Watchguard proxy deny executables
I have a Watchguard firewall that I'm trying to block executables from being downloaded on.
If I allow application/octet-stream under "Content Types" so that users can download PDF, word, and excel documents from their webmail, then executables (EXE) appear to be allowed on that Watchguard proxy.
How can I allow application/octet-stream and deny executables.?
If I allow application/octet-stream under "Content Types" so that users can download PDF, word, and excel documents from their webmail, then executables (EXE) appear to be allowed on that Watchguard proxy.
How can I allow application/octet-stream and deny executables.?
If you need to allow application/octet-stream only from one/few specific sites, then you can configure as below:
1. Your current HTTP proxy service with application/octet-stream denied.
2. Create new HTTP proxy or create copy of above [so you would not need to configure from scratch] and then allow application/octet-stream content type and configure as, Enabled and Allowed; from any-trusted [or specific alias/subnet/hosts]; to specific-public-ip-of-webs
Now only for website having their public IP in step 2 would have application/octet-stream allowed; rest sites would have application/octet-stream blocked.
Note that service created at 2 must be placed higher in order than 1; so that it gets hit first.
Please implement and update.
Thank you.
1. Your current HTTP proxy service with application/octet-stream denied.
2. Create new HTTP proxy or create copy of above [so you would not need to configure from scratch] and then allow application/octet-stream content type and configure as, Enabled and Allowed; from any-trusted [or specific alias/subnet/hosts]; to specific-public-ip-of-webs
Now only for website having their public IP in step 2 would have application/octet-stream allowed; rest sites would have application/octet-stream blocked.
Note that service created at 2 must be placed higher in order than 1; so that it gets hit first.
Please implement and update.
Thank you.
ASKER
dpk wal,
Your post sparked an idea that might be my solution but is still quite frustrating
To keep things simple, why don't I just add proxy exceptions in my current HTTP-Proxy_OUT and turn off the application/octet-stream globally.
I'm discouraged that to allow PDF file downloads, I have to allow application/octet-stream at all. This is quite frustrating as that is also the application type for executables. Doesn't make sense to me.
We have alot of users that randomly research on the web and view alot of PDF type documentation. This would keep me chasing my tail making exceptions every time someone is doing a google search for documentation on certain product offerings. Typically PDF documents in alot of cases.
Your post sparked an idea that might be my solution but is still quite frustrating
To keep things simple, why don't I just add proxy exceptions in my current HTTP-Proxy_OUT and turn off the application/octet-stream globally.
I'm discouraged that to allow PDF file downloads, I have to allow application/octet-stream at all. This is quite frustrating as that is also the application type for executables. Doesn't make sense to me.
We have alot of users that randomly research on the web and view alot of PDF type documentation. This would keep me chasing my tail making exceptions every time someone is doing a google search for documentation on certain product offerings. Typically PDF documents in alot of cases.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
If file extension is enough for you you, allow more content-type and filter by file extension
If not let me know and I can provide you some content-type that filter most executable.
If not let me know and I can provide you some content-type that filter most executable.
You should also look into the https proxy in case this is a ssl webmail.