Bypass Firewall and block Download Accelerator

[nbctcp]

https://wordpress.com/post/nbctcp.wordpress.com/1811

I want to know whether PANOS 9.x be able to block some technique to bypass firewall and download accelerator such as

1. DNS over TLS (method 11)

2. Soft Ether (method 7)

3. ZenMate (method 3)

4. Opera Turbo (method 2)

5. Open Proxy (method 5)

6. IDM (method 😎

7. FDM (method 9)

8. IDA (method 10)

tq

[OtakarKlier]

Hello,

You might be able to block some of this traffic with App-ID and URL filtering. As for the DNS, we block all DNS outbound traffic except from our internal DNS servers.

Regards,

[nbctcp]

How if DNS over HTTPS or TLS. or SSH

[michelealbrigo]

By definition, unless you decrypt outbound traffic, no firewall would be able to tell DNS over HTTPs traffic from the rest, especially if DoH is implemented over a large cloud infrastructure that you can't block with IP lists (think about Cloudflare and Google, which might host the service on their "base image" and mix up services at their will).

I think the only currently viable solution is browser makers honoring some "kill switch" mechanism (e.g. Mozilla's canary domain: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet and network administrators implementing it, where appropriate (I'm thinking about networks where you have a split-DNS situation, and external clients are pointed to a different IP than internal ones... ...lots of reasons to do this, and not all of them can be worked around). Anyway, not really a firewall problem/solution, here, unless we start fiddling with PAN's DNS proxy.