How do I block specific "sites.google.com"

[Mbutler522010]

We have the google FQDN's opened per their suggestion ( https://support.google.com/a/answer/2589954?hl=en ) and ( https://support.google.com/drive/answer/6163291 )

the kids have discovered a number of gaming sites on google homepages, all seem to be named "unblocked games" i.e.

https://sites.google.com/site/unblockedgames4me

https://sites.google.com/site/unblockedgames77

https://sites.google.com/site/punblockedgames/

The problem is that blocking google by address doesn't seem to work as every request seems to use a different one, and I don't know why but I don't seem to be able to block by name.

I put in a simple IPV4 policy, source = any,  Destination = "sites.google.com/site/unblockedgames4me",  block

and it doesn't work.  because it is a block there is no SSL inspection or anything like that....

When I look at the log there is nothing that says "sites.google.com/site/unblockedgames4me" just "encrypted-tbn1.gstatic.com" but I don't want to block all of google, just the few sites.

Can anyone help?

[AlexFeren · Accepted solution]

michellem812 wrote:

If I enable Full (deep) inspection, then Google complains about HSTS issues. How did you get past that issue?

[size="2"]

[/size]

[size="3"]See "config ssl-exempt" below.[/size]

FG60C (root) # show firewall ssl-ssh-profile "Deep-inspection with HSTS Exception" config firewall ssl-ssh-profile     edit "Deep-inspection with HSTS Exception"         set comment "Deep inspection!"             config https                 set ports 443             end             config ftps                 set ports 990             end             config imaps                 set ports 993             end             config pop3s                 set ports 995             end             config smtps                 set ports 465             end             config ssl-exempt                 edit 1                     set type address                     set address "*.adobe.com"                 next                 edit 2                     set type address                     set address "android"                 next                 edit 3                     set type address                     set address "apple"                 next                 edit 4                     set type address                     set address "appstore.com"                 next                 edit 5                     set type address                     set address "citrixonline"                 next                 edit 6                     set type address                     set address "dropbox.com"                 next                 edit 7                     set type address                     set address "Gotomeeting"                 next                 edit 8                     set type address                     set address "icloud"                 next                 edit 9                     set type address                     set address "itunes"                 next                 edit 10                     set type address                     set address "skype"                 next                 edit 11                     set type address                     set address "swscan.apple.com"                 next                 edit 12                     set type address                     set address "update.microsoft.com"                 next                 edit 13                     set type address                     set address "HSTS"                 next             end     next end

  FG60C (root) # show firewall addrgrp HSTS config firewall addrgrp     edit "HSTS"         set member "wikipedia" "Google"     next end

FG60C (root) # show firewall addrgrp Google config firewall addrgrp     edit "Google"         set member "*.google.com.au" "*.google.com"     next end

FG60C (root) # show firewall address *.google.com.au config firewall address     edit "*.google.com.au"         set type fqdn         set fqdn "*.google.com.au"     next end FG60C (root) # show firewall address *.google.com config firewall address     edit "*.google.com"         set type fqdn         set fqdn "*.google.com"     next end

[jawad]

i want to block these and this one also 

https://sites.google.com/site/unblockedgames333/

any working method plz share 

[butering]

I m teacher, & my duty to blocked un necessary activities for kids need help to blocked google games site like and example this...

https://sites.google.com/site/huntingunblockedgames https://sites.google.com/site/coolmathgameszone

no success to find can explain in simple words...

[michellem812 · Accepted solution]

Props to AlexFeren for the info on how to do this - I used that info and expanded on it to give me what I needed. You need to use Deep/Full SSL inspection to restrict on the words in the URL, and if you deploy certificates I think it is easier to configure the Fortigate, but I did not want to install certificates. So instead you have to do what AlexFeren suggested - use the Deep/Full SSL profile, but also exempt most sites/categories due to HSTS, so that the end users don't get a web prompt to 'continue to this site' for most sites. If you do not require end-users to install a certificate on their device, then it is a matter of playing with the "firewall ssl-ssh-profile" exemptions to get around Chrome's HSTS restrictions but still block what you want.

[james0007]

Now a lot of sites like https://unblockedgames66sites.com/ coming up once again, How can we block these?

[Melike1986]

I want to block this site. But I couldn't

https://sites.google.com/.te/bestunblockedgames77/

[Dave_Hall]

All/most google related sites (except for a few) use the same wild * card security certification.  So once an encrypted connection is established to a google site, it's difficulty (if impossible) for the fgt to discern the actual URL on that site.  For this reason, Full SSL inspection is required. 

[davidahaha93]

I have the same problem as you. Children often visit the website [link]https://sites.google.com/site/unblockedgamesfun66,[/link] which I can't stop

Help me!

[schoolana]

please help block this sites :https://sites.google.com/view/unblockable-games

                                         https://sites.google.com/site/unblockedgame67/

[clara]

I've been trying for days, but I couldn't ! https://sites.google.com/site/allunblockedgames77 please help me.

[Dave_Hall]

This site and a lot (all?) sites on the google platform uses a wildcard security certificate when a https connection is established.  Unless your fgt device is configured to perform deep packet (content) inspection (see SSL Certificate Inspection vs Full SSL Inspection), all the Fortigate will likely see is the domain or FQDN (on the security certificate) as *.google.com.  But check your web filter or FortiView/Destination logs to confirm for sure - drill down on an device's individual connection sessions to see what is being allowed/blocked.  If need be enable "Device Detection" on the internal LAN interface - this will allow the fgt to identify devices on your internal network.