Blocking all internet traffic - MX250

[FCFC]

Hi all

Im using group policy to attempt to block all internet traffic. To do so I have applied deny all 21 of the categories in Layer 7 and have also added the *, wildcard to the Block list URL patterns.

On the face of it, all internet traffic is blocked, however there are some websites which pass all traffic. Into sure why or what other steps I can take to block ALL internet traffic.

Any advice greatly appreciated

Thanks 

[alemabrahao]

You can use an asterisk "*" in URL blocking.

Now I read that you've already done this, so it's probably a browser cache. Try clearing your cache.

[FCFC]

Hi there and thanks so much for replying

I already have the asterisk added in that section, still some traffic is passing?

[alemabrahao]

Now I read that you've already done this, so it's probably a browser cache. Try clearing your cache.

But just to make sure you selected the override, right?

[FCFC]

My browser is constantly cleared of all cached files, for whatever reason its one a hand full of sites, using a private browser also has the same effect

 

[alemabrahao]

It can be tricky because some traffic can bypass the filters. Have you tried blocking all categories as well? What if you create an L3 rule denying everything?

Otherwise I suggest you open a support case.

[FCFC]

Thanks 

Everything that can be blocked is pretty much blocked, I agree, support ticket it is

[ww]

You could also use layer3 firewall to block all traffic to public IP's

1 allow rfc 1918 ranges

2 deny any

Using content filter only blocks dns based. For example Apps using direct ip address to services will still be allowed

[PhilipDAth]

I would use @ww approach.  It is far more bullet proof.

When using L7 - you are relying on the web site/app have a L7 classification.  What if it is not classified?

Layer 3 rules also allow FQDNs.

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Using_Layer_3_Firewal...

You could also use a group policy to override the L3 rules, and then apply L7 rules.

[Brash]

100% agree with this.

I do this for some of my networks and it works great.

Using L3 firewall rules is a far more resilient approach than relying on L7 rules and classifications.

[FCFC]

Thank you all so much for your reply and advice.

Below is the make up of the GP I have applied to the device. 

This should block all internet traffic correct?

 

 

[alemabrahao]

Theoretically yes.

[FCFC]

Hi

By way of an update, I got this to work in the end using one layer 3 rule.

No need for nay Layer 7 rules.

Not sure if this is the right way to do what I want but its working.

Thanks for all the input

 

[alemabrahao]

It was exactly what I had suggested before, but I ended up deleting the post. 😅

[alemabrahao]

I didn't delete it. 😃

[FCFC]

Yep

Thats why tried it, thanks for your help.