Ringfencing Internet Access
Ringfencing enables you to block an application from accessing the internet altogether. Or you can specify only certain websites that you know this application needs to access.
Custom Rules are a legacy feature and when possible ThreatLocker recommends using Exclusions instead as they are more efficiently managed, do not require an application restart, and can be automatically learned. If you are applying Tags, they will need to be applied in the 'Custom Rules' tab.
Exclusions are very efficient to manage. Here you can specify IPv4 addresses, IPv6 addresses, or domain names the application can access. Changes made to exclusions do not require you to restart the application, or deploy policies.
To set up internet Ringfencing restrictions on your own policy, select the checkbox next to 'Restrict these applications from accessing the internet, except for the below rules'. Then you will type in the exclusions you want to allow access to, and you can use wildcards as needed. Be sure to click 'Add' after each entry.
To add a domain name to the 'Exclusions' list, choose 'text' from the 'Value' dropdown menu and then type in the text you wish to include in the tag. You can use wildcards in the text string. Then click the 'Add' button to add your Value to the list below.
When you are using wildcards in the domain name, be careful not to place a wildcard at the end of a domain name. An attacker could easily set up a domain with a name that begins the same as a trusted, legitimate address. (e.g. www.google.malicious_site.com)
To add an IPv4 address, choose 'IPv4' from the 'Value' dropdown menu and then type the address you want to include in the tag. Then click the 'Add' button to add your Value to the list below.
To add an entire subnet of addresses, choose 'IPv4' from the 'Value' dropdown menu and then type the address of the subnet you want to include in the tag using CIDR notation. Then click the 'Add' button to add your Value to the list below.
To add an IPv6 address, choose 'IPv6' from the 'Value' dropdown menu and then type the address you want to include in the tag, being sure to click the 'Add' button when you are finished.
Changes to Exclusions happen in real-time. You do not need to click 'Save'; you can simply exit out of the window.
If you ever need to delete an item, simply select the delete button next to the Exclusion you want to remove.
When you are applying Ringfencing to an Application that has previously not had Ringfencing applied, it is very important to place that specific Policy into a Monitor Only Status for about a week.
Failure to place a new Ringfencing Policy into a Monitor Only Status for a week may possibly impact your day-to-day business operations.