Lightspeed MacOS Filtering Service Problem

[KCOS]

Helloo, not sure if anyone can help, but the past month across our whole deployment of 1000 Macs, we've been getting specific pages blocked at random 'Due to a filtering service problem'. These are fully allowed at the top level.

 

We've had a Lightspeed engineer check over our deployment on Jamf, remote onto a machine, and all appears correct. At this time they're unsure of whats causing it.

 

The issue happens more frequently when going to links without 'www.' in the URL. Such as 'https://amazon.co.uk/' will be blocked, but 'https://www.amazon.co.uk/' will be allowed, despite traffic in relay saying its allowed to both.

Then there is a long list of sites we've got where both options do not work.

 

We've tried different DNS servers, and get the same thing. Our Windows and Chrome devices are all working fine. Enabling the 'bypass rules on failure' does get it working correctly, but we don't want that option enabled for security reasons.

 

Its at the point where we've now got the whole school on our back about it...

 

Any ideas are greatly appreciated.

[Face-Man]

Have you got the same issue with different browsers on the same devices ?

 

I'm not familiar with lightspeed or jamf but this seems to be an issue others have had https://community.jamf.com/t5/jamf-pro/safari-and-chrome-show-blank-white-on-all-pages/m-p/198699

 

the issue appeared to be with the jamf ad blocker plug in but is an old thread.

 

I know with us we had to allow lots of ports through the firewall so mac's could check in with apple list here https://support.apple.com/en-gb/HT210060

[KCOS]

Just an update on this, we've had another remote session with Lightspeed earlier this week, and they've replicated the issue their side. Its to do with sites that use lets encrypt and something between the lsproxy and lsfilter is not working and so the sites fail to decrypt. Temp work arounds are enabling the 'bypass on failure' option or adding individual domains under domains to the decryption exclusion. Its with their dev team at the moment, so hopefully if anyone else is having this issue, it will be fixed in a future update.