Blocking specific subdirectory of domain

Forum|Forum|5 years ago
February 6, 2021
3 replies
6989 views

Hello! I would like to access the following url: www.heise.de But I would like to block all subfolders/subdirectories, like www.heise.de/forum, www.heise.de/forum/startseite etc. The site is https, I have a Fortigate 30d with latest 5.8 fw, webfilters working. I tried everything with filters, at least that I know of. I can block of course the whole domain, but not the subdirectories to their forum. I suspect, it has something to do with the https. Reason: I want myself being blocked from posting in their forum, but still, I want to consume the news=) Any help? Thx.

Best answer by emnoc

You can build a web filter profile but in each case ssl decryption is going to be needed. Filtering by SNI is not going to be helpful since the Host: header is not part of the SNI extension.

Ken Felix

emnoc

New Member

You would need to build a custom ips signature and set the action to drop.

I would start by finding the fortios custom ips-signature documentation and build a signature. For HTTPS you will need ssl/tls decoding in order to see the requested in the body.

It should look similar to this ;

config ips custom

edit web-block

set signature "F-SBID( --name \"web_heise\"; --pattern "Host|3A|www.heise.de/forum"; --no_case ; --protocol tcp; --dst_port 80; --default_action drop; --flow from_client; )"

You would write one for http and https and apply the ips rule in your firewall policy that allows traffic to the website.

Ken Felix

SteffiAuthor

New Member

Thx for your answer. So, as I can see from your answer, it should not be possible with simple url filter (simple, regex oder wildcard), right? I can also see, that ssl deep inspection is needed. I know, not difficult to implement, but in my case, too much for an simple url block.

emnocAnswer

New Member

You can build a web filter profile but in each case ssl decryption is going to be needed. Filtering by SNI is not going to be helpful since the Host: header is not part of the SNI extension.

Ken Felix

Sign up

Login with SSO

Login to the community

Login with SSO