How to allow HTTPs but block all other protocol

Help
,
1

We are using aws network firewall, which provide a place to write suricata rules.
What I want to do is to allow TLS or HTTPs on port 443, and block all other protocol.

pass tls $HOME_NET any -> $EXTERNAL_NET any (tls.sni; dotprefix; content:".google.com"; ssl_state:client_hello; nocase; endswith; msg:"matching TLS allowlisted FQDNs"; priority:1; flow:to_server, established; sid:1; rev:1;)
drop tls $HOME_NET any -> $EXTERNAL_NET any (msg:"not matching any TLS allowlisted FQDNs"; priority:1; flow:to_server, established; sid:3; rev:1;)

For example, when we visit www.google.com, this connection can be considered as HTTPS, then suricata enging check it’s SNI, then decide to pass this connection. (work as expected)

when we visit www.microsoft.com, this connection can be considered as HTTPS, then suricata enging check it’s SNI, then decide to drop this connection. (work as expected)

However, if we just nc 1.2.3.4 443, and sent messages, firewall will not drop it because suricata do not know what protocol it use.

In previous situation, I only want to allow access to google.com, but block access to 1.2.3.4 . Here 1.2.3.4 is some random IP address that not in our domain list
Our original motivation is to make sure our server can only access website in our doamin list.

Is that possible in suricata?

2

You would have to add additional pass rules for the HTTP part and afterwards you can set drop ip $HOME_NET any -> $EXTERNAL_NET 443 but you could also add a variable and add more ports to it.

3

After a lot of discussion with AWS support, we find a way to partially resolve this problem.

First make sure network firewall policy is in strict order and default action is set to drop established.
In this way, nc can not send message out, but can still receive message from server.

AWS confirm that drop established only drop connection from client to server. That is why nc may receive message.
To remediate this, we need to add a rules look like drop ip $EXTERNAL_NET 443 -> $HOME_NET any (msg:"Drop established non-HTTP suricata by ran"; flow:established;sid:1236;rev:1;)
Then, nc connection can be established, but can not transfer any message.