Internal access to school website - DNS issue

[CHiLL]

We have recently been experiencing issues with accessing our website when connected to our internal network, but it seems inconsistent. Our website is hosted by E4Education (Juniper) and our DNS is handled by CloudFlare.

 

The website will not load on my desktop, a VM running on my desktop or on my colleagues desktop.

 

The website loads when using external connections, such as 4G.

The website loads when connected to our WiFi networks, including Guest, BYOD and 802.1x.

The website loads on a device connected on our main VLAN, which is the same VLAN that my and my colleague's desktops are on and the only difference IP/DNS wise between our desktops and the rest of the workstations is that we are using DHCP reservations.

 

In DNS, we have a scope defined as <website.lea.sch.uk>, with the following A records:

 

(same as parent folder) - Start of Authority - dc01.domain.local, hostmaster.domain.local - static

(same as parent folder) - Name Server (NS) - dc01.domain.local - static

(same as parent folder) - Name Server (NS) - dc012domain.local - static

(same as parent folder) - Host (A) - <IPv4 address as confirmed by Juniper> - static

autodiscover - Alias (CNAME) - autodiscover.outlook.com - static

www - Host(A) <IPv4 address as confirmed by Juniper> - static

 

When I attempt to access the website on my desktop, VM or colleague's desktop, we get an error message stating: 

Quote

403 Forbidden

Request forbidden by administrative rules.

 

I am currently at a loss as to what's happening.

Edited August 5, 2025 by CHiLL

[ThomL]

Initial thoughts:

Do you consistently get the same ip result across the different networks/devices when performing an NSlookup (via cmd) of the domain?

If you run a tracert (va cmd) from the various devices are the working devices and forbidden devices taking the same routes?

Are the forbidden devices being NAT'd in the same way as the working devices?

 

Last time I had this I was working at a school that was using SWGfL for internet connectivity, the school was using IP space dictated to them from when they were LEA and then the service that the school purchase from the LA once converted to an academy were blocking the traffic because it was seeing the traffic coming from an internal SWGfL range when it was expecting WAN traffic. Took way too much work to prove this and get the issue resolved.

 

I don't think this is a DNS issue - unless nslookup gives inconsistent results - it seems like you are getting to the server, it's just responding with the 403 http Error.

 

Edited August 5, 2025 by ThomL

[CHiLL]

2 minutes ago, ThomL said:

Initial thoughts:

Do you consistently get the same ip result across the different networks/devices when performing an NSlookup (via cmd) of the domain?

If you run a tracert (va cmd) from the various devices are the working devices and forbidden devices taking the same routes?

Are the forbidden devices being NAT'd in the same way as the working devices?

 

Last time I had this I was working at a school that was using SWGfL for internet connectivity, the school was using IP space dictated to them from when they were LEA and then the service that the school purchase from the LA once converted to an academy were blocking the traffic because it was seeing the traffic coming from an internal SWGfL range when it was expecting WAN traffic. Took way too much work to prove this and get the issue resolved.

 

nslookup on the working laptop and my desktop (both on the same VLAN) shows the same IP address.

Tracert on my desktop, where the website doesn't work goes through the VLAN gateway > Sophos firewall > ISP > does a couple more hops and then the hops time out

Tracert on the laptop, where the website does work, goes through the VLAN gateway > Sophos firewall and then all hops time out, including ones that my desktop got responses from.

As far as I am aware, in terms of the NAT is the same for both devices. There is a filter bypass in-place for our desktops on the Sophos, to exclude us from a lot of the web-filtering.

 

We have a vanilla network and we use Virgin Media for our Internet, which is administered by Wave9 (as well as the Sophos firewall).

[machy]

is it a Cloudflare 403 message or another one? 

 

[CHiLL]

Just now, machy said:

is it a Cloudflare 403 message or another one? 

 

There are no indicators to suggest it's CloudFlare, it's not their usual page. It's literally just:

<html><body><h1>403 Forbidden</h1>
Request forbidden by administrative rules.
</body></html>

 

[ThomL]

100% going to the same URL on both devices? Not hitting a slightly different url that's causing the error?

 

Can you switch the laptop to the proxy bypass and check if it still works?

 

[CHiLL]

1 hour ago, ThomL said:

100% going to the same URL on both devices? Not hitting a slightly different url that's causing the error?

 

Can you switch the laptop to the proxy bypass and check if it still works?

 

Yeah, it's definitely the same URL exactly. 

 

I added the IP address of my test laptop into the proxy bypass and it broke immediately, which suggests that it is a Sophos issue. I have raised a ticket with Wave9.

 

Thanks for your assistance @ThomL and @machy.

[ThomL]

s'all good - hopefully a quick resolution from Wave 9  

[glen_j]

We use juniper and have an Alias(Cname) record for www pointing to a fqdn of a host at e4education.co.uk this might be the missing part for you.

[CHiLL]

22 hours ago, glen_j said:

We use juniper and have an Alias(Cname) record for www pointing to a fqdn of a host at e4education.co.uk this might be the missing part for you.

It looks like it was this. Juniper got back to us and stated we need a CNAME record for www to point to the FQDN of the website host. I am not sure how it was working up until this point without the CNAME record - but it appears to be working now.

[ThomL]

That makes no sense -  not in the context of the website working on one device and not another, unless a browser or proxy server was stripping/adding 'www.' to the url when making the web request?