Block where app is None

[Greedy456]

Hi all

Is there any way to block applications that are labeled as None?

I've tried adding a rule to block where app equals None.

Any help will be gratefully received.

[jcoffin]

Do you mean Application Category is none? Application should never be none, at least UDP / TCP in there.

[Greedy456]

Do you mean Application Category is none? Application should never be none, at least UDP / TCP in there.

There is a app none in the screenshot below

Screenshot_20220324-080122_Chrome.jpg

[jcoffin]

These are sessions which were not classified due to a number of reasons; bypassed, no app control in policy, timed out classifying, IPv6 etc.
I do not recommend blocking these sessions.

[Greedy456]

These are sessions which were not classified due to a number of reasons; bypassed, no app control in policy, timed out classifying, IPv6 etc.
I do not recommend blocking these sessions.

The instance highlighted in the screenshot, is a clients using nordvpn and bittorent. How else can I block it if showing as none

Nord connects to too many ports and servers to block through the firewall. So I was hoping app control would do it

[jcoffin]

Think of this the other way around. Many session are set to None which are not Nord VPN. If you block None, how many session is it going to block erroneously?

[jcoffin]

Are some of the sessions marked VPN? Nothing will block all private VPN services. It is always an arms race to block these. Even governments like Russia and China have issues.

[Greedy456]

Are some of the sessions marked VPN? Nothing will block all private VPN services. It is always an arms race to block these. Even governments like Russia and China have issues.

Guess so. Thanks for your help