Firewall Filtering HTTPS Traffic

Modern firewalls are able to perform deep packet inspection to determine the payload of the traffic at Layer 7, thus identifying the specific application being employed. However, protocols such as HTTPS complicate such filtering because the Layer 7 data is encrypted, making it difficult for firewalls to inspect beyond IP addresses and port numbers.

Several strategies exist to address this challenge. Some of the most popular are described below:

Man-in-the-Middle Proxy

This technique involves the firewall intercepting, decrypting, and re-encrypting HTTPS traffic, allowing access to the Uniform Resource Identifier (URI) for filtration. However, this method can introduce complexity, processing requirements, and issues with certificate authentication.

Server Name Indication (SNI)

During the TLS handshake, the SNI field, which identifies the domain, can be leveraged by the firewall for domain-based access control. However, advancements in TLS, such as Encrypted Client Hello (ECH), obscure the SNI, reducing its reliability as a filtering tool.