Smoothwall - filter by URL keywords

[zachariah]

I'm trying to block a site within sites.google.com, (sites.google.com/site/newstudyhallx1) but it's just not working. Is there any way to filter URLs by keywords, like MS ISA does? It feels like this should be something already in Smoothwall, but I can't find it. I'm looking for a way to put, say, 'newstudyhallx1' as a keyword to automatically block any URL containing that.

 

Thanks for any advice!

[sonofsanta]

In your User Defined Filter, click the Advanced button and use a regular expression in URL patterns. (newstudyhallx1) should suffice, I believe.

 

Useful page for using regex: regexpal.com

[tom_newton]

Caveat: URL filtering is NOT effective against SSL requests unless you are MITM inspecting (this is true for all filter products) as you cannot see the URL part without decrypt.

[zachariah]

Just an update to say this is still not working, and url filtering on Smoothwall appears to be ineffective.

[tom_newton]

It certainly does work - but there are two reasons it wouldn't apply:

1. The site is using SSL encryption, and you aren't MITMing it - we then have no access to the URL.

2. There's another rule above the one you're writing which applies an allow or whitelist action to the site in question.

[zachariah]

Thanks - No.1 is probably it, though with 'sites.' being a sub-domain of Google, we are loathe to put any filtering on it that might cause any slowdown. Any workarounds for this?

[tom_newton]

As a subdomain you can differentiate sites, and just mitm that?

[stepud]

It is worth putting in a support ticket to Smoothwall as we had exactly the same issues. It needed a new category, search term patterns setting up to catch the 'unblocked games' sites and ensuring that this category was at an appropriate level in the hierarchy to get priority over other rules. You also must enforce decryption of the https traffic (which you need to do anyway these days for Google searches in general.)

As this is fairly dependant on the way your site is set up Smoothwall's support guys will probably need to remote in and be given admin access to the web front end. They know their stuff and this isn't the first school they have set up!