Planet E-Stream Live Streams and smoothwall

[stgoodyeara]

We are a Planet E-Stream and Smoothwall customers. All elements of Planet E-Stream work over smoothwall with the exception of watch a live stream. It just get a buffer wheel and the stream never comes through. If i record the live stream i can watch it back in planet e-stream via smoothwall i just can't watch it live. I have added an any,any,any,allow firewall rule for my Laptop IP and added a guardian source exception and this has made no difference. I have tethered my laptop to mobile data and the live streams work, and similarly mobile phones that play the live streams stop when added to an SSID that behind the smoothwall.

 

Surely adding the allow all firewall rules and guardian exception should solve this? Im out of ideas when ive kicked the biggest hole possible in the smoothwall and its still doesn't work.

 

Any ideas?

[Steve21]

Offhand I can't remember which way Smoothwall prioritises rules, but have you tried a SSL decryption/inspection bypass?

 

Can't remember if the exception will do that, or whether that's only for their filtering policies rather than inspection etc

 

Steve

[stgoodyeara]

Offhand I can't remember which way Smoothwall prioritises rules, but have you tried a SSL decryption/inspection bypass?

 

Can't remember if the exception will do that, or whether that's only for their filtering policies rather than inspection etc

 

Steve

 

Surely it has to go through the proxy to be SSL inspected? The allow all rule is firewall, ive put a source exception in to bypass guardian. For piece of mind ive just tried turning of MITM in it's entirety and it still doesn't work.

[stgoodyeara]

The browser is chucking this:

 

 

live.planetestream.com is in a "Do not Filter" Rule, the URL list is in an auth bypass and SSL inspection bypass too.

[tom_newton]

If you could lend us some credentials for the service (and put in a support ticket - send me the #!) we should be able to track it down and sort it

[TechMonkey]

Could it be that because it is in the Auth Bypass it is having the lowest filtering applied due to being an unauthenticated IP and that may be filtered?

[stgoodyeara]

If you could lend us some credentials for the service (and put in a support ticket - send me the #!) we should be able to track it down and sort it

 

@tom_newton Ticket number #526256 i added you as a CC to the ticket too.

 

Thanks Tom

[tom_newton]

Ta. I popped it on the desk of our top categorisation chap yesterday

[stgoodyeara]

Ta. I popped it on the desk of our top categorisation chap yesterday

 

Ok thanks. Don't feel like it's a category issue. I bypass guardian entirely and it still doesn't work. It looks like the JS that pulls the stream isn't happy. Wasn't able to provide creds but but I've published some public live streams for you. I've just updated the ticket with a new link as the initial one I gave allows access to the room but not the broadcast.

[tom_newton]

Oh that's interesting - is it definitely a Smoothwall thing then? Maybe it's... DNS? It seems it has been tough to reproduce

[stgoodyeara]

Oh that's interesting - is it definitely a Smoothwall thing then? Maybe it's... DNS? It seems it has been tough to reproduce

 

As far as i can see its a smoothwall thing, in the sense that if i take any device from behind our smoothwall and try it it work. Could possible by DNS, ill investigate this. I have circulated the link around other smoothwall establishments and its works too. So it seems specific to my box.

 

Any other ideas?

[dapaulio]

Have you tried whitelisting their Cdn also

 

I am finding the following Cdn

[stgoodyeara]

Have you tried whitelisting their Cdn also

 

I am finding the following Cdn

[ATTACH]71779[/ATTACH]

 

Tried this and it hasn't changed anything.

 

We have multiple sites with centralised filtering and management and e-stream works at all the other sites. This would indicate its not a guardian issue

 

@tom_newton Tried setting a public DNS on my device and that hasn't resolved the problem.

[bknaggs]

https://www.planetestream.academy/support/techdocuments/pdf/Firewall%20Port%20Requirements.pdf

 

Does this help? Live streams are quite often on different ports to 80/443

[robintech]

Does the web site certificate show the "real" authority after disabling https inspection?

Might be trying to build a websocket with the destination only referenced in some JavaScript maybe

Also the real time web filter logs should show what is being blocked

[stgoodyeara]

@tom_newton This is the link load balancer causing this, if I bind guardian to single external interface the issue resolves. How can I stop the LLB rapidly changing the external IP of the end user device?

[DavonPotter]

It's frustrating when the expected workaround doesn't resolve the issue. Have you checked if there might be any specific port settings or network configurations needed for live streaming within Planet E-Stream that could be impacting the connection through Smoothwall? Sometimes, additional settings or adjustments might be required for the firewall rules or network settings that aren't immediately obvious.

[stgoodyeara]

It's frustrating when the expected workaround doesn't resolve the issue. Have you checked if there might be any specific port settings or network configurations needed for live streaming within Planet E-Stream that could be impacting the connection through Smoothwall? Sometimes, additional settings or adjustments might be required for the firewall rules or network settings that aren't immediately obvious.

 

Ive narrowed down the issues to our link load balancer. We have 3 ISP's presented to the smoothwall. If i bind all guardian traffic to a single ISP E-Stream Works. This would indicate that the smoothwall isn't binding all traffic for devices internally on the same ISP. The normal steps here would be to bypass the traffic in guardian and allow it straight out, adding an Link Load Balancing rule to force all the traffic down the same tunnel. The issue here is that the live streams seem to be presented from any number of Azure IP address, and it doesn't even seem to be limited to a single azure data centre.

 

Ideally @tom_newton we could do with solving this behaviour on the load balancer, as having all of guardian limited to a single ISP is going to have serious impact, as would bypass huge amount of Azure.

 

- - - Updated - - -

 

It's frustrating when the expected workaround doesn't resolve the issue. Have you checked if there might be any specific port settings or network configurations needed for live streaming within Planet E-Stream that could be impacting the connection through Smoothwall? Sometimes, additional settings or adjustments might be required for the firewall rules or network settings that aren't immediately obvious.

 

Ive narrowed down the issues to our link load balancer. We have 3 ISP's presented to the smoothwall. If i bind all guardian traffic to a single ISP E-Stream Works. This would indicate that the smoothwall isn't binding all traffic for devices internally on the same ISP. The normal steps here would be to bypass the traffic in guardian and allow it straight out, adding an Link Load Balancing rule to force all the traffic down the same tunnel. The issue here is that the live streams seem to be presented from any number of Azure IP address, and it doesn't even seem to be limited to a single azure data centre.

 

Ideally @tom_newton we could do with solving this behaviour on the load balancer, as having all of guardian limited to a single ISP is going to have serious impact, as would bypass huge amount of Azure.

[tom_newton]

Seems like Harry has managed to pin just that IP for you. It's strange as LLB usually puts 1 client/server/port combo on one line, and fixes it there. Quite why this is misbehaving I dont know, but that fix will hold