LGfL webscreen filtering - Bursar can't use Nat West website (Host is an IP)

[Koldov]

I've just had an email saying the Bursar is having trouble with the Nat West website and I've run a report which shows me the denied entries being 'HOST is an IP'.

 

This is a blocked category in webscreen (I think by default, I don't usually have to mess with it though) and I'm not entirely sure why, but I just presume bad things come from such hosts...

 

I could unblock this but obviously this leaves a security hole, so I could limit it to the IP of the Bursar's computer (but still a hole).

 

Or I could possibly allow those IPs, but there's no guarantee they are static... and as they are IPs I'm not sure if it will work if I just unblock the Nat West 'website'...?

[DavR]

You could try unblocking http://www.natwest.co.uk as a keyword, there's probably no harm in it.

 

However, I would also / instead open an URL recategorization request with LGfL, so they can fix this problem for everyone and make sure that all the Nat West addresses are in the correct categories.

[sigma]

Can you indicate the exact format of what was blocked, with x’s for the ip addy?

 

Run a category check as it likely fits other categories which may or may keep it blocked for other users.

 

You may find you also have to bypass decryption for banking urls too.

[DavidYoung]

Hi Koldov,

 

Sorry to hear this is happening. Normal websites accessed through a browser shouldn't be showing as 'Host is an IP' which implies something Is going wrong with the SNI detection.

 

Keeping Host is an IP blocked is always a good idea as it stops a whole load of potential backdoors, so I wouldn't unblock it to fix this.

 

Do you have a case raised for this? If so can you post/DM the reference? Otherwise, drop me a email to SchoolProtect at LGfL . net.

 

We'll get this sorted for you.

 

David

[Koldov]

Thanks everyone.

 

Otherwise, drop me a email to SchoolProtect at LGfL . net.

 

Thanks for reaching out, I appreciate it.

 

I didn't raise a case as I thought it might just be something some websites do to deliver certain content...

 

I've emailed you all the details I have.