Smoothwall blocking access to Arbor MIS

[toffee_paul]

Is anyone else experiencing an issue whereby Arbor is inaccessible due to Smoothwall blocking it?

 

I've narrowed this down to a JavaScript library (ravenjs.com) that Arbor use and which is loaded from cdn.ravenjs.com when our Arbor site is accessed.

We have a category named 'App - Arbor' containing all the recommended URLs Arbor say should be whitelisted.  This has been added to a web filtering policy and set it to ‘Do Not Filter’.  Also added a HTTPS Inspection Policy and set that to 'Do Not Inspect'.

 

Arbor have told me they have multiple customers affected by this and the common denominator is that all are using Smoothwall.

 

We have a ticket open with Smoothwall but they haven't responded since Thursday.

 

Access to our Arbor site works perfectly when:

- accessed from a mobile device using a mobile data connection.
- when I add the IP address to Web Filter > Exceptions page thereby giving unfiltered access to the internet.

 

I can't be giving unfiltered access to the internet to staff for obvious reasons.

 

Arbor have told me that another school who raised a ticket with them for the same problem had a Smoothwall engineer tell them they're blocking an IP address because they see it as malicious.  I've not been able to get a response from Smoothwall to my ticket and my account manager is on annual leave so we are stuck with no access to Arbor and an inability to send comms to parents.

[MrEprise]

Not Arbor in our case, but we did recently have an issue with Calendly being blocked by Smoothwall. I also tracked it down to a JavaScript library commonly used by Porn sites (including Child Porn sites worryingly) which was subsequently being blocked under the Child Porn category

The fix for me in the end was to add the JS library to an Allow category above the one blocking the JS library in the policies list and applying the category to Staff only.
 

[simpsonj]

Can you locate the IP address using the Web Developer tools in the browser? My peronal preference for this is Firefox - More Tools - Web Developer Tools - Network this should highligh the web pages that are accessible and those that are being blocked.

 

Once located, you could put the IP address into the Smoothwall under Web filter - Exceptions - Detination Exceptions, or create a rule as @MrEprise mentions.

[5nowman]

1 hour ago, toffee_paul said:

Is anyone else experiencing an issue whereby Arbor is inaccessible due to Smoothwall blocking it?

 

I've narrowed this down to a JavaScript library (ravenjs.com) that Arbor use and which is loaded from cdn.ravenjs.com when our Arbor site is accessed.

We have a category named 'App - Arbor' containing all the recommended URLs Arbor say should be whitelisted.  This has been added to a web filtering policy and set it to ‘Do Not Filter’.  Also added a HTTPS Inspection Policy and set that to 'Do Not Inspect'.

 

Arbor have told me they have multiple customers affected by this and the common denominator is that all are using Smoothwall.

 

We have a ticket open with Smoothwall but they haven't responded since Thursday.

 

Access to our Arbor site works perfectly when:

- accessed from a mobile device using a mobile data connection.
- when I add the IP address to Web Filter > Exceptions page thereby giving unfiltered access to the internet.

 

I can't be giving unfiltered access to the internet to staff for obvious reasons.

 

Arbor have told me that another school who raised a ticket with them for the same problem had a Smoothwall engineer tell them they're blocking an IP address because they see it as malicious.  I've not been able to get a response from Smoothwall to my ticket and my account manager is on annual leave so we are stuck with no access to Arbor and an inability to send comms to parents.

 

This sounds soo much like the issue I am having with a different resource. Did your issue start last week?

 

"JavaScript library (ravenjs.com)"  how do you know that arbor uses this? How do I find out what the site I am using uses?

 

The problem I am having is the site I am on is very very slow and timeouts. Smoothwall too.

 

[tom_newton]

DM me some ticket numbers and I will make sure they're looked at together

[tom_newton]

Just fired ravenjs (root domain and their minimised js file) through smoothwall on-prem and there's no block, so may be a red herring

[toffee_paul]

@5nowman Use Developer Tools and you'll see that it reaches out to various sites and pulls things in. In the case of Arbor they use the JavaScript library at ravenjs.com.

 

@simpsonj I'm on Edge (chromium) and I can only see the domain, not an IP address.  This is what it tries to load: https://cdn.ravenjs.com/3.16.1/raven.min.js

 @tom_newton Arbor have told me four customer have reported the same issue occurring at the same time.  Maybe it's something unique to the on-prem config of all five schools then? All I know if our web policies haven't changed in quite a while, and we can get to Arbor when bypassing the Smoothwall.

 

[toffee_paul]

Some screenshots attached.

I tried adding the IP address that's returned when pinging cdn.ravenjs.com to Destination exceptions on the Smoothwall but it didn't make a difference.

[andy_b]

We had exactly the same kind of problem a while back (not with smoothwall).  Turns out a blocklist in Adguard was stopping cdn.ravenjs.com so we had to allow list it.

 

( HaGeZi's Pro Blocklist)

Edited May 18 by andy_b

[SeeFights]

Hi guys

 

i do not think this is a smoothwall issue. We have the same issue (arbor trying to access https://cdn.ravenjs.com/3.16.1/raven.min.js) and on affected devices it returns a 403 (FORBIDDEN) error.

The reason we dont think this is smoothwall issue is even connected to a wifi that goes straight out it still happens.

[toffee_paul]

@andy_b  Thanks Andy but we're not using any ad-blocking extensions.

 

@SeeFights I'm struggling to think it's NOT a Smoothwall issue to be honest. The fact other Arbor customers have the same issue and they're all on Smoothwall is the primary reason, along with the fact that if I add the IP of an affected device to The Web Filter > Exceptions page it loads Arbor no problem.

[SeeFights]

@toffee_pauli didnt think of adding the devices IP to Smoothwall as when we turned our smoothwall off (on the device) it still didnt load.

 

gonna shove a pencil up my nose and bang my desk real quick this is annoying

[5nowman]

5 minutes ago, SeeFights said:

@toffee_pauli didnt think of adding the devices IP to Smoothwall as when we turned our smoothwall off (on the device) it still didnt load.

 

gonna shove a pencil up my nose and bang my desk real quick this is annoying

does smoothwall show any issue  with that site? 

 

 

Exception turned off, rules set to allow all traffic from a local ip and the website (not the one here) is SLLOOOOOOWWWWW

 

to make things worse OFSTED is SOON!!! 

[SeeFights]

Just now, 5nowman said:

does smoothwall show any issue  with that site? 

 

 

Exception turned off, rules set to allow all traffic from a local ip and the website (not the one here) is SLLOOOOOOWWWWW

 

to make things worse OFSTED is SOON!!! 

 

39 minutes ago, toffee_paul said:

Some screenshots attached.

I tried adding the IP address that's returned when pinging cdn.ravenjs.com to Destination exceptions on the Smoothwall but it didn't make a difference.

well i followed the above actions policy testing it and i got the same thing "dns lookup failed"

[toffee_paul]

@SeeFights  Try adding the IP of an affected device Guardian > Web Filter > Exceptions page and leaving it a minute or two for it to take effect.

 

Adding IP an exception - site loads fine.. removing the IP and doing a hard refresh (Ctrl+Shift+R) and it's blocked again.

Hard refresh forces it to go out and load the JavaScript from the site, and not use a locally cached copy.

 

What's equally frustrating for me is trying to get a response to my ticket.  I was asked by the second line support manager for details which I replied back to within a couple of hours and I've heard diddly squat back since then.  Even contacted our account manager last week too to see if they could give it a push along and got no response. Really disappointing. Just need someone to remote on and take a look.

[SeeFights]

Just now, toffee_paul said:

@SeeFights  Try adding the IP of an affected device Guardian > Web Filter > Exceptions page and leaving it a minute or two for it to take effect.

 

Adding IP an exception - site loads fine.. removing the IP and doing a hard refresh (Ctrl+Shift+R) and it's blocked again.

Hard refresh forces it to go out and load the JavaScript from the site, and not use a locally cached copy.

 

What's equally frustrating for me is trying to get a response to my ticket.  I was asked by the second line support manager for details which I replied back to within a couple of hours and I've heard diddly squat back since then.  Even contacted our account manager last week too to see if they could give it a push along and got no response. Really disappointing. Just need someone to remote on and take a look.

hey im just defending smoothwall but not trying to start an argument, if you are being affected and im being affected and according to other posts 5 other schools are being affected that 7 schools. 7 IT technicians reporting the same issue. they could be rammed right now regarding other websites using this raven js crap. give Smoothwall a second and they will get round to you and if staff are up your arse about it, lock ya office door, take 10 mins and come back or send a school wide email explaining you are actively investigating.

[SeeFights]

10 minutes ago, toffee_paul said:

@SeeFights  Try adding the IP of an affected device Guardian > Web Filter > Exceptions page and leaving it a minute or two for it to take effect.

 

Adding IP an exception - site loads fine.. removing the IP and doing a hard refresh (Ctrl+Shift+R) and it's blocked again.

Hard refresh forces it to go out and load the JavaScript from the site, and not use a locally cached copy.

 

What's equally frustrating for me is trying to get a response to my ticket.  I was asked by the second line support manager for details which I replied back to within a couple of hours and I've heard diddly squat back since then.  Even contacted our account manager last week too to see if they could give it a push along and got no response. Really disappointing. Just need someone to remote on and take a look.

I have submitted my own ticket with the following

"Hi

as the title describes Arbor is trying to access https://cdn.ravenjs.com/3.16.1/raven.min.js however on some devices it times out and i get a 403. Apparently this is affecting other schools too, see here; https://www.edugeek.net/forums/topic/226544-smoothwall-blocking-access-to-arbor-mis/

I have tried the following;

• reinstalling chrome
• deleting cookies and browsing data
• hard restarting Arbor (CTRL + SHIFT + R)
• i have tried on a different wifi network
• i have tried with the smoothwall proxy off

when you test the revenjs url in Smoothwalls policy tester it returns a bad dns lookup failed error."

 

[5nowman]

 

13 minutes ago, SeeFights said:

I have submitted my own ticket with the following

"Hi

as the title describes Arbor is trying to access https://cdn.ravenjs.com/3.16.1/raven.min.js however on some devices it times out and i get a 403. Apparently this is affecting other schools too, see here; https://www.edugeek.net/forums/topic/226544-smoothwall-blocking-access-to-arbor-mis/

I have tried the following;

• reinstalling chrome
• deleting cookies and browsing data
• hard restarting Arbor (CTRL + SHIFT + R)
• i have tried on a different wifi network
• i have tried with the smoothwall proxy off

when you test the revenjs url in Smoothwalls policy tester it returns a bad dns lookup failed error."

 

ok forget this.. here are the errors I get... you can see the name of the site and what we are accessing.

 

It looks very similar except it does not link to raven....

 

 

[SeeFights]

@5nowmanSmoothwall have obviously updated something and its broken some JS scripts.

[toffee_paul]

Out of interest what ISP are you both using?

[SeeFights]

1 minute ago, toffee_paul said:

Out of interest what ISP are you both using?

virgin with a i think bt backup

[5nowman]

Just now, toffee_paul said:

Out of interest what ISP are you both using?

BT Fibre.

[5nowman]

@tom_newton If you can disclose... are there issues with smoothwall and JS at the moment?

This should help alot if you can confirm that is something you are currently looking into.

 

My ISP has logged a ticket for my school.

[robintech]

I'm getting the same issue with our  Freshdesk.com subdomains in the last hour or so , works for www.freshdesk.com , if I put my IP in exceptions it loads fine

Smoothwall Web filter report shows a 503 response code in the logs

 

Edge says connection closed

 

Firefox says

Secure Connection Failed

An error occurred during a connection to subdomain.freshdesk.com. PR_END_OF_FILE_ERROR

Error code: PR_END_OF_FILE_ERROR

 

ISP is Syntura

 

 

 

 

[toffee_paul]

Following a call with Smoothwall they believe it to be an issue with DNS. Upon changing the DNS forwarders to Google's (8.8.8.8 / 8.8.4.4) on our on-prem appliance, access to Arbor is now working fine.

 

May be worth changing yours temporarily and see if it makes a difference.  @5nowman you mentioned you're on BT Fibre so maybe your issue is different as you mentioned slowness rather than an out-and-out inability the resource itself.

 

Thanks to Alan @ Smoothwall for highlighting this.