# How to allow HTTPs but block all other protocol
**URL:** https://forum.suricata.io/t/how-to-allow-https-but-block-all-other-protocol/4731
**Category:** Help
**Tags:** rules, suricata
**Created:** [June 27, 2024, 7:34pm UTC](https://forum.suricata.io/t/how-to-allow-https-but-block-all-other-protocol/4731 "2024-06-27T19:34:11Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@kki](https://forum.suricata.io/u/kki)
#### Post date: [June 27, 2024, 7:34pm UTC](https://forum.suricata.io/t/how-to-allow-https-but-block-all-other-protocol/4731/1 "2024-06-27T19:34:11Z")
We are using aws network firewall, which provide a place to write suricata rules.
What I want to do is to allow TLS or HTTPs on port 443, and block all other protocol.
```auto
pass tls $HOME_NET any -> $EXTERNAL_NET any (tls.sni; dotprefix; content:".google.com"; ssl_state:client_hello; nocase; endswith; msg:"matching TLS allowlisted FQDNs"; priority:1; flow:to_server, established; sid:1; rev:1;)
drop tls $HOME_NET any -> $EXTERNAL_NET any (msg:"not matching any TLS allowlisted FQDNs"; priority:1; flow:to_server, established; sid:3; rev:1;)
```
For example, when we visit [www.google.com](http://www.google.com), this connection can be considered as HTTPS, then suricata enging check it’s SNI, then decide to pass this connection. (work as expected)
when we visit [www.microsoft.com](http://www.microsoft.com), this connection can be considered as HTTPS, then suricata enging check it’s SNI, then decide to drop this connection. (work as expected)
However, if we just `nc 1.2.3.4 443`, and sent messages, firewall will not drop it because suricata do not know what protocol it use.
In previous situation, I only want to allow access to [google.com](http://google.com), but block access to `1.2.3.4` . Here `1.2.3.4` is some random IP address that not in our domain list
Our original motivation is to make sure our server can only access website in our doamin list.
Is that possible in suricata?
---
### Author:  [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)
#### Post date: [July 31, 2024, 9:12pm UTC](https://forum.suricata.io/t/how-to-allow-https-but-block-all-other-protocol/4731/2 "2024-07-31T21:12:00Z")
You would have to add additional pass rules for the HTTP part and afterwards you can set `drop ip $HOME_NET any -> $EXTERNAL_NET 443` but you could also add a variable and add more ports to it.
---
### Author:  [@kki](https://forum.suricata.io/u/kki)
#### Post date: [August 2, 2024, 4:09pm UTC](https://forum.suricata.io/t/how-to-allow-https-but-block-all-other-protocol/4731/3 "2024-08-02T16:09:39Z")
After a lot of discussion with AWS support, we find a way to partially resolve this problem.
First make sure network firewall policy is in strict order and default action is set to `drop established`.
In this way, `nc` can not send message out, but can still receive message from server.
AWS confirm that `drop established` **only drop connection from client to server.** That is why `nc` may receive message.
To remediate this, we need to add a rules look like ` drop ip $EXTERNAL_NET 443 -> $HOME_NET any (msg:"Drop established non-HTTP suricata by ran"; flow:established;sid:1236;rev:1;)`
Then, `nc` connection can be established, but can not transfer any message.