So far, I have written a few articles about firewall bypassing techniques. Using simple methods like ToR or SSH tunneling—if allowed—you can completely bypass firewall protections. But is there a way to bypass URL filtering as well? Unfortunately, yes, and it’s surprisingly simple.
Google Translate as a Firewall Bypass
Google Translate is usually allowed int most networks. For example, Palo Alto categorizes it as:
In my lab enviroment, news category was blocked:
Let’s try accessing a blocked website through Google Translate as a proxy by using the direct link:
https://translate.google.com/translate?sl=auto&tl=en&u=https://www.reddit.com/
As you can see, the “news” category, which should be blocked, is now accessible. From the firewall’s perspective, the traffic is not going to Reddit but to Google Translate, making it difficult to enforce URL filtering rules.
How to Prevent Firewall Bypass via Google Translate
The challenge is allowing access to Google Translate while preventing its use as a proxy for restricted content. To ensure advanced security, the firewall must be able to inspect traffic in clear text. The solution? Deploy decryption.
Without decryption, the firewall can only see the domain (e.g., translate.google.com). However, with decryption enabled, the firewall can inspect the full URL and detect attempts to access restricted sites through Google Translate.
The firewall can identify that a user tried to access a blocked website through Google Translate.
Conclusion
To summarize, decryption is a must-have feature in network security, yet it is often not implemented. From a technical perspective, decryption may occasionally disrupt some communications and require maintenance, but it is essential for achieving a strong security posture. While not always easy to deploy, proper decryption ensures that similar firewall bypass techniques remain ineffective.
You can also fix this problem by blocking the translate.goog domain in the FortiGate Web Filter, Full SSL Inspection is not required, SSL Certificate Inspection is sufficient.
Agree! – if company policy allows it and people don’t need it to do their work