grant_girdwood

Hi bondbill, thanks for posting this I've added it to our URL dB which will be pushed out to everyone in the next update. There are also a couple of other URLs that are referenced which I've added aswell. Cheers, Grant

Hi RJK, I could be down to Microsoft responding to DNS queries using IPv6, if you raise a call with our support team they'll be able to sort this for you in no time cheers, Grant

Have you configured the SSL Intercept module on Bloxx - this will give you full HTTPS filtering.

Glad to hear the issue is resolved. The geeky part of me is intrigued as to what caused it so I'd like to know

Hi Smellbow, I hope all is well - it would really depend where the Bloxx appliance sits on your network and how it has been deployed (e.g. proxy only mode or in-line mode). Can you see traffic from the wireless network hitting the Bloxx appliance (e.g. does it show in reports/live-stats?). If it does then it would be a rule that has been created either via subnet or on a policy that has no filtering in place. It would probably be best if you gave our support team a call on 01506 425 465 or drop an email to [email protected] and we can walk through the setup with you. Cheers, Grant -=-=- Technical Service Manager Bloxx Ltd

We use Go Daddy for our wildcard cert, we also have a separate certificate for Exchange with Subject Alternative Names. However as of 2014/5 you will not be able to reference internal domains as a SAN, not sure what can be done after that time!

no worries

Throw this in your squid config acl CONNECT method CONNECT acl YT_accounts dstdomain .accounts.youtube.com acl YT dstdomain .youtube.com acl YT dstdomain .ytimg.com http_access allow CONNECT all YT_accounts http_access deny CONNECT all YT

Here, here! 100,000th milestone for internet charity

wlxrs.com gfx.ms login.live.com shared.live.com imp.live.com imp.microsoft.com account.live.com c.live.com mail.live.com afx.ms p.s. Hotmail used to present attachments via IP addresses which may of changed or could of been ported across to Outlook - if you block IP address based URLs this would stop this. GLHF!

Hi, AFAIK there is not really an easy way to this unfortunately. Our method is to install the certs you require, backup the cert8.db file and push this out using logon scripts. Cheers and good luck! Grant

Yup but you'd want to allow the text but deny the site translations? e.g. The following allows kids to circumvent a block if one existed on edugeek.net http://translate.google.com/translate?hl=en&sl=af&tl=en&u=www.edugeek.net

One of the first ports of calls for kids when it is allowed. However there are ways to allow the text based translation but still block the page translation with Bloxx

Have you tried denying access to HTTPS and forcing them to go through the HTTP side of Google? You'll need to create a CNAME entry for Google to redirect to nosslsearch.google.com Google SafeSearch and SSL Search for Schools - Web Search Help

Your ICAP settings shouldn't prompt you for authentication - you can modify your authentication prompt to display a specific message - may be an idea to change that (cannot remember where the option is but a quick google will help) this would help you identify if the prompt is definitely coming from your proxy. I usually have my authentication options before my ICAP settings so you could juggle them around. What does your whitelist.txt file now read? You could also try quickly creating your own bypass ACL for a test site and pop it before the ICAP options. e.g. acl authbypass_test dstdomain .microsoft.com http_access allow authbypass_test

If it is something to do with the filtering by your LEA try running the upload using browser development tools and taking a network capture (F12 in IE, CTRL + SHIFT + I in Chrome) and look at the network components which will show each request and the HTTP response code (there could be something in the back-end that is being blocked) Also try running a Wireshark network capture and interrogate this to see if there is a sub-component being blocked which may cause this error. Cheers!

# added by adrian to bypass auth on certain domains acl whitelist dstdomain "/etc/squid/whitelist.txt" http_access allow all whitelist Should read # added by adrian to bypass auth on certain domains acl whitelist dstdomain "/etc/squid/whitelist.txt" http_access allow whitelist

Bypass authentication only applies to domains not URLs. .domain.com should be the syntax you are using. Have a wee read here: ConfigExamples/Authenticate/Bypass - Squid Web Proxy Wiki

Hi guys, I'm one of the technical consultants at Bloxx. Sorry to hear you have been experiencing issues with your new appliances, can you send me a PM with your details so I can investigate this further for you and get back to you to resolve any issues you've been experiencing. Thanks, Grant

Check your windows DNS server - as a security issue a WPAD entry in DNS was blocked by microsoft however there is a work around provided by MS

Hi Abbadon, you'll probably be running NTLM authentication which is a seamless windows protocol which will work for domain joined machines. Cheers, Grant

Hi Scholes99, The sendlogon method of identifying users will only run when the user logs on as it runs as part of your logon script. If a client moves from say wired to wireless, the IP address of the client has changed. Bloxx will not be notified of this unless the user either logs of and back on or runs the batch script manually. However, There are other methods of identifying users web requests - one method is by using the Bloxx AD Logger, it works in the same premise of IP based identification however it sits centrally on your domain controllers. Ultimately it monitors your DC for certain success events (e.g. when a user logs on or accesses a network drive) and the AD Logger notifies Bloxx that User X now has IP address Y. There are other methods of identifying users to Bloxx - I'd suggest you give us a call on 01506 425 265 or drop an email to [email protected] so one of our support engineers can walk through all the options available to you and assist you in implementing the solution that fits your organisation. Cheers, Grant

You're best bet would be to deploy using the Google MSI - Google reads a lot of configuration from the system as opposed to the likes of firefox which uses its own configuration settings.

Let me google that for you <---- Click Me You basically need to deploy it via GPO in to the Trusted Root Certificate Store

test it against megaproxylist.com