Smoothwall: Realtime webfilter questions

[browolf]

What does it mean when an url is status 200 Ok but hasn't activated a specific policy aka

 

 

in relation to how web filter policies might be set up.

 

There seems to be a lot of hits that register as unathenticated ips even when there's a user logged on, is that normal?

Edited October 11, 2023 by browolf

[TechMonkey]

200 is an allowed, so probably not part of a category list.

The wierd one is if you get a 200 but it is red. I'm pretty certain that is showing it is having issues with HTTPS interception.

 

if a lot of unathenticated IPs, either your authentication isn't working, you have a lot of devices that don't use authentication or you have a lot of entries in your Bypass Auth category.

[browolf]

200 is an allowed, so probably not part of a category list.

The wierd one is if you get a 200 but it is red. I'm pretty certain that is showing it is having issues with HTTPS interception.

 

if a lot of unathenticated IPs, either your authentication isn't working, you have a lot of devices that don't use authentication or you have a lot of entries in your Bypass Auth category.

 

They show on logged in pc intermixed with authenticated hits.

 

I thought the penultimate column shows all the groups the url match, wouldn't bypass auth appear in this list too?

 

it's like it fell out of the bottom, should there be a block everything final policy?

Edited October 11, 2023 by browolf

[tom_newton]

No - if there's no policy, default is "allow" - we've got categories, but no policy. That's perfectly normal.

Unauthenticated stuff may be something that's in the "Do-not-auth-for" list - on long-lived systems this list can grow and grow, and sometimes needs a prune, or it could be something on the PC that's not authenticating (maybe some stuff is traditional proxy, some is inline, and inline isn't authing?)

Suggest a health check (contact your Smoothwall CSM) would be useful

[ThomL]

200 is an allowed, so probably not part of a category list.

The wierd one is if you get a 200 but it is red. I'm pretty certain that is showing it is having issues with HTTPS interception.

 

if a lot of unathenticated IPs, either your authentication isn't working, you have a lot of devices that don't use authentication or you have a lot of entries in your Bypass Auth category.

Hijacking the thread slightly - I've got a ticket open with smoothwall currently that's just been escalated from 1st to 2nd line - 1st line said the issue is certificate pinning from the ClassCharts iOS App, red items with a 200 in the real time:

Escalation followed me asking how I could determine certificate pinning issues in the future to save opening support tickets - is it as simple as items being displayed in red while showing a 200 have a certificate issue?

[tom_newton]

Pretty much - that means that something failed that wasnt able to give us a http failure code. It's almost always something cert-y.

For IOS consider using our iPad secure browser - that will help you avoid such issues in future

[TechMonkey]

I have no official source but that is what I have determined. Adding it to HTTPS Bypass normal stops it being red.

[browolf]

I have another question,

 

is it possible to ban youtube on an active directory group of PCs?

 

I can create a directory group mapped to an AD group but it seems that location group on a rule will only accept Ip adresses. I tried adding the group as "who" as it appears in the "available users or groups" list but that didn't work.

 

it would be useful if there was a pinned post for asking little questions that don't need individual posts

 

@ipballe I see there's a closed smoothwall subreddit that you're the mod of, what happened with that?

Edited October 12, 2023 by browolf

[tom_newton]

If you have reverse DNS you can use that as a location by "list of hostnames" - you may have to turn on reverse dns lookup in the filter (web proxy, settings... may be advanced, cannae remember) - it does put a little extra load on your dns servers, which is why it is off by default (1 extra lookup/request)

[browolf]

If you have reverse DNS you can use that as a location by "list of hostnames" - you may have to turn on reverse dns lookup in the filter (web proxy, settings... may be advanced, cannae remember) - it does put a little extra load on your dns servers, which is why it is off by default (1 extra lookup/request)

 

Do I need to do "save and restart" with this?

[ibpalle]

Just a note on the code column and the 200 result that has been discussed. The code column shows the code from the upstream web server. A 200 means success OK so the transaction succeeded. Other examples are 404, 503 etc. Hover over the code to see status result and do a lookup for http server result codes if you would like to know more.

 

This is why you can see both code 200 and code 0 for blocks, depending on block reason. A block for playboy.com will show with a code of 0 as it was blocked immediately due to playboy being listed specifically in both Porn and adult. A search for 'AR 15' could show a 200 for the code in case the block was caused by content filtering. The content of the page caused the block and the filter has to get the content first in order to decide on the block, hence the 200 in the code column.

 

When you see a red block with 200 and no policy listed as the cause of the block, the issue is always related to HTTPS - note that the entries are all for https links. You won't see http. It could be that the client does not have the Smoothwall CA installed. It could be caused by an application using certificate pinning or an app/software that isn't using certificates 'correctly' - apps/software only need to talk to one server, not all web servers in the world like browsers, so they sometimes just embed certificate keys in the app and as long as they compare favourably to the server certs, that's security enough for the app/software.

 

If an app/software is generating red https blocks, then add the target domain to a do not filter policy (or do not inspect in https inspection) - that will get rid of standard certificate checks in the filter and likely allow the app to work.

Edited October 12, 2023 by ibpalle