Youtube configuring a conditional DNS forwarding rule on Server 2013

[talksr]

As part of the changes with Google and Restricted Pages, I got the following update through from our ISP, Atomwide.

 

Google have recently made a change forcing all YouTube traffic to be encrypted (HTTPs) thereby limiting the effectiveness of Safe Search and keyword blocking through the WebScreen 2.0 filtering service.

 

As a result of these changes and to protect schools from inappropriate content, the LGfL DNS servers have been set to enforce YouTube’s new Restricted Mode.

 

Schools that would like to turn off the Restricted Mode should configure a conditional DNS forwarding rule on their own DNS servers pointing youtube.com, googleapis.com and youtube-nocookie.com domains to the Google Public DNS IP addresses (8.8.8.8 and/or 8.8.4.4).

 

To be kept up to date and informed of any future announcements of this nature, we recommend that you download the ParentComms mobile application.

 

I can't say I have ever put on a conditional DNS forwarder rule before. Does anyone have any experience of how this is done?

Edited January 7, 2016 by talksr

[localzuk]

Server 2012 you mean? Windows Server - How to configure a Conditional Forwarder in DNS

[Bagpuss66]

Does this work with Google search engine ? Since the changes we can't enforce safesearch and it has caused a few incidents of students accessing Adult images.

We managed to block Youtube for ks3-4 using our palo alto firewall as only Ks5 and teachers are allowed access to Youtube in our Academy.

[talksr]

Thanks so much, and yes, I wish they wouldn't put the 3 button so close to the 2 on keyboards!!!!!!

[fiza]

You want to check this thread http://www.edugeek.net/forums/london-grid-learning-lgfl/163957-youtube-restricted-mode.html

[localzuk]

Does this work with Google search engine ? Since the changes we can't enforce safesearch and it has caused a few incidents of students accessing Adult images.

We managed to block Youtube for ks3-4 using our palo alto firewall as only Ks5 and teachers are allowed access to Youtube in our Academy.

 

You can do it using a similar method - https://support.google.com/websearch/answer/186669?hl=en

[talksr]

Does this work with Google search engine ? Since the changes we can't enforce safesearch and it has caused a few incidents of students accessing Adult images.

We managed to block Youtube for ks3-4 using our palo alto firewall as only Ks5 and teachers are allowed access to Youtube in our Academy.

 

Hi, not sure about that as ours is automatically set to safe search on google. It is done by our ISP.

 

I have added the forwarders, does this look correct?

 

Edited January 7, 2016 by talksr

[Bagpuss66]

You can do it using a similar method - https://support.google.com/websearch/answer/186669?hl=en

We tried this but for some reason when we create a CNAME we lose Google maps and safesearch is still not enabled. Very strange!

We have Windows server 2012 r2 installed.

[DJ-1701]

@talksr When clicking the attachement I am getting 'Invalid Attachment specified'. Might need to reupload.

[talksr]

@talksr When clicking the attachement I am getting 'Invalid Attachment specified'. Might need to reupload.

 

Have just re-uploaded, hopefully it is showing now!

[DJ-1701]

Have just re-uploaded, hopefully it is showing now!

 

Looks correct. Though I noticed you didn't include an entry for googleapis.com as mentioned in your initial quotation.

[psydii]

If you are returning restricted.youtube.com etc via DNS, you can spin up an AD Sync'd GAFE instance and let teachers authorise which videos logged on students can see.

[talksr]

Looks correct. Though I noticed you didn't include an entry for googleapis.com as mentioned in your initial quotation.

 

Thanks, don't think we have ever used googleapis before so not sure we need that.

[talksr]

If you are returning restricted.youtube.com etc via DNS, you can spin up an AD Sync'd GAFE instance and let teachers authorise which videos logged on students can see.

 

 

Thank you, never heard of that. Sounds a little more complicated to do, do you know of any instruction sites that could help me set it up?

[psydii]

Thank you, never heard of that. Sounds a little more complicated to do, do you know of any instruction sites that could help me set it up?

 

Because my school is very heavily invested in MS technology, we did this via Office365/AzureAD.

 

Create an Office365 for Education instance

https://products.office.com/en-gb/academic/office-365-education-plan

 

Install AzureAD Connect on a server BUT ONLY SYNC a few select users. Assign them licences as appropriate.

https://azure.microsoft.com/en-gb/documentation/articles/active-directory-aadconnect/ (you want the customised option so that you can filter which users get enabled in the cloud)

Check they can logon.

 

Create an Google Apps for Education instance.

https://www.google.com/edu/products/productivity-tools/

(you get a limited trial to begin with, you need to follow these instructions to get an 'unlimited' one: https://support.google.com/a/answer/2856827?hl=en)

 

From Office365 go to AzureAD and set up the Google integration (its called an application). Make sure that all future accounts are set to be enabled for this service.

https://azure.microsoft.com/en-gb/documentation/articles/active-directory-saas-google-apps-tutorial/

 

Make sure now that your All Staff / All Teachers group in your local AD is being synced up to AzureAD (not acting as the filter, but specifically being synced up)

 

 

In Google Apps Admin Center go to the YouTube app and set it up. Add the All Staff group as authorised.

https://support.google.com/a/answer/6212415?hl=en

 

Now back in AzureAD Connect allow all staff and student accounts to filter up to the cloud.

 

 

Having researched it thoroughly, I did this in 3 days this week, and spent a few hours on support calls with MS and Google. However it could take up to 3 weeks as the domain verification may take a long time, and several steps are officially "click and wait 24hrs". Helpdesk stats suffered massively too as project time ate up time I'm supposed to be spending on support.