Tuesday, March 24, 2015

How to Block Ad Networks in SonicWALL

Last year saw several ad networks being compromised and serving malware.  One way to avoid being compromised by further attacks on ad networks is to keep them blocked. While a bit extreme, i have yet to have a user complain that there weren't any ads showing in their browser.  Here's how to do it using App Rules:

1. Create a Match Object:
     Navigate to Firewall => Match Objects.  Add a New Match Object

Object Name:           Ad Networks
Match Object Type: CFS Allow/Forbidden List
Match Type:             Exact Match

Then, Paste the following list into a .txt file and save it:  

adimages.go.com
admonitor.net
ads.specificpop.com
ads.web.aol.com
ads.x10.com
advertising.com
amazingmedia.com
clickagents.com
commission-junction.com
doubleclick.net
go2net.com
infospace.com
kcookie.netscape.com
linksynergy.com
msads.net
qksrv.net
yimg.com
zedo.com
101com.com
101order.com
123found.com
123pagerank.com
180searchassistant.com
adboost.net
adbooth.net
adbot.com
adbrite.com
bidvertiser.com
chitika.com
clicksor.com
pocketcents.com
adinterax.com
adisfy.com
adition.com
adition.de
adition.net
adjix.com
adjug.com
adjuggler.com
adjuggler.yourdictionary.com
adjustnetwork.com
ads.blog.com
ads.bloomberg.com
ads.bluelithium.com
ads.bluemountain.com
ads.bluesq.com
ads.bonniercorp.com
ads.boylesports.com
ads.brabys.com
ads.brain.pk
ads.brazzers.com
ads.bumq.com
ads.businessweek.com
ads.canalblog.com
ads.canoe.ca
ads.carocean.co.uk
ads.casinocity.com
ads.cbc.ca
ads.cc
ads.cc-dt.com
ads.cdfreaks.com
ads.centraliprom.com
ads.cgnetworks.com
ads.channel4.com
ads.cimedia.com
ads.clearchannel.com
ads.cnn.com
ads.co.com
ads.collegclub.com
ads.com.com
ads.comicbookresources.com
ads.contactmusic.com
ads.crakmedia.com
ads.creative-serving.com
ads.creativematch.com
ads.cricbuzz.com
ads.cyberfight.ru
ads.cybersales.cz
ads.dada.it
ads.datinggold.com
ads.datingyes.com
ads.dazoot.ro
ads.deltha.hu
ads.dennisnet.co.uk
ads.desmoinesregister.com
ads.detelefoongids.nl
ads.deviantart.com
ads.digital-digest.com
ads.digitalmedianet.com
ads.digitalpoint.com
ads.directionsmag.com
ads.discovery.com
ads.domeus.com
ads.eagletribune.com
ads.easy-forex.com
ads.eatinparis.com
ads.economist.com
ads.edbindex.dk
ads.egrana.com.br
ads.einmedia.com
ads.electrocelt.com
ads.elitetrader.com
ads.emirates.net.ae
ads.epltalk.com
ads.escalatemedia.com
ads.esmas.com
ads.eu.msn.com
ads.exactdrive.com
ads.exhedra.com
ads.expat-blog.biz
ads.expedia.com
ads.ezboard.com
ads.factorymedia.com
ads.fairfax.com.au
ads.faxo.com
ads.ferianc.com
ads.filmup.com
ads.financialcontent.com
ads.flooble.com
ads.fool.com
ads.footymad.net
ads.forbes.com
ads.forbes.net
ads.forium.de
ads.fortunecity.com
ads.fotosidan.se
ads.foxkidseurope.net
ads.foxnetworks.com
ads.foxnews.com
ads.freecity.de
ads.freeze.com
ads.friendfinder.com
ads.ft.com
ads.futurenet.com
ads.gamecity.net
ads.gameforgeads.de
ads.gamershell.com
ads.gamespyid.com
ads.gamigo.de
ads.gaming-universe.de
ads.gawker.com
ads.geekswithblogs.net
ads.glispa.com
ads.globeandmail.com
ads.gmodules.com
ads.godlikeproductions.com
ads.good.is
ads.goyk.com
ads.gplusmedia.com
ads.gradfinder.com
ads.grindinggears.com
ads.groundspeak.com
ads.gsm-exchange.com
ads.gsmexchange.com
ads.guardian.co.uk
ads.guardianunlimited.co.uk
ads.guru3d.com
ads.hardwaresecrets.com
ads.harpers.org
ads.hbv.de
ads.hearstmags.com
ads.heartlight.org
ads.hideyourarms.com
ads.hollywood.com
ads.horsehero.com
ads.horyzon-media.com
ads.iafrica.com
ads.ibest.com.br
ads.ibryte.com
ads.icq.com
ads.iforex.com
ads.ign.com
ads.img.co.za
ads.imgur.com
ads.incgamers.com
ads.indiatimes.com
ads.infi.net
ads.internic.co.il
ads.ipowerweb.com
ads.isoftmarketing.com
ads.itv.com
ads.iwon.com
ads.jewishfriendfinder.com
ads.jiwire.com
ads.jobsite.co.uk
ads.jpost.com
ads.jubii.dk
ads.justhungry.com
ads.kaktuz.net
ads.kelbymediagroup.com
ads.kinobox.cz
ads.kinxxx.com
ads.komli.com
ads.kompass.com
ads.krawall.de
ads.lesbianpersonals.com
ads.linuxfoundation.org
ads.linuxjournal.com
ads.linuxsecurity.com
ads.livenation.com
ads.localnow.com
ads.lvz-online.de
ads.mambocommunities.com
ads.mariuana.it
ads.massinfra.nl
ads.mcafee.com
ads.mediaodyssey.com
ads.mediaturf.net
ads.medienhaus.de
ads.mgnetwork.com
ads.mmania.com
ads.moceanads.com
ads.motor-forum.nl
ads.motormedia.nl
ads.movieflix.com
ads.msn.com
ads.multimania.lycos.fr
ads.nationalgeographic.com
ads.ncm.com
ads.netclusive.de
ads.netmechanic.com
ads.networksolutions.com
ads.newdream.net
ads.newgrounds.com
ads.newmedia.cz
ads.newsint.co.uk
ads.newsquest.co.uk
ads.newtention.net
ads.nigella.com
ads.ninemsn.com.au
ads.nj.com
ads.nola.com
ads.nordichardware.com
ads.nordichardware.se
ads.nwsource.com
ads.nyi.net
ads.nytimes.com
ads.nyx.cz
ads.nzcity.co.nz
ads.o2.pl
ads.oddschecker.com
ads.okcimg.com
ads.ole.com
ads.olivebrandresponse.com
ads.oneplace.com
ads.ookla.com
ads.optusnet.com.au
ads.outpersonals.com
ads.p161.net
ads.passion.com
ads.pennet.com
ads.penny-arcade.com
ads.pheedo.com
ads.phpclasses.org
ads.pickmeup-ltd.com
ads.pkr.com
ads.planet.nl
ads.pni.com
ads.pof.com
ads.powweb.com
ads.primissima.it
ads.prisacom.com
ads.program3.com
ads.psd2html.com
ads.pushplay.com
ads.quaylemedia.com
ads.quoka.de
ads.rcs.it
ads.realmedia.de
ads.recoletos.es
ads.rediff.com
ads.redlightcenter.com
ads.redtube.com
ads.resoom.de
ads.returnpath.net
ads.rottentomatoes.com
ads.rpgdot.com
ads.s3.sitepoint.com
ads.satyamonline.com
ads.savannahnow.com
ads.scifi.com
ads.seniorfriendfinder.com
ads.sexinyourcity.com
ads.shizmoo.com
ads.shopstyle.com
ads.sift.co.uk
ads.silverdisc.co.uk
ads.skins.be
ads.slim.com
ads.smartclick.com
ads.smartshopping.co.uk
ads.soft32.com
ads.space.com
ads.spoonfeduk.com
ads.sprotiv.org
ads.sptimes.com
ads.stackoverflow.com
ads.stationplay.com
ads.struq.com
ads.sun.com
ads.supplyframe.com
ads.switchboard.com
ads.t-online.de
ads.tahono.com
ads.techtv.com
ads.techweb.com
ads.telegraph.co.uk
ads.theglobeandmail.com
ads.themovienation.com
ads.thestar.com
ads.thewebfreaks.com
ads.timeout.com
ads.tjwi.info
ads.tmcs.net
ads.top500.org
ads.totallyfreestuff.com
ads.townhall.com
ads.trinitymirror.co.uk
ads.tripod.com
ads.tripod.lycos.co.uk
ads.tripod.lycos.de
ads.tripod.lycos.es
ads.tripod.lycos.it
ads.tripod.lycos.nl
ads.tripod.spray.se
ads.tso.dennisnet.co.uk
ads.tweetmeme.com
ads.uknetguide.co.uk
ads.ultimate-guitar.com
ads.uncrate.com
ads.undertone.com
ads.uploading.com
ads.usatoday.com
ads.v3.com
ads.verticalresponse.com
ads.vgchartz.com
ads.videosz.com
ads.virtual-nights.com
ads.virtualcountries.com
ads.vnumedia.com
ads.weather.ca
ads.web.aol.com
ads.web.cs.com
ads.web.de
ads.webmasterpoint.org
ads.websiteservices.com
ads.whi.co.nz
ads.whoishostingthis.com
ads.wiezoekje.nl
ads.wikia.nocookie.net
ads.wineenthusiast.com
ads.wunderground.com
ads.wwe.biz
ads.xhamster.com
ads.xtra.co.nz
ads.y-0.net
ads.yimg.com
ads.yldmgrimg.net
ads.yourfreedvds.com
ads.youtube.com
ads.zdnet.com
ads.ztod.com
ads03.redtube.com
ads1.canoe.ca
ads1.mediacapital.pt
ads1.msn.com
ads1.rne.com
ads1.theglobeandmail.com
ads1.virtual-nights.com
ads10.speedbit.com
ads180.com
ads2.brazzers.com
ads2.clearchannel.com
ads2.collegclub.com
ads2.collegeclub.com
ads2.exhedra.com
ads2.gamecity.net
ads2.jubii.dk
ads2.net-communities.co.uk
ads2.oneplace.com
ads2.rne.com
ads2.virtual-nights.com
ads2.xnet.cz
ads2004.treiberupdate.de
ads3.gamecity.net
ads3.virtual-nights.com
ads4.clearchannel.com
ads4.gamecity.net

You can add more, but the file must remain below 8kb total.

Once the file is saved, click on the Load From File Button:


Select your file and click upload:

Once the file finishes uploading, You should see the list populate:


Click OK and then Create another Match Object:
Object Name:  Content Filtering
Match Object Type: CFS Category List

Select the items you want from the list:

Click OK

Next, we will add an App Rule using this match object:

Navigate to Firewall => App Rules and click Add New Policy

Copy the settings in the image below:

Lastly, configure the content filtering in Security Services => Content filtering and select the Via App Rules option under the CFS Policy Assignment Selection.


**NOTES**
This will remove any allowed or blocked domains you have added to content filtering.

To add Allowed Domains, create another CFS Allow/Denied match object with he list you need allowed and select that list in the CFS Allow/Excluded list selection.

To manually add Blocked Domains, add them to the Ad Networks Match Object.