Top Level Domain (TLD) Blocks

[Brian_Deutmeyer]

I'm looking for a way to block top level domains (TLDs) on the gateway.  I see others have done this with a custom app (https://community.checkpoint.com/t5/Security-Gateways/Regex-for-TLD-Blocks/m-p/24704), but I'm looking for something more real-time and maybe more native.  I stumbled across sk132193 for Custom Intelligence Feeds, which is pretty much what I'm looking for, except I'm concerned that adding a TLD here will match any part of the domain name and not just the TLD.

Will adding `com` match `mycompany.net` only sites like `badtld.com`?

Anyone have any experience blocking TLDs?  Any sort of near real time automated pull is what I'm looking for.

Thanks!

[PhoneBoy]

Maybe @TP_Master can confirm, but I think the Custom Intelligence Feeds option for domains only match a precise FQDN, not, say, a partial.

[Brian_Deutmeyer]

Interestingly, I just tested a list of top level domains imported via the IOC and it seems to be working as desired!  I'll be curious to see what @TP_Master has to say.

[PhoneBoy]

That is good news.
I did look at one of the examples in the SK and it seemed to only contain hostnames.
Your experience sounds promising, though 🙂

[Brian_Deutmeyer]

How do you see if drops are happening?  The logs don't report a drop and `fw ctl zdebug + drop` doesn't show a drop, but the traffic isn't allowed.  How can you see what was blocked? 

[PhoneBoy]

I assume you'd see logs to this effect.
Unless @TP_Master has a suggestion, you might need to open a TAC case.

[Brian_Deutmeyer]

It appears it logs on the first block matching an indicator entry, then records all subsequent blocks for that same indicator on the same log.  So if I block the TLD org, and then try to go to:

example1.org
example2.org
example3.org

I will see the block for example1.org only.  After some unknown period of time, the other 2 domains will show up in the log for the block of example1 under resources.  After some other unknown period of time, that log closes out and a new log gets generated repeating what I just explained.

[Brian_Deutmeyer]

Just an update. My account team has told me that TLDs are NOT supported even though it is working for me via the ioc_feeds.  I'd love to hear from someone who can dive into the nuts and bolts on how this actually works to confirm.  For now, those choosing to use this method, sounds like we are on our own for TLD blocks.

[Blason_R]

Yes - Even we had this issue and we opted for Commercial DNS Firewall and there we could block multiple TLDs without any hassles and even integrated with Check Point firewall as DNS Malware Trap