Technical Tip: How to block LinkedIn Jobs

Description

This article describes how to browse LinkedIn sites but block the LinkedIn Jobs page from being accessed.

Scope

FortiGate.

Solution

To achieve this, it is necessary to use a Web Filter along with deep inspection. These are mandatory for a functioning static URL filter.

To set this up, follow the steps below.

In the GUI:

• Create a simple Firewall policy with a custom Web Filter ‘Jobblock’ and SSL Inspection as ‘Deep Inspection’:
  
  

• Create a custom web filter, enable Static URL filter, and add the following URLs with a 'block' action.
  
  

In the CLI:

• Firewall Policy:
  
  

config firewall policy
      edit 3
          set name "LinkedinJobBLOCK"
          set uuid 90d2ec82-48d1-51ee-34c2-e79f4313836e
          set srcintf "port2"
          set dstintf "port1"
          set action accept
          set srcaddr "all"
          set dstaddr "all"
          set schedule "always"
          set service "ALL"
          set utm-status enable
          set ssl-ssh-profile "deep-inspection"
          set webfilter-profile "Jobblock"
          set logtraffic all 
          set nat enable
          set comments " (Copy of To Internet) (Copy of test)"
      next
  end

• Next, create the Web Filter. It is first necessary to create the entries of URLs with type and action. Afterwards, assign the filter to the Web Filter profile.
  
  

config webfilter urlfilter    
      edit <Name of the static URL filter.>    
          config entries
               edit 1    
                  set url "*linkedin.com/jobs*"
                  set type wildcard
                  set action block
                  set antiphish-action block
                  set status enable
                  set referrer-host ''      
          next  
               edit 2
                  set url "*.linkedin.com/voyager/api/jobs/*"
                  set type wildcard
                  set action block
                  set antiphish-action block
                  set status enable
                  set referrer-host ''
          next 
               edit 3
                  set url "*.linkedin.com/litms/utag/voyager-web-jobs*"
                  set type wildcard
                  set action block
                  set antiphish-action block
                  set status enable
                  set referrer-host ''
          next  
               edit 4
                  set url "www.linkedin.com/voyager/api/graphql?variables=(count:1)&&queryId=voyagerJobsDashJobsFeed*"
                  set type wildcard
                  set action block
                  set antiphish-action block
                  set status enable
                  set referrer-host ''
          next
               edit 5
                  set url "www.linkedin.com/voyager/api/graphqlincludeWebMetadata=true&variables(count:1)&&queryId=voyagerJobsDashJobsFeed*"
                  set type wildcard
                  set action block
                  set antiphish-action block
                  set status enable
                  set referrer-host ''
          next
                edit 6
                   set url "platform.linkedin.com/litms/allowlist/voyager-web-jobs*"
                   set type wildcard
                   set action block
                   set antiphish-action block
                   set status enable
                   set referrer-host ''
          next
                edit 7
                   set url "www.linkedin.com/voyager/api/jobs*"
                   set type wildcard
                   set action block
                   set antiphish-action block
                   set status enable
                   set referrer-host ''
           next
                edit 8
                   set url "*launchpadContext=JOBS_HOME*"
                   set type wildcard
                   set action block
                   set antiphish-action block
                   set status enable
                   set referrer-host ''
           next
                edit 9
                   set url "/www.linkedin.com/voyager/api/graphql?variables=(count:1)&&queryId=voyagerJobsDashJobsFeed*"
                   set type wildcard
                   set action block
                   set antiphish-action block
                   set status enable
                   set referrer-host ''
           next
       end
   next

• Web Filter Profile:
  

config webfilter profile
      edit "Job_block"        
         set comment "Default web filtering."
          config web
               set urlfilter-table 4    
          next 
       end

Where '4' is the URL filter table ID. It is possible to find this ID under 'config webfilter urlfilter', where the URL filter is listed with its corresponding ID number.

Results:

After setting this up, the user will be able to browse LinkedIn but will be blocked from the 'Job' tab.

• When directly going to the 'Job' tab by entering the URL 'linkedin.com/jobs' in the browser, it will show as having been blocked by the URL filter:
  
  

• When logging in to LinkedIn and then browsing from the feed to the 'Job' tab, it will not load. The error will appear after refreshing the page.

Note:

Blocking the QUIC protocol is necessary as it often permits clients to bypass transparent proxies, resulting in UTM features not working properly. See: Technical Tip: How to block/disable QUIC.

Related articles:

• Technical Tip: Using a static URL filter feature to allow/block web sites

• Technical Tip : How to Block Youtube using a Static URL filter