Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

nProbe IPS: block traffic by FQDN #587

Open
dimalev01 opened this issue Nov 13, 2023 · 12 comments
Open

nProbe IPS: block traffic by FQDN #587

dimalev01 opened this issue Nov 13, 2023 · 12 comments
Assignees
@lucaderi @cardigliano
Labels
bug

Comments

@dimalev01
Copy link

Hello ,

Is it possible to block traffic for specific fqdn's with nprobe in traffic policies?
We tried to do it in "Host Rules" but it doesn't work.

Br ,

Dima Lev.
@cardigliano cardigliano self-assigned this Nov 17, 2023
@cardigliano cardigliano mentioned this issue Nov 17, 2023
Closed
@cardigliano
Copy link
Member

ntopng seems to propagate the policy to nProbe as expected:

{"policy":{"id":3,"default_marker":"pass","markers":{"continents":[],"categories":[],"countries":[],"hostnames":{"test.com":"drop"},"protocols":[]},"name":"Pool 2 rules","flow_risk":{"marker":"drop","bitmap":0},"root":0}}

we need to check on the nProbe side if this is honoured

@cardigliano cardigliano changed the title block traffic by FQDN nProbe IPS: block traffic by FQDN Nov 17, 2023
@dimalev01
Copy link
Author

We will wait for your update.

@cardigliano
Copy link
Member

@dimalev01 sure this is in queue, I will update you as soon as we complete the tests

@lucaderi lucaderi self-assigned this Nov 24, 2023
@lucaderi
Copy link
Member

Can you please report your netfilter configuration? I would like to check whether the problem is due to netflter or nprobe.

@dimalev01
Copy link
Author

dimalev01 commented Nov 26, 2023 via email

@lucaderi
Copy link
Member

Can you please try again as see no netfilter configuration (please also add the ifconfig configuration and explain what interface does what)

@dimalev01
Copy link
Author

dimalev01 commented Nov 29, 2023 via email •
edited by cardigliano

@ntop ntop deleted a comment from dimalev01 Jan 30, 2024
@ntop ntop deleted a comment from dimalev01 Jan 30, 2024
@ntop ntop deleted a comment from dimalev01 Jan 30, 2024
@sever-sever
Copy link

Any updates?

@l0crian1
Copy link

l0crian1 commented May 6, 2024

ntopng seems to propagate the policy to nProbe as expected:

{"policy":{"id":3,"default_marker":"pass","markers":{"continents":[],"categories":[],"countries":[],"hostnames":{"test.com":"drop"},"protocols":[]},"name":"Pool 2 rules","flow_risk":{"marker":"drop","bitmap":0},"root":0}}

we need to check on the nProbe side if this is honoured

@cardigliano I know this is an old issue, so maybe this is already known.

It appears the output you put has improper nesting when compared to the documentation. The "hostnames" is outside of "markers" in the documentation. Maybe ntopng is pushing the policy to nprobe incorrectly. This worked for me once I moved that, though I noticed the matches are explicit (e.g. google.com would only block google.com, and not www.google.com; wildcards didn't work).

@cardigliano
Copy link
Member

@l0crian1 hostnames should be inside markers, we just released an update that fixes this.
As of the wildcards, they are not currently supported for hosts defined under "hostnames" (they are supported when using the protos or categories definitions), however we are working for supporting them, I will update the issue once ready.

@l0crian1
Copy link

l0crian1 commented May 7, 2024

Thanks @cardigliano! Quick question on both methods for host filter (definitions and rules syntax), is it just blocking DNS requests with those (sub)domains, or will it also block on the CN in a certificate?

@cardigliano
Copy link
Member

It detects the hostname from any supported protocol, it includes DNS, HTTP, TLS CN

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@lucaderi lucaderi

@cardigliano cardigliano

Labels
bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@lucaderi @cardigliano @sever-sever @l0crian1 @dimalev01