URL blocking

Answered Question
Jun 12th, 2008
User Badges:

Hello Sir,


I want to block 'orkut' in my network with websense, when i am trying with the same, 'gmail' also got blocked, how can i block 'orkut' with out affecting gamil by websense...

Thank You.

Correct Answer by Farrukh Haroon about 8 years 11 months ago

Yes its better to use the pattern matching as the earlier poster described, if you do nslookup of both the google webpage and orkut, you see one very interesting thing:


> www.google.com


Non-authoritative answer:

Name: www.l.google.com

Addresses: 74.125.39.103, 74.125.39.99, 74.125.39.104, 74.125.39.147

Aliases: www.google.com


> www.orkut.com


Non-authoritative answer:

Name: orkut.l.google.com

Address: 209.85.129.85

Aliases: www.orkut.com


Compare the two A records, both contain *.google.com. So thats why websense is thinking both to be the same, both are sub-domains of the same domain.


You could also maybe put www.google.com in a White List or something.


Regards


Farrukh

Correct Answer by dgroscost about 8 years 11 months ago

In Websense v6.3.2 (possibly earlier versions as well) you can block by URL Patterns. Simply place the word orkut in your policies to block and that should do it.


Worst case, you can use RegEX in your firewalls/routers and block it that way.



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Loading.
Correct Answer
dgroscost Fri, 06/13/2008 - 08:00
User Badges:

In Websense v6.3.2 (possibly earlier versions as well) you can block by URL Patterns. Simply place the word orkut in your policies to block and that should do it.


Worst case, you can use RegEX in your firewalls/routers and block it that way.



Correct Answer
Farrukh Haroon Fri, 06/13/2008 - 11:42
User Badges:
  • Red, 2250 points or more

Yes its better to use the pattern matching as the earlier poster described, if you do nslookup of both the google webpage and orkut, you see one very interesting thing:


> www.google.com


Non-authoritative answer:

Name: www.l.google.com

Addresses: 74.125.39.103, 74.125.39.99, 74.125.39.104, 74.125.39.147

Aliases: www.google.com


> www.orkut.com


Non-authoritative answer:

Name: orkut.l.google.com

Address: 209.85.129.85

Aliases: www.orkut.com


Compare the two A records, both contain *.google.com. So thats why websense is thinking both to be the same, both are sub-domains of the same domain.


You could also maybe put www.google.com in a White List or something.


Regards


Farrukh

Actions

This Discussion