Why is my firewall blocking on some files but not others?

Question

I'm behind a corporate firewall which restricts access to certain urls and most downloads. The download restriction is mainly on .exe(but it allows some exe files to be downloaded and I don't know why!)

The main picture here is that i can download an 'access restricted' file or exe through other means, like dropbox.

How is it possible? is it related to the way firewalls treat urls? for ex:

site.com/install/toolname.exe

or

dl-web.dropbox.com/get/toolname.exe?w=p4dd0df8&dl=1

or should i see much more than that? can someone shed some light on this?

Answer 1

A firewall is "a device or set of devices designed to permit or deny network transmissions based upon a set of rules". These rules are usually written by your network administrators, and, depending on the sophistication of the firewall, can be very simple or very clever.

Your admins have probably written a set of rules designed to allow DropBox traffic through. Perhaps an important business process (or a senior person in the business, alas!) requires Dropbox. Or they may have concluded that an executable file you have deliberately put in your dropbox is more likely to be safe than something you downloaded from the Internet.

They might have done this by writing a rule that looks at the URL (modern firewalls can do this). More likely is that they have a rule that looks at the site you are connected to. Or, they might allow secure HTTPS traffic, which Dropbox uses, but not regular HTTP traffic. Or they might only block the downloading of executables from your web browser, and allow dropbox through. Modern (third generation) firewalls can do lots of fancy things.

Also, of course, it is possible that they do not want DropBox to get though, but have made a mistake in their rule set. Network admins are human!

For a definitive answer, you'll need to ask your network admins. You might also check if you have an Acceptable Use Policy for the Internet - that may give some clues at what is filtered.

Answer 2

My best guess is that when you connect to the Dropbox service, you're using an encrypted protocol. The firewall therefore can't get a good look at your traffic. They might have the desire to block foreign executables, but not the ability -- big difference.

Standard HTTP isn't encrypted, so that's easy to monitor and/or block. Your administrators also have access to your organization's mail infrastructure and can write rules to identify and possibly strip attachments.

It's probably a visibility question more than anything else. Ask them, they probably appreciate your interest. ( But don't ignore them and do things anyway, if you don't like the answer! )