0

We setup a ISG-1000 firewall about a month ago with the goal of blocking specific URLs. Please see image file below in which there are 70EA PCs.

Even though we think we blocked specific URLs, some users detour the IP using the zenmate program which is some kind of Detour Program!

Are there firewall settings that would help with this? Not quite sure what to try next.

enter image description here

6
  • 1
    so ummm... what?
    – motoku
    Aug 19, 2015 at 3:23
  • 1
    If these computers are on your corporate network and under your control, you can just prevent people from installing browser extensions or running unapproved programs by setting the appropriate corporate group policies. You're running into an issue inherent to network-level website blocking in general, which is that it can easily be circumvented using encrypted proxies/VPN services. It is often easier to block such services at the computer level rather than at the network level.
    – tlng05
    Aug 19, 2015 at 3:29
  • Just blocking URLs isn't going to work. There is actually a lot involved in securing a network from nefarious input.
    – motoku
    Aug 19, 2015 at 3:34
  • Thank you guys. But I have a question to tlng05. Among you wrote down, "by setting the appropriate corporate group policies." what is meaning?.. appropriate policy? Is this method in the Juniper???
    – SK.Kwon
    Aug 19, 2015 at 6:51
  • How are the computers currently being managed? Are you the administrator of all of them?
    – tlng05
    Aug 19, 2015 at 11:19

1 Answer 1

2

There are lots of ways to pass data through a firewall and more so if you don't have control of the software installed on the client computers inside the network.

According to this information zenmate tunnels the data through a HTTPS connection. And according to this zenguard.biz is the backend server involved in this process. And based on this information zenguard.org and zenguard.io domains are involved too. Thus it might be enough to block these sites, both for HTTP and HTTPS. This will of course block all use of zenmate and not only access to the specific URL you want to block. And of course the domains might change in the future because zenmate itself is not interested in being blocked.

But note that blocking zenmate only solves part of the problem. There are other ways to bypass the firewall, like using a SSL-VPN, tunneling with SSH and much more. At the end there is no fully technical solution to block these bypasses. Instead you should make sure that you control which software is installed and have security policies to prohibit use of any firewall bypasses. Then you need to monitor your network for violations and publicly punish everybody who tries to violate these policies so that other users don't even try.

11
  • The old game of Url-filtering-whack-a-mole
    – schroeder
    Aug 19, 2015 at 4:07
  • And if you successfully ban zenmate, there's always another waiting in the wings. Aug 19, 2015 at 4:24
  • Thanks to your opinion, I have known this is very difficult thing... Ah ;( ... Then,., whenever I block something, another detouring methods are waiting for me...??
    – SK.Kwon
    Aug 19, 2015 at 6:54
  • @SK.Kwon: their are enough ways to pass through a firewall for a knowledgeable user. Without a clear security policy, a way to control it and a way to punish violations as deterrence there is not much you can do. Also, users might simple bypass the firewall with phone tethering etc so you need to control the client PC's too. Aug 19, 2015 at 7:15
  • 1
    You can forbid you users to bring personal devices including phones and paper and frisk them (that might be illegal). Then make them work in a Faraday cage, in a bunker, on controlled computers that are re-imaged every days. Even better, you can cut their internet connection. This should be an efficient solution to your problem, unless you want work to be done. Another solution is to forbid your users to browse for porn or whatever and trust them. Aug 19, 2015 at 13:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .