FQDN on alises for gmail

[periko]

Hi guys.

We move a company email to gmail g suite.

I have some issues related to the rule to allow LAN users to gmail smtp, imap server.

I add a alias for:

smtp.gmail.com && imap.gmail.com
port: 465,587,993

I put a rule in the Firewall-LAN to allow the LAN to go those aliases.

But for some strange reason is intermittent, what I mean is that some times let u access, others won't allow.

smtp and imap use a lot of ip, I was thinking that with this rules pfsense would allow the users reach gmail servers without issues.

I didn't want to search for all the IP's in the tcpdump debug console.

Any advice related to this problem someone could share?

Pfsense 2.4.4_p2, thanks.

[Gertjan]

Hi,

It's a know issue.
Your alias is converted to IP's (IPv4 and/or IPv6) every 5 minutes by a process called filterdns that resolves the URL's.
Added to that, pfSense could use the local default Resolver, and client PC's could use some remote DNS's (very popular these days) like 8.8.8.8.

The thing is : on every DNS request, different IP's could come back as a result, because big operators use any-cast DNS. They have to do so to keep latency low, and to maintain a good accessibility for their billions of users.

An approach to a solution would be : have pfSense and your clients using the same DNS.
A best solution would be : maintain manually a alias list with all the existing IP's / IP ranges.

The same thing goes for Facebook IP's, Twitter, etc etc etc.

[periko]

I was trying to avoid the option to manually add the IP's as they appear.
But looks like is the only way.
Thanks for your information and help.

[Gertjan]

Just for my personal curiosity :
I don't have your motives to switch a company controlled mail server over to Google, but, still ...
Having a 'local' mail server isn't that rocket science these days ... (ok, you have to know what a mail is, that helps).
I understand that you want to limit outgoing mail only to your Google mail servers. That's pretty tight ...

edit :
I thought a little bit more about the issue :
This list with IP's is like moving sable.

Just ask yourself this question : Why is Google never announcing "Maintenance on network - some services might be unavailable " ?
Because they program their DNS to exclude some clusters upfront.
Then, after the DNS time out, they take down an entire cluster, do their maintenance, and re activate the IP's again in the list. The entire process becomes totally transparent for their user (planet Earth).
If you make a static list with all possible IP's, your clients could hit IP's that are "unavailable" at some moment.

The perfect solution might as well not exist.

[periko]

@gertjan I use to manage the email before, but the company decide to move to the cloud , sometime we just need to follow orders.

Normally, I just open what I need normally, for security reason and to avoid users that try to be curious with a computer.

This is the main reason.

[periko]

Just to add news, I found this site:

google ips

I have found this info, add to my alias and looks like is working.

Just the email ports.

Thanks.

[johnpoz]

Blocking or allowing traffic to CDN hosted services is becoming harder and harder... And for companies to do that you either need a NGFW that does it all for you upfront... Say Palo Alto and the likes - but they come with a HUGE price tag... Or you need someone smart enough to leverage the other options that don't cost so much but need the person using them to know how to do it.

Pfsense for sure can use openappid with snort to allow/block specific applications.. So you could for sure just allow gmail for example.

If your goal is blocking allowing specific web based services - your better off actually using proxy, because proxy can be used to just allow or block based upon name ie url vs having to block large or allow huge amounts of IP space that is used by such services on their CDN that can change every other minute, etc.

If your company is wanting you to save money and control your network with pfsense vs paying the price tag for say PA... you should prob ask them to atleast spring for some official pfsense training..

https://www.netgate.com/training/

[periko]

@johnpoz my goal is to allow our email like Thunderbird or Outlook to access the email services from gmail only.

For other users that doesn't need this apps, I will run them over a proxy.

All this under pfsense.

[johnpoz]

So the port thing is easy enough to do... The problem is that gmail is hosted off a global CDN and has huge amounts of IPs that can change all the time..

You could for sure just use openappid to allow gmail access only.
While you might find some IP lists, and you could pull these lists from their ASNs yourself - prob you going to run into these can and do change all the time as well.

[NogBadTheBad]

Pfblocker to create a google alias based on ASN number, get pfBlocker to update the alias daily ?

[periko]

@johnpoz we are getting to much good information here, snort haven't try yet, but is on the list.

[periko]

@nogbadthebad have u try that?

[NogBadTheBad]

Only having a play with a match outbound for Facebook, it looks something like this:-

You'd need to use googles ASN numbers, it would automate fetching new IP addresses asigned to google.

Have a play.

[periko]

@nogbadthebad I will give a try to pfblockerng to, I use but not with ASN.
Good move.