Internet browsing issues with new Smoothwall... Can't get my head round them!

[TomHD]

Morning All,

Recently our broadband provider switched from E2BN to Smoothwall and ever since I have been having browsing issues for particular websites. These issues are only affecting domain machines, my office PC and the staff laptops are not behaving this way.

I would attempt to explain the issue but its so odd and inconsistent I made a video instead:

https://www.youtube.com/watch?v=csfX6zAkKMA

 

The issue also appears to be affecting copy/paste of pictures from the web!

Looking forward to hearing from you guys, anyone else had this?

Thanks, TomHD

Edited May 15, 2018 by TomHD

[TronXP]

Wow, thats slow.... Not a smoothwall customer but my guess is to do with SSL inspection

[TomHD]

Yeah I am leaning towards SSL inspection! I have already raised a case with our provider but they closed the ticket and said the problem was sorted. I'll get back in touch with them.

[Bezwick]

We have the same issue on Smoothwall. Got round it by creating an authentication white list, telling specific sites to bypass the packet inspection. As all the sites in our list (only about 10) are ones we trust its not much of an issue.

[TomHD]

Thanks for the heads up, our Smoothwall is managed by School's Choice and I cannot see an option to whitelist, what I have done is add twinkl.co.uk to the "Everyone Allowed" list but still having the same issue

[AlanD]

Not sure what your "Everyone allowed " category is assigned to ...but authentication is not the same being allowed.....

 

Typically white listing bypasses authentication and any block....

 

According to their web site Schools Choice uses "Protex" filtering...not smoothwall. So I don't understand why you are quoting smoothwall problem.....

 

Does their Protex system produce "Prevent" strategy reporting - reporting by username on Violence/racism/ etc.... its not one I've looked at....

Edited May 15, 2018 by AlanD

[TomHD]

School's Choice in Suffolk have definitely moved from Protex to Smoothwall, perhaps they are yet to update their correspondents. I'm guessing the white listing configuration is on their end. I have made contact with them so hopefully I hear something soon.

[Jawloms]

School's choice have moved, and have a massive amount to do/change/update/notify/pulltheirfingerout. The Suffolk schools don't get to see the 'normal' smoothwall interface.

@TomHD - do you have a contact there? We have been working very closely with them in the hopes they will sort out the shambles of a migration, and I have a name/email if you don't get very far. PM me if want it.

[TomHD]

@Jawloms have you been having issues too? Certainly will need that contact, I'm sure the more complaints they get the more resources they can appropriate to fix!

[AlanD]

....so how are they doing their user identification....by joining to your domain...or by your clients installing and running an identification module...or by using some form of cloud identification service? When you say it’s affecting your domain machines.and not your office machines...are you saying your office machines are not domain machines? And how are they being identifies?

[sigma]

Not managed by School's Choice any more.You have the phone the Suffolk IT helpdesk now. I still have issues outstanding from last year.

[sigma]

School's choice have moved, and have a massive amount to do/change/update/notify/pulltheirfingerout. The Suffolk schools don't get to see the 'normal' smoothwall interface.

@TomHD - do you have a contact there? We have been working very closely with them in the hopes they will sort out the shambles of a migration, and I have a name/email if you don't get very far. PM me if want it.

 

We Suffolk schools are "tennants" so can only access a very limited Portal which is so slow that it usually logs me out in the middle of trying to navigate it

 

Interesting that others are also having problems as I keep being told by School's Choice that everyone else says how great it is and its just me that has issues! To be honest, I have felt like a beta (alpha?) tester as so many basic aspects of this ill thought out implementation just don't work.

 

I'd be happy to share the things I've found that don't work, security concerns, perceived product/implementation shortcomings etc. with other Suffolk schools and to find out about problems I've not hit yet. PM me.

[AlanD]

...thinking that if I was working in a Suffolk school...I’d be planning to move away from using them...there are choices out there in the wide world...and too often bad, and often costly suppliers rely too much on baseless loyalty to keep their customers. Internet and web filtering requirements are changing all the time, and are being used as cash cows...

[sigma]

Morning All,

Recently our broadband provider switched from E2BN to Smoothwall and ever since I have been having browsing issues for particular websites. These issues are only affecting domain machines, my office PC and the staff laptops are not behaving this way.

I would attempt to explain the issue but its so odd and inconsistent I made a video instead:

https://www.youtube.com/watch?v=csfX6zAkKMA

 

The issue also appears to be affecting copy/paste of pictures from the web!

Looking forward to hearing from you guys, anyone else had this?

Thanks, TomHD

 

Thanks for posting this.

 

A couple of questions..

 

For all your users, did you install the client or are you using the proxy and port to determine the level of access per user, and which is used in the video?

 

What version of Windows Server and Windows are you running?

 

For each of the websites that you visit in the video and for each browser, can you check the SSL cert to see if its the real one for the site or the Smoothwall interception one?

 

Not actually relevant to this problem, but are you an LEA maintained school or an Academy or Free school? (Relevant to other issues).

 

 

 

 

.

[sigma]

...thinking that if I was working in a Suffolk school...I’d be planning to move away from using them...there are choices out there in the wide world...and too often bad, and often costly suppliers rely too much on baseless loyalty to keep their customers. Internet and web filtering requirements are changing all the time, and are being used as cash cows...

 

I understand that some Suffolk schools have - after looking at the County/School's Choice Smoothwall solution, but I also believe that it costs a bit more to move away, and some schools just can't afford to at the moment.

Edited May 16, 2018 by sigma

[TomHD]

I am only using the proxy and port at the moment, I have the client ready to deploy but I didn't want to complicate the installation anymore until the issues have been resolved. Would you suggest I use the idex client instead?

 

The machine in the video is a domain machine using the proxy and port method.

 

We are running Win7/Server2088R2 RM CC4.

 

The SSL certs seem to be for the website, not the Smoothwall one. If I go to Twinkl and click the "i" it shows this:

 

We just converted to academy in March 2018.

 

I want to move away from any managed service at all but money...

[sigma]

Unless the adults in your school have provided informed consent to have all their internet usage available for County, MLL and Smoothwall to view by personal identifier (probably name?) then you are probably best never deploying the client. As you are an Academy, the staff no longer have an employee relationship with County, and it's difficult to see how County, MLL and Smoothwall have any justification under GDPR to detailed browsing logs otherwise.

 

Bearing in mind you can build up a very detailed profile from metadata and all their searches and social media updates (including incoming) if they are allowed access are decrypted and inspected.

[AlanD]

Thanks for posting this.

 

A couple of questions..

 

For all your users, did you install the client or are you using the proxy and port to determine the level of access per user, and which is used in the video?

 

 

I'd reiterate that. I know you are paying for this service...but its not as simple as connect and go....and you need to understand what needs to be done to get the user authentication to work - which seems to be at the heart of this issue.

[sigma]

Today's issue:

Teacher does news search (think she mean't to do image search) for "cucumber" and it gets blocked for reason "Core blocked - porn"

 

I do pupil search (KS1/2) for "news for Cucumber" and the first Google search result is:

Why would anyone cleanse their vagina with a cucumber? - BBC Three

https://www.bbc.co.uk/bbcthree/article/ab7a165a-3904-477b-8878-e55833f44e1a

 

This system is seriously failing.

[TomHD]

I had the same with Bing searches for "Twinkl" that were being blocked because the word "twink" is a descriptive word for a certain kind of gay man this filter is a mess!

 

And I have rolled back the use of the idex client for now until GDPR issues are made clear. Only filtering based on machine IP now.

[1an]

Also a Suffolk school with similar issues since the Smoothwall migration. Using proxy / port to set filtering levels. I have a number of tickets open with County and have had particular issues with Renaissance Learning website not responding this week.

[TomHD]

Sorry to hear that you're having issues too! My biggest gripe with the issues is how inconsistent they are!

[sigma]

Today a search for:

Can+you+grow+potatoes+inside?

 

Is blocked by the "core block" for *drugs*

 

Who knew?

[sigma]

I'm also seeing the string "Do not inspect mobile apps" in the logs from a school with a large number of iPads.

 

I was otherwise not aware there was a difference in the filtering.

[sigma]

You do know that if I come to your school I can logon to your school's portal with my school's account and make changes to your school's filtering?