topic Re: Block PDF sites in Next-Generation Firewall Discussions

Block PDF sites

Tuguldur — Wed, 03 Jul 2024 07:30:44 GMT

Hello there,

I need to every pdf converter sites. Examples like pdf.io, tools.pdf24.org, lightpdf.com.
I need to block that site url that contains "pdf"

How to configure it ? Any help please ?

Re: Block PDF sites

Claw4609 — Wed, 03 Jul 2024 19:07:10 GMT

Hello,

Do you have ssl inspection applied? If so you should be able to do a custom app-id, possibly matching a the http-req information. This would also more than likely catch items that you wouldnt want to catch, but if you're goal is to block any url that contains "pdf" then a custom app-id and a block rule for that app-id should get the job done.

Re: Block PDF sites

BPry — Wed, 03 Jul 2024 19:18:18 GMT

@Tuguldur,

I'd caution that what you're attempting to do isn't viable and attempting to block any URL that requests a resource that contains 'pdf' is going to many false-positives and usability issues on other resources. Your best bet with something like this would be a "best effort" attempt to identify resources and listing them in an easily updated EDL that you'd manage to attempt to block this sort of thing and having a policy that it isn't to be done and anyone identified doing so will face consequences.

While a large amount of these resources will include "pdf" in the URL, not all of them do. If you setup a signature to block access to anything with PDF in http-req I'd be extremely mindful of the number of resources you'll actually end up blocking and whether or not that's actually something you want to do.

Re: Block PDF sites

Tuguldur — Thu, 04 Jul 2024 06:27:23 GMT

Many Thanks. I have created custom app, it worked fine.

Re: Block PDF sites

Tuguldur — Thu, 04 Jul 2024 06:29:03 GMT

Many thanks for the help and many more.

About false positive, I aiming for the pdf so I dont need to worry about that. Thanks !!! 😄 🙂