How to exclude tightvnc from Risk or High Risk application list

Hi Søren Jensen ,

Thank you for reaching out to the community, you can try adding an exception - ^https?://([A-Za-z0-9.-]*\.)?www\.tightvnc\.com/

tightvnc  runs on ports 5900 and 5800 by default. verify with the command in the client machine:
netstat -an | find "ESTABLISHED" | find ":5900 " 

If this two ports are open and not filtered, you'll be able to make it work. 

Hi Vivek Jagad,

Thanks for your reply and suggestion. I've tried the solution you suggest, but it do not work. Maybe because I'm not doing it correctly or maybe because TightVnc, as I use it, is an EXE file local to my workstation, and I'm trying to connect to an IP no nnn.nnn.nnn.nnn:5902, where the nnn's is the external IP no of a firewall allowing request to port 5902 come in, when it is coming from my fixed external Ip no. 

Anyway, I have changed the "Block high risk (Risk Level 4 and 5) apps" application filter and added a category "Remote Access", using smart filter to only include "VNC Remote Access" (filtering out VNC WEB Remote Access), allowing it, all the time. It means I can now use TightVnc to access the external computer I want, but I guess it also means any of the internal  workstations can use any application categorized as VNC Remote Access, to connect to any IP no in the world. 

So to allow me to connect with TightVnc to a specific IP no., I have had to open up for a lot of other VNC programs connecting to an unlimited number of Ip adresses. How do I limit the VNC Remote Access category further ? If possible I would like to limit only to TightVnc, and further, only to a fixed number of IP adresses.

I can't see any further options under Application Filter (or Application Lists for that matter), so where should I look ?

Best Regards

Soren

Hello,

You may create the destination-based rule to with the destination FQDN/IP addresses of TightVNC and the ports used and keep the existing rule to block the High Risk application.