> Haven't they noticed that everything piggybacks on top of HTTP/HTTPS these days? Blocking outbound traffic at layer 3/4 does not require an expensive firewal

> Haven't they noticed that everything piggybacks on top of HTTP/HTTPS these days? Blocking outbound traffic at layer 3/4 does not require an expensive firewall. It provides protection against certain attack vectors, but as you say, most stuff nowadays uses http/https and in the case of trojans, likely reverse shells. Any firewall should be able to do this. The expense usually comes in when doing application layer filtering and/or transparent/active proxying, which is the point at which you can block SSL VPN clients and the like. To do this over HTTPS it obviously requires MITMing TLS traffic, which I have mixed feelings about.