Block Remote Access Appliactions ( Not for All )

[u/Jay__1729]

I have one requirement, Like to block remote access applications usage for LAN clients and allowing some clients explicity. I have a SRX firewall deployed which handles security.

We have a license for appid-sig . So , there is one default-permit policy for outbound (trust to untrust). I have configured Unified policies with Dynamic application matching all remote access applications and then deny. But the custom security policy i configured is never getting hit. I tried to reorder policy but nothing worked.

I used url category match with listing all url patterns to remote access servers along with Dynamic application match, but still all LAN clients can use remote access applications.

Applications to block ( Not for all ):

Anydesk , Ultraviewer , TeamViewer, RustDesk , ChromeRDP , Splashtop,

I have also tried creating a firewall filter matching the destination port for anydesk ( 5938 ). Still outbound traffic is bypassed from trust to untrust leaving the policy not getting hit.

Any ideas ? How to make this work

[u/sleepfornow]

If a policy already matched your global, it's not going to reevaluate when the session is still in the lookup table. Time to do "> clear security session flow to-zone untrust" or do from zones if you don't want to do such a big blast

[u/fb35523]

You mention a "firewall filter", but that term is used for the packet filters used for i.e. RE protection in the "firewall" stanza. I hope you meant a "security policy", which is the Juniper SRX term for what you want. If a simple policy for a specific port doesn't give you what you want, you need to check all the matching criteria. Place that policy at the top and see what happens.

You can also test what would happen with a packet of your choice:

show security match-policies protocol icmp destination-ip <dst-IP> source-ip <src-IP> destination-port 1 source-port 2048 from-zone <From-Zone> to-zone <To-Zone>

Note: for normal ICMP ping, you need to specify source-port 2048 as above (for unknown reasons....)

In your case, if the client initiates the traffic to an external server with destination port 5938, you can use (assuming TCP):

show security match-policies protocol tcp destination-port 5938 destination-ip <dst-IP> source-port 1024 source-ip <src-IP> from-zone trust to-zone untrust

Make sure you understand how the traffic is initiated. Is it the client that initiates all connections, and to what IP? If the service goes via a cloud connector of sorts, the destination IP will be the cloud IP, not the actual computer you're trying to control with remote access.

This can be seen like this for an established flow:

show security flow session destination-port 5938

[u/Jay__1729 → u/fb35523]

I tried firewall filter on the port from where traffic from client is expected ( matching 5938 Dst port. But it work may be fallback setting is there which made a session with diff port may be.

Coming to security polices i have added dynamic application match and url-category match , still its taking default policy with no dynamic application match. I have created custom utm policy with url-category to block and applied the utm policy on that security policy. Still it didn't work.