Using Android Mobiles with Netsweeper

[Jobos]

We have a bought a new android mobile but we are having problems keeping it connected to the wifi. Each time we connect the mobile it says unable to access the internet. The mobile has a dhcp reservation and it has been assigned to the staff Netsweeper policy but nothing is being listed as blocked in the logs. Does android need any firewall ports opening as I'm guessing the logs I am looking at only cover http and https filter?

[Oaktech]

I suspect you will need to open up unfiltered the Google connectivity checks ports and URLs...

 

https://support.google.com/work/android/answer/10513641?hl=en

[Jobos]

I suspect you will need to open up unfiltered the Google connectivity checks ports and URLs...

 

https://support.google.com/work/android/answer/10513641?hl=en

 

Thanks, I see how it goes.

[CyBeRkId2002]

I was actually just going to post a very similar question - but thought I may as well tag on here.

 

Has anyone managed to get Android devices working without the 'No Internet / Limited Connectivity' warnings whilst retaining SSL Inspection. I am starting to think it is impossible. So far I have:

 

* Tried adding connectivitycheck.gstatic.com to our SSL Exceptions

* Tried adding https://www.google.com/generate_204 to SSL Exceptions (although I can't be 100% certain this is working correctly)

 

I strongly expect that Google is making a request to Google and using certificate pinning. As such I think it is impossible to not get this message - although would love to hear if others have got this working!

 

If not I suppose our only options (particularly for BYOD devices are):

 

* Not decrypt Google (and in turn not see search activity which I feel is a major safeguarding risk)

* Advise pupils to click 'Stay connected' and carry on about their business. Not ideal, and something I would like to avoid, but better than not monitoring sufficiently

[Jobos]

I too have added connectivitycheck.android.com, connectivitycheck.gstatic.com and https://www.google.com/generate_204 to the filter exceptions but still getting the no internet message.

 

Reading through the link that @Oaktech kindly posted I see references to FCM and needed open ports. Has anyone had success after opening them namely ports 5228-5230?

 

https://firebase.google.com/docs/cloud-messaging/concept-options#messaging-ports-and-your-firewall

[PaddyNewman]

They are the standard ports for Google push, unlikely have bearing on the 'internet' side but worth opening to the Google endpoints however.. counterproductive but exclude

www.Google.Com

From your decrypt, against this one device to test. Android is built on Google,

www.google.com

is pinned in that OS, best of luck and sorry for badly formatted post. It kept hyperlinking

Edited December 4, 2024 by PaddyNewman

[CyBeRkId2002]

With Google excluded it works - but like I say this is best avoided if possible. I am, however, starting to think it is impossible unless anyone can advise otherwise.

[PaddyNewman]

I imagine its an uphill and quite unwinnable battle with pinning.

 

I think, and I'll have to test, a hardcoded proxy is fine, but transparent is just a no. I mean, Google is Google, you will conform etc, super power of the internet and all that jazz. It's incredibly annoying from an ISP side that really wants to push decryption though so I feel your pain!

[ab79]

A compromise could be to setup the below in DNS to force "safe search" in google so you can "decrypt" Google

 

1. Add a new CNAME record on your local DNS server for your local Google domain(s) pointing to forcesafesearch.google.com. For this example, we will be using www.google.com. Create a CNAME record for www.google.com that points to forcesafesearch.google.com.

2. Clear your DNS cache of the saved www.google.com record.

3. Make a new search and you should be prompted that SafeSearch is enabled. As long as this CNAME record is in place, SafeSearch will be enforced on the network.

 

[CyBeRkId2002]

oooo. That is clever! My only question - if Android does check Google at connection (as I suspect) would the new flow not be as below:

 

Android Connects to Network -> Android Checks in with Google -> Request gets re-routed to forcesafesearch.google.com -> Response comes from forcesafesearch.google.com -> Android checks cert

 

Whilst this will match, I will still need to disable SSL on forcesafesearch will I not for it to skip the MitM, which goes back to the original issue.