Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 25 replies
  • Subscribers 1 subscriber
  • Views 27557 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

url blocking

William Warren
in v8 i used to be able to go *.whatever.whatever to kill an entire domain.  I've been hunting down the domains that are serving these freaking video ads and i have a good idea where they are coming from but i can't get them blocked inside the web proxy.  one of hte domains i want dead is newsinc.com and all subdomains.  *.newsinc.com used to work.  nOw it doesn't.  Some pointers would be appreciated.


This thread was automatically locked due to age.
  • 0
    here's another domain to kill
    ads.auditude.com
    adobes ad platform.  

    need to get these added to the ad blocking database...

    Owner:  Emmanuel Technology Consulting

    http://etc-md.com

    Former Sophos SG(Astaro) advocate/researcher/Silver Partner

    PfSense w/Suricata, ntopng, 

    Other addons to follow

  • 0
    ad.crwdcntrl.net

    Owner:  Emmanuel Technology Consulting

    http://etc-md.com

    Former Sophos SG(Astaro) advocate/researcher/Silver Partner

    PfSense w/Suricata, ntopng, 

    Other addons to follow

  • 0
    ndn.cdn.auditude.com

    Owner:  Emmanuel Technology Consulting

    http://etc-md.com

    Former Sophos SG(Astaro) advocate/researcher/Silver Partner

    PfSense w/Suricata, ntopng, 

    Other addons to follow

  • 0
    plus they are being miscatergorized as hardware/software and other thing..like http..[:(]

    Owner:  Emmanuel Technology Consulting

    http://etc-md.com

    Former Sophos SG(Astaro) advocate/researcher/Silver Partner

    PfSense w/Suricata, ntopng, 

    Other addons to follow

  • 0
    OPTMD

    Owner:  Emmanuel Technology Consulting

    http://etc-md.com

    Former Sophos SG(Astaro) advocate/researcher/Silver Partner

    PfSense w/Suricata, ntopng, 

    Other addons to follow

  • 0
    Use regular expressions, e.g.: 
    ^https?://([A-Za-z0-9.-]\.)*newsinc\.com/


    For a recategorization request go to Reassessment Request  and choose Sophos UTM.

    ----------
    Sophos user, admin and reseller.
    Private Setup:

    • XG: HPE DL20 Gen9 (Core i3-7300, 8GB RAM, 120GB SSD) | XG 18.0 (Home License) with: Web Protection, Site-to-Site-VPN (IPSec, RED-Tunnel), Remote Access (SSL, HTML5)
    • UTM: 2 vCPUs, 2GB RAM, 50GB vHDD, 2 vNICs on vServer (KVM) | UTM 9.7 (Home License) with: Email Protection, Webserver Protection, RED-Tunnel (server)
  • 0
    Use regular expressions, e.g.:
    ^https?://([A-Za-z0-9.-]\.)*newsinc\.com/

    For a recategorization request go to Reassessment Request  and choose Sophos UTM.


    So that means the domain blocking section isn't working correctly...I'll contact support

    Owner:  Emmanuel Technology Consulting

    http://etc-md.com

    Former Sophos SG(Astaro) advocate/researcher/Silver Partner

    PfSense w/Suricata, ntopng, 

    Other addons to follow

  • 0
    Domain blocking in 9.1 works two ways:

    You can add a domain into the domains field.  This specific domain ONLY is blocked (not any subdomains).  Wildcards are not supported.  If you enter in "*.whatever.whatever" then nothing will get blocked.  If you enter in "whatever" then nothing will get blocked.

    If you use domains blocking, I recommend that you do not also enter in a Regular Expression.  This is because the two fields are ANDed together not ORed.  Therefore something would need to match both the domain and regex before it is blocked.

    The other option is to just use regular expressions.  For this leave the Domains field blank.  Use code similar to what scorpianking posted.

    The online help contains this information as well.

    In 9.2 the functionality will be exactly the same but the UI will be clearer that you can do domain, you can do regex, or you can do regex that applies to a domain.
  • 0
    Domain blocking in 9.1 works two ways:

    You can add a domain into the domains field.  This specific domain ONLY is blocked (not any subdomains).  Wildcards are not supported.  If you enter in "*.whatever.whatever" then nothing will get blocked.  If you enter in "http://whatever" then nothing will get blocked.

    If you use domains blocking, I recommend that you do not also enter in a Regular Expression.  This is because the two fields are ANDed together not ORed.  Therefore something would need to match both the domain and regex before it is blocked.

    The other option is to just use regular expressions.  For this leave the Domains field blank.  Use code similar to what scorpianking posted.

    The online help contains this information as well.

    In 9.2 the functionality will be exactly the same but the UI will be clearer that you can do domain, you can do regex, or you can do regex that applies to a domain.


    That's unfortunate...it was so easy to nail an entire domain with *.domain.TLD....

    Owner:  Emmanuel Technology Consulting

    http://etc-md.com

    Former Sophos SG(Astaro) advocate/researcher/Silver Partner

    PfSense w/Suricata, ntopng, 

    Other addons to follow

  • 0
    But once you got the RegEx basics, it's not that difficult.
    You have much more possibilities with RegEx to restrict your rules...

    ^ = the beginning of the string to match
    \ = escape sign for special characters (like . or \)
    [A-Za-z0-9.-] = only the character sets A-Z, a-z, . and - are allowed
    ? = the previous character (or set) is optional
    * = the previous character (or set) may appear 0 or more times
    + = the previous character (or set) may appear 1 or more times

    So the pattern "^https?://([A-Za-z0-9.-]+\.)?domain\.tld/" matches the domain and all its subdomains without allowing e.g. "my.domain.tld.baddomain.tld" or "http:/.../something"...

    ----------
    Sophos user, admin and reseller.
    Private Setup:

    • XG: HPE DL20 Gen9 (Core i3-7300, 8GB RAM, 120GB SSD) | XG 18.0 (Home License) with: Web Protection, Site-to-Site-VPN (IPSec, RED-Tunnel), Remote Access (SSL, HTML5)
    • UTM: 2 vCPUs, 2GB RAM, 50GB vHDD, 2 vNICs on vServer (KVM) | UTM 9.7 (Home License) with: Email Protection, Webserver Protection, RED-Tunnel (server)
Cookie Information Banner