4

is there a solution to create FW rules by URL instead of IP for inbound traffic? For example a.example.com and b.example.com are the same IP on the DNS, but they are different sites, is there a solution to open port 22 for example just to a.example.com?

If so, what is the name of the solution?

Thanks.

1

There are two possible ways I can think of.

1.If your firewall has URL/Web filtering feature, you can configure a local filter with the URL you mentioned, but you still need to define traditional a firewall policy first and attach you URL/Web filtering configuration to the policy.

2.If your firewall has AI (applicatoin identification) feature and support custom signature, you can define your URL as a custom application. Because application identification happens in a very early stage, you can define a normal policy and replace destionation IP and port with your the custom app.

2

This depends on your firewall solution. What you are talking about sounds like Layer 7 Content Filtering. This is not as common as Layer 3 IP filtering but is supported on some more advanced firewalls.

To address your question of being able to differentiate between connections to the same IP but different hostnames:

This is very easy to do with websites as the hostname is transmitted in the HTTP header and can be easily identified by the firewall. If you want to do this with SSL/TLS you will get a certificate error unless the proper CA is installed on the client, this is because the firewall needs to act as a Man-In-The-Middle to decrypt, inspect, and re-encrypt the data in order to see the hostname.

If you were wanting this functionality for other services, such as SSH as you suggested, this is much more complex. There are no headers or any other indications of a hostname in many other protocols such as SSH. Some advanced firewalls may offer enough configuration flexibility to help address this, but it wouldn't be a fool proof solution. This would likely be done on the DNS level and either serve a bad IP for the banned hostname, or block the IP after a DNS request was made for banned hostname.

Edit: After re-reading your question, I am not sure why I assumed you were talking about outbound filtering. If you are talking about inbound filtering, then the last bit about DNS doesn't really apply.

  • 1
    For inbound filtering: If you are in control of the DNS server resolving a.domain.com and b.domain.com, you could inspect this traffic, and force the TTL to be low, as you cannot allow DNS entries to be cached. I just read your answer, and you pretty much said exactly the same as me :) - Deleted my answer – Dog eat cat world Jul 27 '14 at 8:57
2

This feature is called content filtering, because you are blocking based on specific content in the TCP packets.

Before running out to buy a product, you should first check if your existing firewall support this feature, many do. Even wifi routers and cable modems often have this feature. For example, Wifi and cable modem products from netgear, motorola, or linksys support content filtering firewalls.

  • Hi, see my edit, i need it for incoming traffic – gabi Jul 27 '14 at 9:16
  • Based on the edit, it sounds like what you are describing is 'name-based virtual hosting'. That's usually implemented in the web server and OS of the server, not enforced by the firewall. For example, you could virtual host a.example.com and b.example.com on different network interfaces of a server, then setup rules for how the network traffic is served. All of that is done on the server. – Jeff-Inventor ChromeOS Jul 27 '14 at 9:39
1

Checkpoint firewalls can do this.

I'd be willing to bet the "nextgen" firewalls like Palo Alto do this as well.

Be warned though, if you are a large enterprise this will cause a lot of overhead on your FW.

  • Yes, its call URL filtering blade, requires additional license if I'm not wrong. – hoa Jul 27 '14 at 8:50
  • Hi, see my edit, i need it for incoming traffic – gabi Jul 27 '14 at 9:16
1

It depends on the firewall (as others said) but also on the application protocol. In your example you use port 22, which is usually associated with SSH. As far as I know SSH does transmit the target hostname inside the protocol, so you can not distinguish SSH access to different hostnames on the same IP address (and the SSH server itself does not distinguish either). Also the protocols used for sending and receiving email (SMTP, IMAP, POP) have no knowledge of target hostname either, so you cannot filter based on hostname too.

As for HTTP: most browsers send the target hostname inside the HTTP header (required with HTTP/1.1, but most HTTP/1.0 user agent do it too) so you can try to distinguish the target based on this header. But this works only it the user does not tamper with the request. Lots of web sites just ignore the Host header, which means that you could easily circumvent a filter for nytimes.com by putting a Host header of example.com in the HTTP request but send this request to the IP address of nytimes.com. This method works for most so called Next Generation Firewalls.

As for filtering inbound traffic: it also depends on the application protocol. So it is possible to detect the target hostname for HTTP or even for HTTPS if SNI is used, but it will not be possible for IMAP, SSH, FTP etc because the hostname gets not transmitted inside the application layer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.