Helpful ReplyHot!Blocking all traffic to server except one URL https connection, Fortigate 90e

Author
VR
New Member
  • Total Posts : 7
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/07/06 03:52:20
  • Status: offline
2018/07/06 04:15:48 (permalink)
0

Blocking all traffic to server except one URL https connection, Fortigate 90e

Hi there guys, we are a company that develops software for a small company.
We have developed an app that makes a connection to a box server in the company using Domino Access services. It is a REST API https connection. The app is making a GET request and server sends back data in JSON format.

Our app is hosted in IBM Cloud and it has public url it uses for communication.
The IT security of the company is managed by a different IT technical support company and they are using FortiGate 90e firewall. The person configuring this firewall was unable to quickly have a suitable solution on how to restrict EVERYTHING else from communicating with server except that one app that has dedicated URL. We tried to block connection based on IP, but since the app is hosted in the cloud IPs can change, we were given IP ranges by IBM, but they don't even match the IP of request of the app.

So we are thinking on restricting everything except these https requests from an app that was given URL by IBM cloud in the form of: "myFancyApp.mybluemix.net."

Can anyone please kindly guide us through making that nice helpful person through configuring his Fortigate 90e firewall to allow our app to communicate through firewall with that server and block everything else in the world ?

We will appreciate any links to "cookbooks" and advice, thank you most kindly in advance. 
#1
emnoc
Expert Member
  • Total Posts : 5062
  • Scores: 307
  • Reward points: 0
  • Joined: 2008/03/20 13:30:33
  • Location: AUSTIN TX AREA
  • Status: offline
Re: Blocking all traffic to server except one URL https connection, Fortigate 90e 2018/07/06 05:01:47 (permalink)
0
You should use some type auth at the app like a API-KEy but that's not for me to debate. Is the RESTful call done thru HTTP or HTTPS?
 

PCNSE,  NSE , Forcepoint ,  StrongSwan Specialist
#2
VR
New Member
  • Total Posts : 7
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/07/06 03:52:20
  • Status: offline
Re: Blocking all traffic to server except one URL https connection, Fortigate 90e 2018/07/06 05:12:27 (permalink)
0
Thanks for responding. It is IBM Domino Server, it is secured by SHA2 and it has encryption certificate, http connections are not allowed.

The app is making htttps GET requests, the server returns data in JSON format. With firewall on, connections from app hosted in the IBM cloud are timing out and failing, when firewall was disabled for 5 minutes, we could get connection back from server.

The server is dedicated to provide data to that one single app and nothing else. We are trying to figure out how to explain firewall administrator how to configure his managed firewall.
#3
rwpatterson
Expert Member
  • Total Posts : 8299
  • Scores: 181
  • Reward points: 0
  • Joined: 2006/08/08 10:08:18
  • Location: Long Island, New York, USA
  • Status: online
Re: Blocking all traffic to server except one URL https connection, Fortigate 90e 2018/07/06 05:24:17 (permalink)
0
Not to rain on your parade, but that sounds more like a web server configuration to me.

-Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

-4.3.19-b0694
FWF60B
FWF80CM (4)
FWF81CM (2)
 
#4
VR
New Member
  • Total Posts : 7
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/07/06 03:52:20
  • Status: offline
Re: Blocking all traffic to server except one URL https connection, Fortigate 90e 2018/07/06 05:38:06 (permalink)
0
If:
1. He had firewall on and app couldn't connect.
And:
2. He had turned it off for 5 minutes and we could connect.
Then it is firewall issue or do you mean it is "web server configuration" option somewhere in the options of the firewall ?

Before that we tried IP restriction, but because it is a cloud app, we don't have a guaranteed static IP address, it keeps changing.
post edited by VR - 2018/07/06 05:39:40
#5
VR
New Member
  • Total Posts : 7
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/07/06 03:52:20
  • Status: offline
Re: Blocking all traffic to server except one URL https connection, Fortigate 90e 2018/07/06 05:50:10 (permalink)
0
We were thinking maybe he has to create whitelist web filter and add a record looking like:
*.mybluemix.net
or maybe the full URL of the app like:
"myFancyApp.mybluemix.net"

Or is the whitelist web filter only for outgoing http requests ?
Does anyone have any clue or scripting links/examples on how to make the URI resources hosted by that server accessible only to the app that has URL:  "myFancyApp.mybluemix.net" ?

To rephrase the explanation here - it is webserver hosting data and displaying it in JSON format as REST api. We need this server locked down and blocked from any incoming connections except one app located at "myFancyApp.mybluemix.net" making https GET requests to retrieve data in JSON format on that server on various URIs with the help of  Fortigate 90e firewall through which all of this communication is happening.
post edited by VR - 2018/07/06 06:02:12
#6
Deepakkhw
New Member
  • Total Posts : 20
  • Scores: 2
  • Reward points: 0
  • Joined: 2017/12/24 08:12:49
  • Status: offline
Re: Blocking all traffic to server except one URL https connection, Fortigate 90e 2018/07/09 02:29:32 (permalink) ☄ Helpfulby VR 2018/07/09 04:17:52
5 (1)
Hi,
You can make it possible with static URL filter option in FortiGate. 
1. First Line: First Simply allow the Simple URL (Your static URL)
2. Second Line: Block "mybluemix.net" with the wildcard.
 
http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-security-profiles-54/Web_Filter/Static%20URL%20Filter.htm
 
 
#7
VR
New Member
  • Total Posts : 7
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/07/06 03:52:20
  • Status: offline
Re: Blocking all traffic to server except one URL https connection, Fortigate 90e 2018/07/09 04:17:44 (permalink)
0
Good sir, I thank you most kindly !
I don't know yet if I can make use of this, and if it works, but it most definitely answers the question I asked.
#8
DingDong
New Member
  • Total Posts : 6
  • Scores: 4
  • Reward points: 0
  • Joined: 2017/07/07 01:15:06
  • Status: offline
Re: Blocking all traffic to server except one URL https connection, Fortigate 90e 2018/07/09 04:53:36 (permalink)
0
Hi
I would do it with a policy from internal interface to public interface, from all internal addresses to an FQDN.
If this doesn't work because unfortunately on the IPv4 policy you can't have wildcard FQDNs, then I would have the IT guy make a web filter. Block all categories and then in the section called 'static URL filter' you can set URL overrides and put there FQDNs and wildcard FQDNs that are allowed to bypass the web filter.
If you need more details let me know.
#9
VR
New Member
  • Total Posts : 7
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/07/06 03:52:20
  • Status: offline
Re: Blocking all traffic to server except one URL https connection, Fortigate 90e 2018/07/10 02:06:58 (permalink)
0
Thank you for your reply.
After some time looking into this I started to think it was impossible.

Just to quickly check if I understood it correctly:
There is a server in company's intranet or DMZ, behind a firewall. It's sole purpose is to respond to HTTP GET requests for resources from an app located in the cloud which has been given a URL like "myApp.mybluemix.net" and can be reached on that address.

And the server can be blocked from any INCOMING connections but the connection from an app with that URL hosted in IBM cloud ? As in: firewall will filter connections INCOMING to intranet ?

Or does it mean that the server will not be blocked from being accessed from the Internet, but it will be able to reply only to the App's URL because the firewall will block any other replies ? As in: firewall will filter connections OUTGOING to internet ?

Cause we are concerned about security of server data, and the person managing firewall said second option may not be sufficiently secure and we would really like to have first option - blocking and filtering connection INCOMING to intranet.
post edited by VR - 2018/07/10 02:08:36
#10
DingDong
New Member
  • Total Posts : 6
  • Scores: 4
  • Reward points: 0
  • Joined: 2017/07/07 01:15:06
  • Status: offline
Re: Blocking all traffic to server except one URL https connection, Fortigate 90e 2018/07/10 02:18:41 (permalink) ☄ Helpfulby VR 2018/07/10 03:06:20
5 (1)
Hi
 
WIth the IPv4 policy it still should be possible, given that either a) you know the IP address or range the http get request comes from or b) you can limit the origin of the http get request to an FQDN (or a number of them) and do not need to use a wildcard FQDN. This way you don't need to use a web filter at all. The policy would look something like the attached picture (you still can add multiple FQDNs to the source but not a wildcard FQDN).
 
By the way, I am just thinking, maybe it would be possible with the application control feature, but I'm not enough into it to tell you that exactly.
 
See if that works for you!

Attached Image(s)

#11
VR
New Member
  • Total Posts : 7
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/07/06 03:52:20
  • Status: offline
Re: Blocking all traffic to server except one URL https connection, Fortigate 90e 2018/07/10 03:07:44 (permalink)
0
Oh, we will explore this option ASAP with the firewall admin, thank you most kindly for your explanation and setting screenshot example.
#12
Mandla
New Member
  • Total Posts : 1
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/11/08 09:59:49
  • Status: offline
Re: Blocking all traffic to server except one URL https connection, Fortigate 90e 2018/11/08 10:08:45 (permalink)
0
I am so frustrated....i just bought huawei router....i work with a lot of clients, when i visit some client sites....i find them blocked....how on earth do i disable this thing....it is tempering with my ability to deliver....so frustrated PLEASE help me mndsibanda@gmail.com
#13
Jump to:
© 2018 APG vNext Commercial Version 5.5