HTTPS sites and YouTube , and Facebook , Can't block them !

Question

HTTPS sites and YouTube , and Facebook , Can't block them ! Greetings to you Dears Really I'm tired from testing all day to block YouTube and Facebook! via foritgate 3240C OS 5.0 What I done! 1- Enable SSL\SSH Inspection 2- application control and block YouTube and Facebook 3- create web fiter and block all Category or block Bandwidth Consuming Category 4- enable all above in Policy for One Computer The results Some time block page come and some time website open normally ! that mean web-filter and application control like doesn't prevent user from access YouTube or Facebook , they can access normally Please ! How I can solve this problem ? block HTTPS websites and YouTube and Facebook . only website I want it to open is allowed through web url filter attached what I done

by the way I test by using ( ENABLE SSH deep scan ) and I did test also without it so don't tell me to uncheck that !

this is the web filter I eanble web site filter all website block using * wildcard in the bottom

Dave_Hall · Answer

Because youtube uses google's wildcard * security certificate and none of our monitored fgt devices use deep inspection (and can not use it), we have to resort to using good old-fashion (FQDN) address firewall blocking, via code similar to the following:

config firewall address
    edit "youtube1"
        set associated-interface "wan1"
        set type fqdn
        set fqdn "www.youtube.com"
    next
    edit "youtube2"
        set associated-interface "wan1"
        set type fqdn
        set fqdn "youtube.com"
    next
    edit "youtube3"
        set associated-interface "wan1"
        set type fqdn
        set fqdn "i1.ytimg.com"
    next
    edit "youtube4"
        set associated-interface "wan1"
        set type fqdn
        set fqdn "youtube-ui.l.google.com"
    next
    edit "youtube5"
        set associated-interface "wan1"
        set type fqdn
        set fqdn "googlevideo.com"
    next
    edit "facebook1"
        set associated-interface "wan1"
        set type fqdn
        set fqdn "facebook.com"
    next
    edit "facebook2"
        set associated-interface "wan1"
        set type fqdn
        set fqdn "www.facebook.com"
    next
    edit "facebook3"
        set associated-interface "wan1"
        set type fqdn
        set fqdn "s-static.ak.facebook.com"
    next
    edit "facebook4"
        set associated-interface "wan1"
        set type fqdn
        set fqdn "login.facebook.com"
    next
    edit "facebook5"
        set associated-interface "wan1"
        set type fqdn
        set fqdn "static.ak.fbcdn.net"
    next
    edit "facebook6"
        set associated-interface "wan1"
        set type fqdn
        set fqdn "profile.ak.fbcdn.net"
    next
end
config firewall addrgrp
    edit "youtube-group"
        set member "youtube1" "youtube2" "youtube3" "youtube4" "youtube5"
    next
    edit "Facebook-group"
        set member "facebook1" "facebook2" "facebook3" "facebook4" "facebook5" "facebook6"
    next
end
config firewall policy
    edit 0
        set srcintf "internal_net"
        set dstintf "wan1"
        set srcaddr "All_Internal"
        set dstaddr "youtube-group" "Facebook-group"
        set schedule "always"
        set service "ALL"

        set action deny
        set logtraffic disable
    next
end

Move firewall rule up in the firewall rule chain so it is before any general HTTP/HTTPS firewall rule.

IMO I wouldn't use this code verbatim (I think one of the FQDN entries for youtube also resolves to an IP for google's search site.)

Sign up

Login with SSO

Login to the community

Login with SSO