Smoothwall filtering issue

[chekmate1984]

Hi, we have Smoothwall in place that is working as transparency proxy server.

 

The school wants to activate Smoothwall blocking certain word searching results for students, as it used to supposedly work, some time ago.

 

We created an HTTPS inspection policy to Decrypt and Inspect for everyone, for Google Search and Web Search, as it wasn't in place.

I've created a Web filter policy - Search suggestions category to activate a blocking list for search results.

 

I applied the above settings to test users, but they worked only if the proxy was set as a non-transparency proxy (so when the proxy server was typed in in the proxy settings).

 

I've created GPO with a user setting to apply proxy settings for users and assigned it to test users, however, the settings haven't been applied by the system (possible other higher priority GPO preventing applying the settings).

This used to work fine before certificate had expired. Seems to be something with proxy I feel but unable to get to right area.

 

Any pointers please? as currently students can search for guns etc

[howartp]

This used to work fine before certificate had expired.

Presumably you've rolled out the new certificate to your workstations?

 

[smoothwall]/modules/guardian3/cgi-bin/guardian/httpssettings.cgi

 

Export

[chekmate1984]

Hi yep, certificates has been deployed been few months since it was deployed. Just the filtering dont seem to be working!

[36Degrees]

I assume you have set the default gateway in DHCP to point to the IP address of your Smoothwall rather than the IP address of your router?

[ibpalle]

This may be due to QUIC traffic - QUIC is a protocol supported by Chrome which use UDP instead of TCP for streaming some web traffic.

 

I would try blocking outgoing access to UDP ports 80 and 443 at the firewall level and also implement a content modification policy to remove QUIC header for eveything.

[PaddyNewman]

This may be due to QUIC traffic - QUIC is a protocol supported by Chrome which use UDP instead of TCP for streaming some web traffic.

 

I would try blocking outgoing access to UDP ports 80 and 443 at the firewall level and also implement a content modification policy to remove QUIC header for eveything.

 

It is more than likely this ^

 

QUIC is a royal PITA, you can tell by capturing and seeing it in Wireshark, you can turn off in Chrome (chrome://flags - search for QUIC) or just binning it at the firewall as suggested, which works if you are using non Chrome browsers. it'll fall back to standard TCP.