HTTPS inspection enabled and are Critical Risk & Anonymizers categories blocked per: sk112249: Best Practices - Application Control ?

[iesnoz]

Hello Chris

I have the same problem as @franctorres, I am in the middle of an homologation of the product and all the test with ultrasurf fail, it always connnects, even activating Anonymizer and Critical Risk categories, and Ultrasurf and Ultrasurf Chrome extension applications. In the log the GW drops some connections, but finally it connects.

[MikeB]

Hi @iesnoz , you managed to get ultrasurf blocked?? Is it necessary to activate HTTPS Inspection for Anonymizers category??

[the_rock]

Guys, I have really good lab with https inspection enabled (yes its R81.20, but I dont think version matters), so if you need me to test this with any specific ultrasurf category/site, please let me know.

Andy

[iesnoz · Accepted solution]

Hi

Yes, we finally got it, some guys in form support team in Checkpoint Spain helped us, but to be honest, I don't remember the specific solution... We passed the homologation with several changes activated and then deactivated because were interferring in the normal behaviour of our product (based on Checkpoint engine using the API). I remember that was not necessary to activate HTTPS inspection, that we modified Ultrasurf recommended settings to "Any" (check the png attached). The problem mainly was that Ultrasurf was trying high ports nad always found one available to connect, with "Any" or customizing to "high ports" for TCP and UDP it worked.

[Sorin_Gogean]

Hello  @franctorres and @iesnoz ,

@franctorres, you didn't provided extra details about your setup, therefore we have to guess things.

CheckPoint can block applications with the help of "ApplicationControl blade" but that only without other modules like "HTTPS Inspection blade" doesn't do miracles.

@iesnoz , you say that there were some packets blocked even you had the AppControl in use, but can you show the logs so we see what was allowed and what was blocked? Could it be that it was allowed on HTTPS while HTTP was blocked? as I was reading some papers, Ultrasurf tries HTTP then some HTTPS connections in order to build the SSL tunnel .

Ty,

[iesnoz]

Sorry, but I don't have those logs, we were in a hurry and we just talked by phone with Checkpoint support to pass and I have checked emails and documents and found nothing related 😞

But I remember everything was blocked, HTTPS and and HTTP, and "Categorize HTTPS sites" was activated.