4 ms·
You'd need a firewall that is not just TCP/UDP-aware, but HTTP(S)-aware, and a way for your firewall to sniff on TLS-encrypted traffic.
by phoe-krk 2y ago
You'd need a firewall that is not just TCP/UDP-aware, but HTTP(S)-aware, and a way for your firewall to sniff on TLS-encrypted traffic.
- diggan 2y agoOr be ok with filtering HTTP/TLS traffic based on the domain only, as that part isn't encrypted (the SNI [Server Name Indication]). OpenSnitch should be able to allow/disallow based on that, rather than having to decrypt the TLS part.
- codetrotter 2y agoUnless it’s using Encrypted SNI. https://www.cloudflare.com/en-gb/learning/ssl/what-is-encrypted-sni/ https://www.cloudflare.com/en-gb/learning/ssl/what-is-encryp... Or, also, not using SNI at all. But still, you can probably correlate DNS requests with connections to IP addresses in many cases. Although if the program uses DNS over HTTPS (DoH) like several programs do now then the DNS record is also not known.