Websense Web Security

Re: Allow full sites like Facebook without tracking down https links!

bigfredi — Thu, 02 Feb 2012 12:41:15 GMT

Sorry, that was a too quick reply :-D

I've used

^https?://.*\.facebook\.com

to avoid fake domains like whateverfacebook.com

In regards to the product... I can't understand how I can allow a user to use facebook apps or facebook email, but to allow facebook in general I have to create particular rules, or the whole social area.

I don't understand how facebook, twitter and alike don't have their own category under social.

Re: Allow full sites like Facebook without tracking down https links!

bigfredi — Thu, 02 Feb 2012 12:34:51 GMT

I've used

^https?://.*\.facebook\.com

to avoid fake domains like whateverfacebook.com

In regards to the product... I can understand how I can allow a user to use facebook apps or facebook email, but to allow facebook in general I have to create particular rules, or the whole social area.

Re: Allow full sites like Facebook without tracking down https links!

ab7734 — Fri, 08 Jul 2011 19:17:47 GMT

Hey this worked well thank you a ton.

I should note the Regex examples on the Websense site are sorely lacking. This link;

http://www.websense.com/content/support/library/email/hosted/admin_guide/regex.aspx

...shows how to list IP addresses, but it completely doesn't work with the Regex test tool built in to Websense.. The way lvmcinto has them listed does work.

Also, I had to list an IP range for UPS World Ship software to work, and ended up actually having to unfilter the entire 3rd octet for a range, which I ended up doing like this:

For the range:

153.2.0.0 - 153.2.255.255

Put in these RegExes:

153.2\.[0-9]\.  (0-9)
153.2\.[1-9][0-9]\.  (10-99)
153.2\.1[0-9][0-9]\.  (100-199)
153.2\.2[0-5][0-5]\.  (200-255)

Re: Allow full sites like Facebook without tracking down https links!

lvmcinto — Fri, 01 Jul 2011 18:07:39 GMT

Large IP ranges can be tricky... You very frequently have to break them into several regexes. While a single regex could be built for many, they would me fairly processor intensive and may impact performance.

I'll take an example from the Webex site: 64.68.96.0 - 64.68.127.255 (or 64.68.96.0/19)

The numbers in parentheses are the 3rd octet matches.

64\.68\.9[6-9]\.              (96-99)
64\.68\.1[0-1][0-9]\.      (100-119)
64\.68\.12[0-7]\.             (120-129)

Re: Allow full sites like Facebook without tracking down https links!

ab7734 — Fri, 01 Jul 2011 17:08:09 GMT

lvmcinto, that example just helped me out a lot.

The regex examples offered on Websense's support page doesn't even mention how to list IP ranges this way.

Your example (the 2nd one) shows how to list a range of IPs with the 1st three octets all being static, and the 4th being completely unfiltered. That's really helpful, but do you know how one would also list the 3rd octet as well as the 4th as variable? When I try just the \. for the 3rd octet it fails to meet the Websense regex checker tool's requirements. So I'm stuck only being able to unfilter the 4th octet wen I need to unfilter the 3rd and 4th. octets

What we are trying to do it list a huge range of IPs mandated by Cisco Webex in a Websense Custom URLs list. See the Webex support KB artticle WBX264, if you're interested in viewing the range of IPs. This is all https too, and we have no Websense Content Gateway, so we have to list IPs instead of URLs.

Thanks.

Re: Allow full sites like Facebook without tracking down https links!

lvmcinto — Tue, 24 May 2011 18:25:28 GMT

No, I understand exactly what is being said... I just don't think you are considering all the options with regex. My post does not imply that you should not use IP adddresses at all. It means that when you use Regex, you need to be careful and truly understand what you're doing.

Yes, a lot of implentations can only use IP for https, but if you are specifying the protocol in front of an IP, you can still do that as https?://

The literal periods are still needed in an IP as well.

Three regex examples of IP rules and what would match

https?://10\.11\.12\.

is a match for http://10.11.12.123 OR https://10.11.12.123

10\.11\.12\.

is a match for http://10.11.12.1 OR https://10.11.12.1

10.11.12.

is a match for http://10.11.12.1 OR http://1091191291 OR https://10.11.12.1 OR https://1091191291

When I do regex rules for IP addresses, I use the second option. That will cover any other protocols like FTP or HULU:// etc detected by network agent.

A final note, ALWAYS use the built in regex checker for Websense. Websense's implementation of regex is not pcre or POSIX or what any other regex tools will test for.

Re: Allow full sites like Facebook without tracking down https links!

Glitch — Tue, 24 May 2011 18:15:14 GMT

I'm sorry lvmcinto but you're either wrong or don't understand the situation and you're going to end up confusing people. Most people do not have the option of filtering HTTPS by URL.

Most Websense integrations can only filter HTTPS requests by destination IP address, not by URL. This is due to the nature and implementation of most integrations where they are out of band and cannot see what you typed in due to the HTTPS encryption. Websense Content Gateway (and probably other proxy integrations like with an ISA server) are exceptions where they can do by URL because they're in path of the traffic.

Your concerns about using IP based filtering with regex are valid, however in many situations it's the only option.

Re: Allow full sites like Facebook without tracking down https links!

lvmcinto — Tue, 24 May 2011 17:25:52 GMT

you're right that the \. is a literal period, and that's what you want for facebook.com or IP addresses. otherwise you'd match something different.

to cover http and https, https?:// works and is pretty efficient.

One other thing is that a lot of Websense customers aren't very technical. So I can understand the approach from their side. You don't want to be in the business of supporting regex in addition to your product.

Re: Allow full sites like Facebook without tracking down https links!

WINNJ — Tue, 24 May 2011 17:10:30 GMT

Good points, thank you for your post. I still think that having the discussion about the correct use of regex is better than telling people not to use it. Ideally, I would use the literal URLs but the demand was to unblock this ASAP and regex served my purpose without recategorizing or allowing all social media sites.

From my understanding a "\" preceding the period changes the special meaning of the character so that it is literally a period. So another character should not be tranposed. Also, in the Websense technical library I found that "?" is not a supported character and did not work with my testing, so I had to get around this with the OR statement.

The period before the IP address was just lazy I suppose, it was intended to cover http, https or just the plain IP address. I will definately get this fixed.

Re: Allow full sites like Facebook without tracking down https links!

lvmcinto — Tue, 24 May 2011 16:00:53 GMT

more efficient would be

^https?://.*facebook\.com/

The last .* is unneccessary and .* in general adds a high utilization hit. The $ is also unnecessary as it denotes the end of the line. that would be impled in a URL after the .com/

To match the .com, you must escape the period. In regex, period matches any character, so facebookscom would match with your current regex.

For all the IP based rules, same thing about periods and .* don't use them unless necessary.

Your regex .*69.63.19[0-1]\.[0-9]{1,3}.*
would match blahblah69s63s190.11.badsite.com

this is why Regex is a bad idea. It's a great tool, but many times the solution becomes the problem.

Re: Allow full sites like Facebook without tracking down https links!

WINNJ — Tue, 17 May 2011 20:31:08 GMT

I added a few different strings to the Unblock URL (Unfiltered URL) section of Websense Manager and this seems to have worked fairly well. I used the same method to allow access to YouTube and Twitter. I wasn't aware that use of regex was not supported by Websense since it appears under the Advanced section on many policies. So i suppose you can try the following out at your own risk:

^htt(p|ps)://.*facebook.com/.*$

http://static.ak.fbcdn.net

.*69.63.17[6-9]\.[0-9]{1,3}.*

.*69.63.18[0-9]\.[0-9]{1,3}.*

.*69.63.19[0-1]\.[0-9]{1,3}.*

Re: Allow full sites like Facebook without tracking down https links!

ZZATU — Tue, 23 Nov 2010 17:00:44 GMT

Anyone have luck getting facebook.com to work with regexpressions and keeping social networking blocked.

What I am trying to do is:
Custom Policy that Allows Custom Category (Recategorized) to access facebook.com although social networking is blocked as a whole (blocked with continue page)

What I have tried:

Allowing the following sites:

http(s)://facebook.com
http(s)://channel.facebook.com
http(s)://static.ak.fbcdn.net
http(s)://fbcdn.net

This seemed to partially work but users reported of incosistencies with the page's sometimes being blocked, reporting confirmed this:

I also tried putting a regex for

facebook.com

fbcdn.net

Under this Custom Group but then facebook.com was not recategorized. And therefore it was still getting blocked.

J Sloan wrote that with the Websense Content Gateway it should work without adding the IP Addresses, this is what I am running and I am not having luck.

Re: Allow full sites like Facebook without tracking down https links!

J Sloan — Tue, 19 Oct 2010 15:34:42 GMT

@Rick586:

Surfcontrol features integrated into Websense:

1. The integrations of the hosted solutions and turning them into a hybrid service is now called "Websense Web Security Gateway Anywhere".
2. Email Security that will soon be part of the Triton Manager in 7.6.

I am sure there are more, but those are the two I can think of real quick.

Re: Allow full sites like Facebook without tracking down https links!

amonte1 — Tue, 19 Oct 2010 15:23:32 GMT

I agree as well! I've been trying to get Websense to add some features that SurfControl always had. One is being able to use a HostName in Rules/Policies. I have alot of Apple MAC users who I have allow rules based on their Hostnames because their AD login doesn't picked up transparently. Not sure why they have been so lax in integrating any features from SC

Re: Allow full sites like Facebook without tracking down https links!

Rick586 — Tue, 05 Oct 2010 11:54:53 GMT

Here, here, well said!!! I'm going to add my pennies worth here and agree whole-heartedly as I'm having exactly this issue and I also found that this worked under SurfControl and it worked well!

As I've said in another post, it's funny how Websense bang on about being market leaders and how they've taken features from SC and integrated them. Really? Where?

This looks like yet another omission.

To be fair though, on a day-to-day basis and in general, our V10000 unit is much better than SC but it's such a shame that some obvious and essential features have been missed, like this, the real-time monitor, User Browse Time Activity Reports, etc.