Instant Messaging App IMO not blocked by Firewall Rules for no internet.

[MindVentures]

So after extensive testing I came to the conclusion that IMO (on Android mobile) keeps working even where the internet access is totally blocked.

My Topology
========

ISP Home Fibre Gateway ==> Untangle Transparent Bridge (2 NICs) ==> Tomato based Netgear Router/APs ==> Wired/Wireless Devices.

I am not using SSL Inspector - I am not sure is it mandatory in my intended scenario or not. As I understand I would have to manually import the certificate on a number of devices (50 plus including PC/Mobiles/TVs/Gaming Consoles/SmartHome IoT) - which is a rather tedious task I am putting off.

My Scenario - spanning across Policy - Firewall - Application Control
==========================================

Wanted to block access to certain identified devices (Mobiles Phones by IP address) for complete internet blackout during the day except for an hour and a half .

So made a policy + rule like below - to identify and tag devices for this specific policy





Onwards I enabled the bare minimum apps I understood I would need to control access for internet blackout and controlling certain IM apps even when internet is available.

So added only the below apps - knowing that probably firewall and application control is all what I need.



Made the following firewall rule



In addition to the firewall - i wanted to control the IM apps (since I saw that firewall is unable to block - more on that laters) . So used application control as follows



Revelations
=======

After setting up the above - in my wee mind - I had conquered it all and achieved the holy grail of super fine grained control to what and what not can be done on my network - assuming the controls are working as desired.

I found out that on the target mobiles (devices) - when the policy time is active, the internet reachability is blocked (the Wifi Connection icon on the mobile shows a little cross symbol) plus no browser pages can be opened -- HOWEVER - the IMO + Whatsapp messaging apps on the mobile keeps working - receiving and sending audio/video calls + messages. I am more focused on IMO.

I tried various modes of connection

1. One mobile on 5G and another on home network - IMO keeps working.
2. Both mobiles assigned to the restrictive policy - IMO keeps working.
3. Establishing an active call session minutes before policy restriction time comes in effect - to see if the call is disconnected - IMO keeps working.

In short despite internet browsing being blocked (not sure what other background services still work) - the IMO app keep working.

Seems like firewall and application control are rendered useless to block this app - plus the firewall rule should block all and any kind of access to internet - as i understand.

Can anyone point me in the right direction if I am missing anything or there is any other way of blocking this/all such apps.

Thanks for your time and responses.

[dashpuppy]

Are you blocking "said" devices via Mac address or ip ? Have you turned off "randomized" mac address on the mobile devices ?

I created a video for this said Time based rule

[MindVentures]

Sure,

The MAC address is not randomized (this option not present in a bit dated low budget android phone) . It is device default and fixed.

For larger networks - going as per Untangle recommendation - I am going by a fixed IP address (assigned by static DHCP server).

Although i have tried enabling the rule via MAC address and to no avail.

Thanks.

[dashpuppy]

Sure,

The MAC address is not randomized (this option not present in a bit dated low budget android phone) . It is device default and fixed.

For larger networks - going as per Untangle recommendation - I am going by a fixed IP address (assigned by static DHCP server).

Although i have tried enabling the rule via MAC address and to no avail.

Thanks.

If you are going to use ip based, make sure you throw that ip into the reservation pool

Also have a look at this video, if still stick let us know.

https://www.youtube.com/watch?v=3g7wNFGn2rQ&t=222s

[MindVentures]

If you are going to use ip based, make sure you throw that ip into the reservation pool

Also have a look at this video, if still stick let us know.

https://www.youtube.com/watch?v=3g7wNFGn2rQ&t=222s

Thanks for pointing me to the video.

I guess my case is a bit more than this according to the details mentioned my OP.

Following differences exist in the approach shown in the video v/s my scenario.

1. In the video it seems untangle is handling DHCP host address assignment on the network, however in my case my DHCP is disabled on Untangle and handled through FreshTomato (2021.2) based Netgear router - pretty stable and running like this for long. Have assigned static DHCP binding for all devices - so whenever they connect their MAC gets the same IP from the pool.

2. Username based approach is also workable, however the identifier to push any device into a certain policy can be IP/MAC/UserName/VLAN Tag and so on, and one can choose based on his/her specific needs . For me IP based identification works fine.

3. In the video " blocking" the internet is tested (i believe) only via checking browser access to any websites or youtube streaming (as it is mentioned in the video). As I mentioned in my OP, the browser based access restriction is working fine in my setup as well during the given time slot. However during the very same time, the IM mobile apps keep working, hence my query is specifically directed towards blocking the "Internet Messaging Apps on Mobile Devices". I recall I guess i did ask this query earlier and I was directed to do packet capture and analysis. Will give it a try, however it may be something beyond my novice level understanding.

A tip for time based rule:
===============

As mentioned in the documentation , to apply a rule throughout the whole day and only allow a certain slot of time for it to be disabled, we have to mention the From and To time in reverse order - only for the time slot intended to be blockage free.

[MindVentures]

Not much traction on the subject I guess.

Anyone who can shed some 101 light on packet capture and how to use the findings from it to block certain application.

Or any pro user - who can test the android app "IMO" in their setup and can guide me to the right direction.

Your guidance would be appreciated.

[dashpuppy]

Not much traction on the subject I guess.

Anyone who can shed some 101 light on packet capture and how to use the findings from it to block certain application.

Or any pro user - who can test the android app "IMO" in their setup and can guide me to the right direction.

Your guidance would be appreciated.

Instead of using a "time" for now, can you try blocking this policy with out it, and see if its actually blocking ?

[MP715]

So after extensive testing I came to the conclusion that IMO (on Android mobile) keeps working even where the internet access is totally blocked.

My Topology
========

ISP Home Fibre Gateway ==> Untangle Transparent Bridge (2 NICs) ==> Tomato based Netgear Router/APs ==> Wired/Wireless Devices.

May I ask why you're not using Untangle as your primary router and setting the Netgear as just an access point?

[jcoehoorn]

May I ask why you're not using Untangle as your primary router and setting the Netgear as just an access point?

Not sure on the OPs motivation, but I've known a few people to do this because the "router" had dhcp features built-in that could only be replicated in Untangle via advanced configuration strings. It's not usually my first choice, but it works fine as long as Untangle is connected to a LAN port instead of the WAN port on the router and is set as the default gateway for the network.

This configuration choice also has one inherent advantage, in that it keeps your internal network up in the case where Untangle goes down; you won't have internet access, but you'll still have printing, some better-engineered IoT services, file sharing, etc.

[MindVentures]

Not sure on the OPs motivation, but I've known a few people to do this because the "router" had dhcp features built-in that could only be replicated in Untangle via advanced configuration strings. It's not usually my first choice, but it works fine as long as Untangle is connected to a LAN port instead of the WAN port on the router and is set as the default gateway for the network.

This configuration choice also has one inherent advantage, in that it keeps your internal network up in the case where Untangle goes down; you won't have internet access, but you'll still have printing, some better-engineered IoT services, file sharing, etc.

This as well as some other features on Fresh Tomato which have grown accustomed to for my use cases.

To name a few :

Static DHCP Binding / VLAN configs / VPN Client Mode (and VPN routing for selected devices on network) while others use default gateway

For Ad Blocking i have PiHole as LAN DNS server - but this can also be acheived by custom ad lists in FreshTomato.

Even a policy without the time boxing , works fine for blocking internet access - in terms of web browsing, media streaming etc. However the mentioned instant messaging app on the mobile device keeps working - although it is available in the "Application Control" (as my screenshot in OP) and I have selected to block/tarpit this application traffic.

Seems like the app traffic signature is not being correctly detected by Untangle to be blocked.

1, Is it necessary to use SSL Inspector while trying to use Application Control for blocking apps with encrypted traffic. Is it a must or optional.

2. Can Untangle look into it, since the application name IMO is already included in built-in stock list of apps which should be easy to block/unblock with a few clicks.

Cheers.

[jcoehoorn]

Seems like the app traffic signature is not being correctly detected by Untangle to be blocked.

This is the nature of application blocking. Since many apps are built from groups of APIs layered on top of HTTP all hosted in the same big AWS pool of IPs, inspection tools often can't know what app is what until after the first several packet exchanges. So a quick check and many apps will seem to function, but then become blocked only after some use... sometimes hitting a specific API endpoint, for example.

1, Is it necessary to use SSL Inspector while trying to use Application Control for blocking apps with encrypted traffic?

It depends on the app. If the app is hosted in AWS or otherwise shares IP information with other services (YouTube is known for this, but so are many others), all traffic goes via HTTPS, and there's not a meaningful hostname included with the unencrypted portion of the header, then you will need SSL Inspector to detect that app.

In the past this hasn't been a big deal, but more and more services are using these features over time. In more recent cases even SSL Inspector will no longer work, and mobile apps often tend towards something called "Certificate Pinning" that prevents Untangle from inserting itself into the conversation to decrypt the traffic for inspection. This still effectively blocks those apps, if that is your goal, but also tends to catch a LOT of other services in the blast radius, some of which you may want to keep available.

2. Can Untangle look into it, since the application name IMO is already included in built-in stock list of apps which should be easy to block/unblock with a few clicks.
Cheers.

Look into what? Changing the fundamental way the internet is built? This isn't magic, and they're not that powerful.

It's important to understand Untangle uses the same basic techniques as other products (just packages them together in an arguably nicer way). You're not gonna have materially different results using something else; this is what the gateway view of your traffic allows for.

If you're having trouble with a particular service, the place to start is the Session Viewer tool in Untangle. Access the service, identify the traffic from that access in Sessions Viewer, and see how Untangle is actually classifying it. And remember, even basic services on the modern internet will use 20 (or more) different domains and requests to provide service. When you visit a web site, the url you see in the address bar at the top of the browser is only the tip of the iceberg.

[gravenscroft]

The vast majority of mobile apps don't restrict themselves to WiFi and NG Firewall can only act on traffic that passes through it. If the device detects that the connection is failing via WiFi, it'll usually just try again using its own data connection. There is, unfortunately, no way for us to disable or filter that connection; while the traffic may be blocked through NG Firewall, it may still go through because the device itself has another route to the internet.

It's also possible that Application Control simply isn't detecting or identifying the app correctly. Check Reports > Application Control > Classified Sessions to verify that App Control is actually able to identify the traffic as matching that application.

[MindVentures]

This is the nature of application blocking. Since many apps are built from groups of APIs layered on top of HTTP all hosted in the same big AWS pool of IPs, inspection tools often can't know what app is what until after the first several packet exchanges. So a quick check and many apps will seem to function, but then become blocked only after some use... sometimes hitting a specific API endpoint, for example.

It depends on the app. If the app is hosted in AWS or otherwise shares IP information with other services (YouTube is known for this, but so are many others), all traffic goes via HTTPS, and there's not a meaningful hostname included with the unencrypted portion of the header, then you will need SSL Inspector to detect that app.

In the past this hasn't been a big deal, but more and more services are using these features over time. In more recent cases even SSL Inspector will no longer work, and mobile apps often tend towards something called "Certificate Pinning" that prevents Untangle from inserting itself into the conversation to decrypt the traffic for inspection. This still effectively blocks those apps, if that is your goal, but also tends to catch a LOT of other services in the blast radius, some of which you may want to keep available.

Look into what? Changing the fundamental way the internet is built? This isn't magic, and they're not that powerful.

It's important to understand Untangle uses the same basic techniques as other products (just packages them together in an arguably nicer way). You're not gonna have materially different results using something else; this is what the gateway view of your traffic allows for.

If you're having trouble with a particular service, the place to start is the Session Viewer tool in Untangle. Access the service, identify the traffic from that access in Sessions Viewer, and see how Untangle is actually classifying it. And remember, even basic services on the modern internet will use 20 (or more) different domains and requests to provide service. When you visit a web site, the url you see in the address bar at the top of the browser is only the tip of the iceberg.

Got it , so i conclude that it is that it may not be 100% possible all the time for untangle to block such traffic accurately and exclusively (by not affecting other non targeted applications).

Was just reaching out to Untangle - to share customer feedback - as the name for this particular IM app was delivered in Application Control in out of the box COTS product - where most of the features work as delivered. So as a customer my assumption was that it will work as intended with stock functionality. As the product vendor, i thought maybe Untangle can assess the latest version of the IM app and upgrade the application signature thru an upcoming version / patch.

Will try taking a look in the session viewer to see if I can find anything useful and probably get some shared guidance from this forum as how to dig around further.

The vast majority of mobile apps don't restrict themselves to WiFi and NG Firewall can only act on traffic that passes through it. If the device detects that the connection is failing via WiFi, it'll usually just try again using its own data connection. There is, unfortunately, no way for us to disable or filter that connection; while the traffic may be blocked through NG Firewall, it may still go through because the device itself has another route to the internet.

It's also possible that Application Control simply isn't detecting or identifying the app correctly. Check Reports > Application Control > Classified Sessions to verify that App Control is actually able to identify the traffic as matching that application.

Well for running my test cases , I ensure that "Mobile Data (LTE/5G)" is turned off on the device. So going thru WiFi was the only available route to reach internet.

Will try checking the classified sessions report to see if the traffic is zapped and identified

[MindVentures]

We get the application signatures/definitions from a third party, called Sandvine, but we don't develop or update the signatures ourselves. We typically update the App Control database with each new NG Firewall release.

Hello,

Thanks for the info. Apparently there seems to be some problem with the forums. My original post where I asked this question is deleted from thread.

However the above-quoted response is appearing as it is posted from me, however I am sure it must be posted by someone else.

Maybe forum admin can take a look.

Thanks.

[jcoffin]

Hello,
However the above-quoted response is appearing as it is posted from me, however I am sure it must be posted by someone else.

I reverted one of our staff's changes. Sorry for the confusion.