| Solution |
It is found that when setting up the application control signature (Cloudflare.1.1.1.1.VPN) on the application profile and applying this in the firewall policy will only block the use of this application when the PC/Device is not yet registered and it has not got a Device ID yet. Additionally, a deep inspection is needed to effectively block this.
When installing this application for the first time, it tries to register the device to the WARP Cloudflare site and provides the device (PC) a Device ID.
WARP Cloudflare uses the below.
- IPv4 API Endpoint: 162.159.137.105 and 162.159.138.105.
- DNS: 162.159.36.1.
- Traffic from the device to the Cloudflare edge will go through. these IP addresses IPv4 Range: 162.159.193.0/24 .
- WARP utilizes UDP for all of its communications. By default, the UDP Port required for WARP is: UDP 2408. WARP can fallback to: UDP 500, UDP 1701, or UDP 4500.
In order to block the Application even after the application registers itself, for example, the PC/Device has already got its Device ID and the app is already existing in the user environment, then follow the steps below.
- Create a firewall address group with range: 162.159.0.0/16.
- Create 'Custom service' with UDP ports: 2408, 500, 1701, 4500.
- Configure a firewall policy and set the address group created above to be the 'Destination' and Custom Service ports created on the 'Service' fields, respectively.
- Set the firewall policy Action to 'Deny'.
This configuration will block the Application (Cloudflare.1.1.1.1.VPN) from connecting.
If, despite performing above, Cloudflare Warp is still able to connect, consider adding the following address services to the deny policy.
TCP: 443
TCP: 80
UDP: 443
UDP: 4443
UDP: 8443
UDP: 8095
UDP: 500
UDP: 4500
UDP: 1701
UDP: 2408
|
