Sorry I'm a bit late, but since its SSL the SNI header can be used and inspected (which is only in the handshake so it's not inspecting _all_ the packets) and use that for filtering, I know there's a netfilter module to do it (quick google found https://github.com/Lochnair/xt_tls), I think JunOS can do it https://apps.juniper.net/feature-explorer/feature-info.html?fKey=7646&fn=Server%20Name%20Indication%20(SNI)%20for%20Web%20filtering and probably most of the others when you get to certain levels of licensing.
The benefit is you don't need to MITM the SSL connection, the SNI is sent in clear-text and is even part of the first packet in the handshake (lots of application level proxies use this to route TLS connections without terminating them, like haproxy). Cheers, Kosh On Mon, 16 Aug 2021 at 20:23, Andres Miedzowicz < [email protected]> wrote: > Hi Jennifer, > > Thanks for that. However, my question is more around the options of > allowing access to millions of IPs (Office alone has /13s, /14s, /15s and > /16s) or narrowing up the list of destination addresses and tightening up > security at the expense of the potential caveats that the MITM approach the > firewalls take to decrypt and inspect outgoing, secure traffic. > > Regards, > > Andres > > Sent from my iPhone > > On 16 Aug 2021, at 20:16, Jennifer Sims <[email protected]> wrote: > > > You should be able to cover 365 via the publicly available IP ranges > > https://docs.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide > > For amazon S3 > > https://aws.amazon.com/premiumsupport/knowledge-center/s3-find-ip-address-ranges/ > > That should give you a good starting point. > > On Mon, Aug 16, 2021 at 7:36 PM Andres Miedzowicz < > [email protected]> wrote: > >> Hello, >> >> >> >> I need to create a firewall rule for outgoing traffic from my network to >> the internet for services hosted in public clouds where the destination URL >> has multiple dynamic IPs (ie: an AWS S3 bucket, Outlook 365 in Azure, etc) >> which makes a rule based on a destination FQDN troubling because each DNS >> query will provide a different IP every time. My possible solutions are: >> >> >> >> 1. Use a firewall rule using a Web URL filter, or application/content >> filtering (depending on the vendor) where I need to perform deep packet >> inspection to get the full destination URL or detect the application (ie: >> email delivery to O365). When this method is used with most of the >> vendors, >> the process involves a MITM approach where the SSL Certificate presented >> to >> the client is one generated by the firewall with the root CA certificate >> issued by the firewall as well. >> >> >> >> 1. Set the destination IP of the rule the full list of possible >> ranges for the public cloud which could mean millions of IPs. >> >> >> >> Any thoughts on security concerns with each of the approaches? Is it >> worth the potential decrease in security by using a non-trusted Root CA >> internally (even though we can install the certificate in the >> application/browser to force it to trust it) vs. allowing access to >> destination IPs that are not necessary for this service but ensures >> uninterrupted encryption end-to-end? >> >> >> >> Thank you all, >> >> >> >> Andres >> _______________________________________________ >> AusNOG mailing list >> [email protected] >> http://lists.ausnog.net/mailman/listinfo/ausnog >> > _______________________________________________ > AusNOG mailing list > [email protected] > http://lists.ausnog.net/mailman/listinfo/ausnog >
_______________________________________________ AusNOG mailing list [email protected] http://lists.ausnog.net/mailman/listinfo/ausnog
