Re:IPv6 celebrates its 20th birthday by reaching 10% deployment
by darkr on Monday January 04, 2016 @04:25PM
(#10838760)
> Haven't they noticed that everything piggybacks on top of HTTP/HTTPS these days?
Blocking outbound traffic at layer 3/4 does not require an expensive firewall. It provides protection against certain attack vectors, but as you say, most stuff nowadays uses http/https and in the case of trojans, likely reverse shells. Any firewall should be able to do this.
The expense usually comes in when doing application layer filtering and/or transparent/active proxying, which is the point at which you can block SSL VPN clients and the like. To do this over HTTPS it obviously requires MITMing TLS traffic, which I have mixed feelings about.
Blocking outbound traffic at layer 3/4 does not require an expensive firewall. It provides protection against certain attack vectors, but as you say, most stuff nowadays uses http/https and in the case of trojans, likely reverse shells. Any firewall should be able to do this.
The expense usually comes in when doing application layer filtering and/or transparent/active proxying, which is the point at which you can block SSL VPN clients and the like. To do this over HTTPS it obviously requires MITMing TLS traffic, which I have mixed feelings about.