Only allow certain ports to certain FQDNs
-
Is there a way to setup pfSense to only allow certain ports to access certain FQDNs? For example, setup port 993 to only access *.gmail.com, or NTP (123) to only access a set of FQDNs? FQDNs that do not match the allowed FQDN should be dropped (if a connection is going to port 993 to www.yahoo.com, it should be dropped).
-
You can setup an outbound NAT rule that translates any activity on port 993 to redirect to some other IP address and port, if that's what you mean.
-
I don't want it to actually redirect the traffic. I just want to create a rule that will look at the port and destination and if that destination doesn't meet the allowed destination for that port, the connection is dropped. I know how to do it with individual IPs using a firewall rule (the same way you setup egress filtering and only allow certain things out). My main question is how to use FQDNs (which can have many IPs), such as gmail.com for that destination address?
-
You can use aliases to represent an URL list. Perhaps you could craft an Outbound NAT rule with an URL list aliases as the Destination?
-
Can I use wildcards in hostname aliases? So to represent all Google URLs, just use "*.google.com", and that would resolve for www.google.com, mail.google.com, drive.google.com, etc.
-
No, I don't believe so. You will have to compile a list of every IP address or FQDN used by the services that you wish to block or redirect. Someone else has an ongoing thread of IP addresses for all of Google video aka YouTube, Facebook etc. Perhaps there is a known list of Gmail addresses that you can use.
-
Thanks for the help. Would it be correct to assume that if I add an alias to www.google.com and/or mail.google.com, drive.google.com, etc. (without wildcards) it will correctly resolve the IP addresses associated with these domains and sub-domains?
-
No, and you don't want to do that anyway. Services like Facebook, Google, YouTube et al use load balancers and global CDNs. Every time you do a lookup of www.google.com, for example, you can get a different IP address from the pool they have for that domain.
-
I understand. Out of curiosity, the Aliases and Hostnames help pages (https://doc.pfsense.org/index.php/Aliases) say the following:
For Host and Network type aliases, you can enter a fully qualified domain name (FQDN) instead of an IP address. The FQDN will be resolved by DNS every 5 minutes and updated internally. This can be useful for tracking dynamic DNS entries to identify sites or users that are unable to use a static IP.
Is that not what I'm trying to do?
-
Yes, but if you're using the resolved IP address to do anything, there is no guarantee that will be the same IP address even a second later. For example, I just did an nslookup on www.google.com. Here is what I got:
Non-authoritative answer:
Name: www.google.com
Addresses: 2607:f8b0:400b:80b::1011
74.125.226.147
74.125.226.148
74.125.226.144
74.125.226.145
74.125.226.146Then I went to a DNS website and resolved www.google.com. Here is what I got:
74.125.131.147
Yet another resolver gave me this:
Type Domain Name IP Address TTL
A www.google.com 74.125.227.144 5 min
A www.google.com 74.125.227.145 5 min
A www.google.com 74.125.227.146 5 min
A www.google.com 74.125.227.147 5 min
A www.google.com 74.125.227.148 5 minSo as you can see, the IP addresses are all over the place.
-
So what you're saying is that if I setup the system in the same way as the guide describes and it resolves an IP every 5 minutes, if within that 5 minutes window, the IP changes and I try to use that resolved IP right after, the connection will fail because the resolved IP that the firewall holds is different than the current IP of the FQDN?
-
Yes, that's what I'm afraid of. If you instead use a list of IP addresses that all respond to your FQDN, one will always match unless they roll out new IPs.
-
The IPs your firewall gets may not be the same IPs your clients get.
