Chrome, QUIC and filter hole.

[TechMonkey]

Not sure if anyone else has ever heard of QUIC but it is essentially HTTP/HTTPS over UDP. I found this out while testing our Guest wireless access and found Google searches were not being logged, even with HTTPS MITM sorted. Yahoo searches were but not Google ones. Very odd.

 

Quick support call with Smoothwall and they tested and proved it was UDP web traffic. Smoothwall currently doesn't monitor UDP web traffic.

 

I'm not sure if this only mobile Chrome using this or all forms of Chrome. I'm also not sure if this a Smoothwall only issue or a wider Filtering/UTM/Proxy issue.

 

UDP web traffic is now blocked on our site but I wasn't sure how many others had heard of these or come across it and it seems like it could be a rather hole in an otherwise excellent filtering policy.

Smoothwall KB

Edited November 24, 2016 by TechMonkey
Added KB

[jamesp]

Old Post I know

But I know I'm seeing many Schools currently suffering from broken web filtering due to QUIC, blocking UDP on 443 will force Chrome to drop down to using normal expected packet transit.

Just chuck this in your firewall rule as an outgoing rule and you should be golden!

 

If really wanted - you could create a group policy to stop Chrome using QUIC though it would have to be maintained throughout the update lifecycle of chrome.

 

Hope that helps some of you!