Freegate blocking issue

[supportabad]

Dear all,

We have FG200D with fortios 5 patch 7. 

We are unsuccessful in blocking freegate.searching application through fortigate. We have configured application control to block all proxy softwares and web filter profile to block "proxy avoidance" category. 

Fortigate logs shows that freegate.searching is being blocked but actually users can easily bypass it to access blocked websites. 

Please help me in creating custom application/ips signature to block freegate.

regards

Burhan

[Dave_Hall]

Can you provide an example of such logs, specifically what ports are being used to send traffic through?  Some proxy software will use known ports that are usually open, like DNS (port 53).  

If it is DNS traffic, you should set up a firewall policy allowing access to allowed DNS servers (IP addresses), then create an app sensor for proxy avoidance and tie it to that policy.  Then below this policy create another policy blocking all other DNS traffic.

Edit: if your company is running an internal DNS server (e.g. Windows AD server) then the only DNS traffic you really should see on the Fortigate is from the server itself -- you could block all other source IP addresses that connect directly to outside DNS servers.  But check with management to see if your company wants to choose that option.

[Fahad]

can you share with us how you are blocking it..

[Fullmoon]

I would suggest to upgrade to the latest firmware.

[supportabad]

Dear all,

Thanks for reply.

Please find the attached snapshot of application control profile and logs which shows that it is blocked.

Please note that the freegate is blocked sometimes by fortigate, but if we change its port(default 8085) or try it 4-5 times, it bypasses fortigate. The forward traffic logs always display that it is getting blocked but actually it is getting allowed.

[Dave_Hall]

Can you provide a pic of your firewall policy rules list, pointing out which rule(s) has the app sensor attached to them -- something like the attached pic.