Skip to main content
A
Anonymous_User
Contributor
July 7, 2008
Question

Allowing only certain URL' s

  • July 7, 2008
  • 15 replies
  • 7285 views
I need to block all web access for certain users EXCEPT for certain job related URL' s (i.e. weather.com) The users are allowed full access during certain times of the day (breaks, lunch, etc.) I was successful in configuring multiple policies to achieve this, but am looking to allow specific URL' s while blocking everything else. Can this be done with FortiOS and how? Thanks for any assistance.

    15 replies

    UkWizard
    UkWizard
    New Member
    July 7, 2008
    you need to use a regex to block everything (its either * or . if i remember offhand) then explcitly whitelist the ones you want to allow.
    rwpatterson
    rwpatterson
    New Member
    July 7, 2008
    Put the regex .* last. This will block everything! Make your valid allowances above this one.
    UkWizard
    UkWizard
    New Member
    July 7, 2008
    a single " ." dot should do the same, doesn' t it?
    rwpatterson
    rwpatterson
    New Member
    July 7, 2008
    The dot means any character once. The star means the prior expression zero or any amount of occurances.
    UkWizard
    UkWizard
    New Member
    July 9, 2008
    The dot means any character once. The star means the prior expression zero or any amount of occurances.
    Bob - Looks like fortinet disagree with us, accidentally stumbled on this KC document; http://kc.forticare.com/default.asp?id=796&Lang=1&SID= It says we should us ^.* to block all
    A
    Anonymous_UserAuthor
    Contributor
    July 7, 2008
    Maybe this is not for this forum, BUT... do I use Firewall policies here or just web filtering?
    rwpatterson
    rwpatterson
    New Member
    July 8, 2008
    The web filtering takes place in a protection profile that is placed into a policy...so yes.
    UkWizard
    UkWizard
    New Member
    July 8, 2008
    Just make sure you use " allow" and not " exempt" for the allowed list, as the latter would not perform any AV or IPS scanning.
    Hracio
    Hracio
    New Member
    July 8, 2008
    mmm, im having some trouble with url filters &regex stuff What to achieve: https://one.domain.com/user ---> Allow https://one.domain.com/everythingelse --->deny https://one.domain.com --->deny What i' v done: From Inet--> DMZ URL one.domain.com/user Type Simple Action Allow Enable URL xx\.x\.xxx\.220 (my ip) Type Regex Action Block Enable Enabled the URL filtering for http & https, but its not working, it allows me to access to every url on https:443. But if i enable this one.. every url is blocked URL one.domain.com Type Simple Action Deny Enable
    UkWizard
    UkWizard
    New Member
    July 9, 2008
    why is your IP in the block entry? URL blocking looks in the header, so it doesnt match the client IP (to my knowledge anyway). just put in one.domain.com for the block rule and that should suffice.
    UkWizard
    UkWizard
    New Member
    July 9, 2008
    yep it does. i use it often for unix scripting.
    Hracio
    Hracio
    New Member
    July 10, 2008
    URL xx\.x\.xxx\.220 (my ip)
    I meant my server IP.. to avoid access via ip/url Can' t make it work yet...
    ^.*
    correct, it blocks all, should be used with exemption actions, also says that https looks on the certificate for blocking... now reading : Mastering Regular Expressions, 3rd Edition By Jeffrey E. F. Friedl Ugghhh... was not on my plans... (if any1 wants it, pm me.)
    UkWizard
    UkWizard
    New Member
    July 10, 2008
    all you need in life is wikipedia..... http://en.wikipedia.org/wiki/Regular_expression
    Hracio
    Hracio
    New Member
    July 10, 2008
    yes, however.. it doesn' t work (as it should) url filtering on https urls... xxx.xx.xxx.220/webmail --->public IP Type Simple Action Allow Enable xxx.mydomain.xxx/webmail --public Domain Type Simple Action Allow Enable xxx\.xx\.xxx\.xxx --Public IP Type Regex Action Block Enable xxx\.mydomain\.xxx -->Public domain Type Regex Action Block Enable This should allow access only to mydomain/webmail & mypublicip/webmail and block everything else... but its blocking everything even the allowed urls. Regards.-!
    Show more replies
    Terms & ConditionsAccessibility statement