Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    FQDN on alises for gmail

    Scheduled Pinned Locked Moved Firewalling
    14 Posts 4 Posters 5.2k Views 4 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • GertjanG Online
      Gertjan
      last edited by Gertjan

      Just for my personal curiosity :
      I don't have your motives to switch a company controlled mail server over to Google, but, still ...
      Having a 'local' mail server isn't that rocket science these days ... (ok, you have to know what a mail is, that helps).
      I understand that you want to limit outgoing mail only to your Google mail servers. That's pretty tight ...

      edit :
      I thought a little bit more about the issue :
      This list with IP's is like moving sable.

      Just ask yourself this question : Why is Google never announcing "Maintenance on network - some services might be unavailable " ?
      Because they program their DNS to exclude some clusters upfront.
      Then, after the DNS time out, they take down an entire cluster, do their maintenance, and re activate the IP's again in the list. The entire process becomes totally transparent for their user (planet Earth).
      If you make a static list with all possible IP's, your clients could hit IP's that are "unavailable" at some moment.

      The perfect solution might as well not exist.

      No "help me" PM's please. Use the forum, the community will thank you.
      Edit : and where are the logs ??

      perikoP 1 Reply Last reply Reply Quote 0
      • perikoP Offline
        periko @Gertjan
        last edited by

        @gertjan I use to manage the email before, but the company decide to move to the cloud , sometime we just need to follow orders.

        Normally, I just open what I need normally, for security reason and to avoid users that try to be curious with a computer.

        This is the main reason.

        Necesitan Soporte de Pfsense en México?/Need Pfsense Support in Mexico?
        www.bajaopensolutions.com
        https://www.facebook.com/BajaOpenSolutions
        Quieres aprender PfSense, visita mi canal de youtube:
        https://www.youtube.com/c/PedroMorenoBOS

        1 Reply Last reply Reply Quote 1
        • perikoP Offline
          periko
          last edited by

          Just to add news, I found this site:

          google ips

          I have found this info, add to my alias and looks like is working.

          Just the email ports.

          Thanks.

          Necesitan Soporte de Pfsense en México?/Need Pfsense Support in Mexico?
          www.bajaopensolutions.com
          https://www.facebook.com/BajaOpenSolutions
          Quieres aprender PfSense, visita mi canal de youtube:
          https://www.youtube.com/c/PedroMorenoBOS

          1 Reply Last reply Reply Quote 0
          • johnpozJ Offline
            johnpoz LAYER 8 Global Moderator
            last edited by johnpoz

            Blocking or allowing traffic to CDN hosted services is becoming harder and harder... And for companies to do that you either need a NGFW that does it all for you upfront... Say Palo Alto and the likes - but they come with a HUGE price tag... Or you need someone smart enough to leverage the other options that don't cost so much but need the person using them to know how to do it.

            Pfsense for sure can use openappid with snort to allow/block specific applications.. So you could for sure just allow gmail for example.

            If your goal is blocking allowing specific web based services - your better off actually using proxy, because proxy can be used to just allow or block based upon name ie url vs having to block large or allow huge amounts of IP space that is used by such services on their CDN that can change every other minute, etc.

            If your company is wanting you to save money and control your network with pfsense vs paying the price tag for say PA... you should prob ask them to atleast spring for some official pfsense training..

            https://www.netgate.com/training/

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 25.07 | Lab VMs 2.8, 25.07

            perikoP 1 Reply Last reply Reply Quote 0
            • perikoP Offline
              periko @johnpoz
              last edited by

              @johnpoz my goal is to allow our email like Thunderbird or Outlook to access the email services from gmail only.

              For other users that doesn't need this apps, I will run them over a proxy.

              All this under pfsense.

              Necesitan Soporte de Pfsense en México?/Need Pfsense Support in Mexico?
              www.bajaopensolutions.com
              https://www.facebook.com/BajaOpenSolutions
              Quieres aprender PfSense, visita mi canal de youtube:
              https://www.youtube.com/c/PedroMorenoBOS

              1 Reply Last reply Reply Quote 0
              • johnpozJ Offline
                johnpoz LAYER 8 Global Moderator
                last edited by

                So the port thing is easy enough to do... The problem is that gmail is hosted off a global CDN and has huge amounts of IPs that can change all the time..

                You could for sure just use openappid to allow gmail access only.
                While you might find some IP lists, and you could pull these lists from their ASNs yourself - prob you going to run into these can and do change all the time as well.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 25.07 | Lab VMs 2.8, 25.07

                perikoP 1 Reply Last reply Reply Quote 0
                • NogBadTheBadN Offline
                  NogBadTheBad
                  last edited by

                  Pfblocker to create a google alias based on ASN number, get pfBlocker to update the alias daily ?

                  Andy

                  1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                  perikoP 1 Reply Last reply Reply Quote 0
                  • perikoP Offline
                    periko @johnpoz
                    last edited by

                    @johnpoz we are getting to much good information here, snort haven't try yet, but is on the list.

                    Necesitan Soporte de Pfsense en México?/Need Pfsense Support in Mexico?
                    www.bajaopensolutions.com
                    https://www.facebook.com/BajaOpenSolutions
                    Quieres aprender PfSense, visita mi canal de youtube:
                    https://www.youtube.com/c/PedroMorenoBOS

                    1 Reply Last reply Reply Quote 0
                    • perikoP Offline
                      periko @NogBadTheBad
                      last edited by

                      @nogbadthebad have u try that?

                      Necesitan Soporte de Pfsense en México?/Need Pfsense Support in Mexico?
                      www.bajaopensolutions.com
                      https://www.facebook.com/BajaOpenSolutions
                      Quieres aprender PfSense, visita mi canal de youtube:
                      https://www.youtube.com/c/PedroMorenoBOS

                      1 Reply Last reply Reply Quote 0
                      • NogBadTheBadN Offline
                        NogBadTheBad
                        last edited by NogBadTheBad

                        Only having a play with a match outbound for Facebook, it looks something like this:-

                        0_1551472686396_Screenshot 2019-03-01 at 20.36.55.png

                        You'd need to use googles ASN numbers, it would automate fetching new IP addresses asigned to google.

                        Have a play.

                        Andy

                        1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                        perikoP 1 Reply Last reply Reply Quote 0
                        • perikoP Offline
                          periko @NogBadTheBad
                          last edited by

                          @nogbadthebad I will give a try to pfblockerng to, I use but not with ASN.
                          Good move.

                          Necesitan Soporte de Pfsense en México?/Need Pfsense Support in Mexico?
                          www.bajaopensolutions.com
                          https://www.facebook.com/BajaOpenSolutions
                          Quieres aprender PfSense, visita mi canal de youtube:
                          https://www.youtube.com/c/PedroMorenoBOS

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.