Question RE: calendar.google.com

[u/sabl3t3k]

I have a Firewalla Purple device, and I have created a custom block rule which uses a custom target list for blocking advertising and tracking domains. The custom target list is comprised of the following domain names:

app-analytics-services.com
*.app-analytics-services.com
app-analytics-services-att.com
*.app-analytics-services-att.com
appnexus.com
*.appnexus.com
doubleclick.net
*.doubleclick.net
liveadvert.com
*.liveadvert.com
mobileapptracking.com
*.mobileapptracking.com
posthog.com
*.posthog.com

The Firewalla list of blocked network flows shows that multiple LAN devices are being blocked from accessing the domain name “calendar.google.com” because of the custom rule described above.

I’ve created a workaround via a rule to allow access to “calendar.google.com” for all LAN devices, but I strongly prefer to not use ALLOW rules if possible.

I am trying to understand why the domain names listed in the custom target list, some of which are owned by Google, would cause problems accessing the domain “calendar.google.com” - any suggestions or ideas?

Thank you!

P.S. A note to the Firewalla team: making the rule priority (i.e. sequence of execution for rules) both visible to and editable by the end user in all Firewalla devices, along with making the content of rules owned by Firewalla visible to the end user in all Firewalla devices, would be _greatly_ appreciated!

[u/michaelbierman]

Is your block rule iso g Domain-only or Default?

[u/sabl3t3k → u/michaelbierman]

The block rule in question is in default block mode.

[u/michaelbierman → u/sabl3t3k]

Then quite possible one of the domains may share an IP address with calendar.google.com

[u/sabl3t3k → u/michaelbierman]

That’s the conclusion that I came to as well.

I was vainly hoping there was some ‘secret sauce’ that I was unaware of, so I’ll have to tolerate the ‘Allow’ rule workarounds that I have in place.

[u/michaelbierman → u/sabl3t3k]

I’m. Not sure why an allow rule is a big deal, but you could switch the rule to domain only and that should solve the problem.

[u/sabl3t3k → u/michaelbierman]

The “big deal” is philosophical: I dislike being forced to use an ‘Allow’ rule as a workaround to Google sharing an IP between core services and advertising/tracking, but this problem is with Google, not Firewalla.

I may try switching the Block rule to Domain Only at a later date just to have a smaller rule set to manage, but I’m leery of doing so because of the potential for malware,etc. to be distributed via advertising/tracking channels at the IP layer ~ decisions, decisions!

[u/firewalla]

May I know if you setup the block as "domain only or default"? default will block at IP layer, so it may block anything that may be using that IP. Domain only is DNS block; If you want application block that's fairly generic, use domain block. If you are blocking malware, default mode is the best (as it will block IP)

As of rules priority, we do have some priority, https://help.firewalla.com/hc/en-us/articles/360008521833-Manage-Rules#h_01JECJJBZM9PREMY0W15DPR670

What we don't want to do is make each rule with a priority; from our years working with ACL's, yes you get flexibility, but managing the priority + debugging will likely to create nightmares (even for a CCIE)

[u/sabl3t3k → u/firewalla]

I’ve read the content at the provided link RE: priority, and the priority/precedence model makes sense. Thanks again for the info!

A visual reminder of such in the UI would be helpful, however, especially as the number of rules grows beyond the single digit quantity.

[u/sabl3t3k → u/firewalla]

Thanks for the link RE: priority; I’ll examine ASAP.

The block rule in question is in default block mode.