Blocking specific subdirectory of domain

[Steffi]

Hello! I would like to access the following url: www.heise.de But I would like to block all subfolders/subdirectories, like www.heise.de/forum, www.heise.de/forum/startseite etc. The site is https, I have a Fortigate 30d with latest 5.8 fw, webfilters working. I tried everything with filters, at least that I know of. I can block of course the whole domain, but not the subdirectories to their forum. I suspect, it has something to do with the https. Reason: I want myself being blocked from posting in their forum, but still, I want to consume the news=) Any help? Thx.

[emnoc · Accepted solution]

You would need to build a custom ips signature and set the action to drop.

I would start by finding the fortios custom ips-signature documentation and build a signature. For HTTPS you will need ssl/tls decoding in order to see the requested in the body.

It should look similar to this ;

config ips custom 

  edit web-block 

set signature "F-SBID( --name \"web_heise\";  --pattern "Host|3A|www.heise.de/forum"; --no_case ;  --protocol tcp; --dst_port 80;  --default_action drop; --flow from_client; )" 

You would write one for http and https and apply the ips rule in your firewall policy that allows traffic to the website.   

Ken Felix

[emnoc · Accepted solution]

You would need to build a custom ips signature and set the action to drop.

I would start by finding the fortios custom ips-signature documentation and build a signature. For HTTPS you will need ssl/tls decoding in order to see the requested in the body.

It should look similar to this ;

config ips custom 

  edit web-block 

set signature "F-SBID( --name \"web_heise\";  --pattern "Host|3A|www.heise.de/forum"; --no_case ;  --protocol tcp; --dst_port 80;  --default_action drop; --flow from_client; )" 

You would write one for http and https and apply the ips rule in your firewall policy that allows traffic to the website.   

Ken Felix

[Steffi]

Thx for your answer. So, as I can see from your answer, it should not be possible with simple url filter (simple, regex oder wildcard), right? I can also see, that ssl deep inspection is needed. I know, not difficult to implement, but in my case, too much for an simple url block.

[emnoc · Accepted solution]

You can build a web filter profile but in each case ssl decryption is going to be needed. Filtering by SNI is not going to be helpful since the Host: header is not part of the SNI extension.

Ken Felix