Smoothwall cloud filter

[CrootUK]

Hi All,

 

Those that are using / tried to use smoothwall cloud filter could you let me know the pros/cons you found along the way?

 

We are majority windows devices, the rest being iPads, we have Intune management for it all.

 

Of our multiple schools only two have smoothwall onprem appliances, but we have devices roaming across all sites.

 

There are a mix of browsers in play usual ones Edge/Firefox/Chrome etc.. quite a few apps with built in browsers too.

 

Has anyone been able to achieve reliable filtering with the limitations smooth-wall cloud filter among others currently have.. eg restriction to Edge/Plugins/Custom browsers etc.. have they had any students find ways around it? Portable browser off a usb etc?

 

Additionally for the sites we have smoothwall, another vlan just wouldn’t be a scaleable solution, so the secret knock would have to be used. Has anyone had success with that? Is it tied to a particular smoothwall or will it work with devices roaming between the two appliances? Has anyone had any students figure this out and bypass filtering? Is anyone leaving it to double filter, I cant imagine the issue with it doing so apart from maybe a extra millisecond delay loading a page?

 

I have looked at a-lot of solutions now and nobody seems to of achieved a onprem equivalent in the cloud that can filter offsite?

 

I keep reading alot about how Apple make it hard to restrict content in safari thus the need for a third party browser, but when I have used Mobile Guardian MDM in the past it could do it perfectly, has something changed since?

 

I know Sophos can also filter on Windows in multiple browsers, but likes of Defender for Endpoint is restricted to Edge for https inspection, just wish there was a all in one solution, that was easy to deploy and scaleable.

 

Appreciate this is a big one, open to thoughts and to hear your own success/failure stories.

 

Thanks.

Edited October 9, 2023 by CrootUK

[ibpalle]

Additionally for the sites we have smoothwall, another vlan just wouldn’t be a scaleable solution, so the secret knock would have to be used. Has anyone had success with that? Is it tied to a particular smoothwall or will it work with devices roaming between the two appliances? Has anyone had any students figure this out and bypass filtering? Is anyone leaving it to double filter, I cant imagine the issue with it doing so apart from maybe a extra millisecond delay loading a page?

 

Just a few pointers.

 

Secret knock is widely used and can work across sites. If a DNS alias is created on each site using the hostname of 'secretknock' for example, pointing to the local Smoothwall, the cloud config can be set to use that hostname for the secretknock, making it work at all sites with that configuration. Similar to wpad for automatic proxy discovery really.

 

Double filtering isn't so much an issue as long as the Smoothwall CA is installed on the client. Can make troubleshooting a bit trickier but mostly just an additional bother, not a showstopper.

[Oaktech]

We deploy it to chromebooks and windows laptops. It's pretty much flawless on the Chromebooks, but we have some issues with the Windows laptops taking upwards of 30 minutes after login to apply the correct filtering if it's anything except student level.

[tom_newton]

We deploy it to chromebooks and windows laptops. It's pretty much flawless on the Chromebooks, but we have some issues with the Windows laptops taking upwards of 30 minutes after login to apply the correct filtering if it's anything except student level.

 

Definitely shouldn't be doing that - put in a ticket, and send me the number so I can track it

 

- - - Updated - - -

 

PS. There's even more power coming down the line for Cloud Filter on windows. Watch this space...

[CrootUK]

Definitely shouldn't be doing that - put in a ticket, and send me the number so I can track it

 

- - - Updated - - -

 

PS. There's even more power coming down the line for Cloud Filter on windows. Watch this space...

 

Hi Tom,

 

Any timeline on this? What can we expect filtering for everything not just chromium? Currently doing testing now so curious if its something I need to add to my notes.

[tom_newton]

Hi Tom,

 

Any timeline on this? What can we expect filtering for everything not just chromium? Currently doing testing now so curious if its something I need to add to my notes.

 

Q1 24 or thereabouts

[kennysarmy]

We've just had a load of our on-prem policies randomly deleted from our box, causing a bit of havoc with our admin staff!

 

Smoothwall have admitted this is because the cloud filter cannot handle policies applied at the user level!

 

Thanks for letting me know this would happen when signing up to trial the cloud filter option :/

 

Hoping support can retrieve and put back all these polices that have been deleted!

 

One to watch out for!

[sparker1977]

We have cloud filter on our student laptops using the secret know. Only problem we have is that the Edge browser works flawlessly, the Chrome one lets you go wherever you want! anyone else have the same issue?

[BOOT]

We have cloud filter on our student laptops using the secret know. Only problem we have is that the Edge browser works flawlessly, the Chrome one lets you go wherever you want! anyone else have the same issue?

You need to set the Chrome policy to disable QUIC protocol.

[sparker1977]

Ah thanks BOOT3988 I'll try that

[ibpalle]

Do not think QUIC is the issue here - is the diagnostic for the cloud filter extension looking different in the chrome and the edge browser?

[sparker1977]

Hi ibpalle bizarrely it has now started to work, not sure why but initially I could browse betting sites on Chrome but were blocked on edge, now it appears Chrome has finally caught up with the filtering! very odd

[chrisjako]

It seems there are several issues that allow unfiltered sites across our academies

 

• Web proxy randomly crashes and needs restarting – with no alert telling us it needs to

• http/https-QUIC needs adding to firewall reject rules

• Devices which secret knock via cloudfilter will not filter traffic when a browser is used that hasn’t got the cloud filter extension, for example renamed portable browsers that are difficult to police in an intune enviroment

 

I have growing concerns regarding Smoothwall's effectiveness in safeguarding both our staff and students.

[ibpalle]

Just a few replies

 

• Web proxy randomly crashes and needs restarting – with no alert telling us it needs to

 

That should be possible to address. It's not something we get complaints.

 

• http/https-QUIC needs adding to firewall reject rules

 

Yes they do. Nothing to do with the cloud filter extension though as that doesn't matter for the cloud filter extension but for normal filtering it does. There is a content mod to remove the QUIC header but that will only work with https inspection and if the browser is not in QUIC to begin with.

 

• Devices which secret knock via cloudfilter will not filter traffic when a browser is used that hasn’t got the cloud filter extension, for example renamed portable browsers that are difficult to police in an intune enviroment

 

Cloud filter extension is meant for managed devices and works in the browser itself. That should have been explained as it's one of the cons of using the cloud filter.

[5tu]

It seems there are several issues that allow unfiltered sites across our academies

 

• Web proxy randomly crashes and needs restarting – with no alert telling us it needs to

• http/https-QUIC needs adding to firewall reject rules

• Devices which secret knock via cloudfilter will not filter traffic when a browser is used that hasn’t got the cloud filter extension, for example renamed portable browsers that are difficult to police in an intune enviroment

 

I have growing concerns regarding Smoothwall's effectiveness in safeguarding both our staff and students.

 

You have to block every method a user could use to run an unmanaged browser. Cloud filter assumes the device is locked down, the Smoothwall browser extension is installed and configured, and that users are unable to add/remove browser extensions.

[ibpalle]

You have to block every method a user could use to run an unmanaged browser. Cloud filter assumes the device is locked down, the Smoothwall browser extension is installed and configured, and that users are unable to add/remove browser extensions.

 

Yes, that is correct.

[chrisjako]

You have to block every method a user could use to run an unmanaged browser. Cloud filter assumes the device is locked down, the Smoothwall browser extension is installed and configured, and that users are unable to add/remove browser extensions.

 

2 of these points can be fixed and prevented, one can not

[chrisjako]

Just a few replies

 

Yes they do. Nothing to do with the cloud filter extension though as that doesn't matter for the cloud filter extension but for normal filtering it does. There is a content mod to remove the QUIC header but that will only work with https inspection and if the browser is not in QUIC to begin with.

 

So for BYOD with http are you saying it could be possible for our students to bypass fitlering?

[5tu]

2 of these points can be fixed and prevented, one can not

 

Which one would you say can’t be done?

 

I’m happy to share our config if it would help you.

Edited January 30, 2024 by gybe78

[ibpalle]

So for BYOD with http are you saying it could be possible for our students to bypass fitlering?

 

For a BYOD not using HTTPS inspection and not blocking QUIC - yes.

Edited January 30, 2024 by ibpalle

[chrisjako]

Web proxy randomly crashes and needs restarting – with no alert telling us it needs to.

 

We find out when students are reported accessing the internet unfiltered, has happened three times over the space of 2 years within 19 academies, apparently a known issue

[ibpalle]

Web proxy randomly crashes and needs restarting – with no alert telling us it needs to.

 

There is an alert you can enable in the reports - alerts - alert settings. The system services section - enable the web proxy and web filter as alerts and include them in the alerts you are already sending out to your team.

[chrisjako]

I appreciate I said "crashes" however that was probably the wrong terminilogy - the green tick still shows on the dashboard so essentially isnt a "crash" - it just needs a service restart to function as intended - in this case the alert will not help

[m0bov]

I am struggling with it here, we have Windows 11 intuned laptops. I have the cloud filter working on an account, if I log in as another account, it shows disconnected.

[tom_newton]

Sorry I missed this as I was away. Good chance the second account hasnt automatically signed into the browser - we dont make a connection if we have no username.