[AusNOG] SSL packet inspection security

[Nathan]

Sorry I'm a bit late, but since its SSL the SNI header can be used and
inspected (which is only in the handshake so it's not inspecting _all_ the
packets) and use that for filtering, I know there's a netfilter module to
do it (quick google found https://github.com/Lochnair/xt_tls), I think
JunOS can do it
https://apps.juniper.net/feature-explorer/feature-info.html?fKey=7646&fn=Server%20Name%20Indication%20(SNI)%20for%20Web%20filtering
and probably most of the others when you get to certain levels of licensing.

The benefit is you don't need to MITM the SSL connection, the SNI is sent
in clear-text and is even part of the first packet in the handshake (lots
of application level proxies use this to route TLS connections without
terminating them, like haproxy).

Cheers,
Kosh

On Mon, 16 Aug 2021 at 20:23, Andres Miedzowicz <
Andres.Miedzowicz at gsn.com.au> wrote:

> Hi Jennifer,
>
> Thanks for that. However, my question is more around the options of
> allowing access to millions of IPs (Office alone has /13s, /14s, /15s and
> /16s) or narrowing up the list of destination addresses and tightening up
> security at the expense of the potential caveats that the MITM approach the
> firewalls take to decrypt and inspect outgoing, secure traffic.
>
> Regards,
>
> Andres
>
> Sent from my iPhone
>
> On 16 Aug 2021, at 20:16, Jennifer Sims <jenn at jenn.id.au> wrote:
>
> 
> You should be able to cover 365 via the publicly available IP ranges
>
> https://docs.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide
>
> For amazon S3
>
> https://aws.amazon.com/premiumsupport/knowledge-center/s3-find-ip-address-ranges/
>
> That should give you a good starting point.
>
> On Mon, Aug 16, 2021 at 7:36 PM Andres Miedzowicz <
> Andres.Miedzowicz at gsn.com.au> wrote:
>
>> Hello,
>>
>>
>>
>> I need to create a firewall rule for outgoing traffic from my network to
>> the internet for services hosted in public clouds where the destination URL
>> has multiple dynamic IPs (ie: an AWS S3 bucket, Outlook 365 in Azure, etc)
>> which makes a rule based on a destination FQDN troubling because each DNS
>> query will provide a different IP every time. My possible solutions are:
>>
>>
>>
>>    1. Use a firewall rule using a Web URL filter, or application/content
>>    filtering (depending on the vendor) where I need to perform deep packet
>>    inspection to get the full destination URL or detect the application (ie:
>>    email delivery to O365). When this method is used with most of the vendors,
>>    the process involves a MITM approach where the SSL Certificate presented to
>>    the client is one generated by the firewall with the root CA certificate
>>    issued by the firewall as well.
>>
>>
>>
>>    1. Set the destination IP of the rule the full list of possible
>>    ranges for the public cloud which could mean millions of IPs.
>>
>>
>>
>> Any thoughts on security concerns with each of the approaches? Is it
>> worth the potential decrease in security by using a non-trusted Root CA
>> internally (even though we can install the certificate in the
>> application/browser to force it to trust it) vs. allowing access to
>> destination IPs that are not necessary for this service but ensures
>> uninterrupted encryption end-to-end?
>>
>>
>>
>> Thank you all,
>>
>>
>>
>> Andres
>> _______________________________________________
>> AusNOG mailing list
>> AusNOG at lists.ausnog.net
>> http://lists.ausnog.net/mailman/listinfo/ausnog
>>
> _______________________________________________
> AusNOG mailing list
> AusNOG at lists.ausnog.net
> http://lists.ausnog.net/mailman/listinfo/ausnog
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20210819/1668ebd7/attachment.html>