Primus

Has anyone seen students using "Doge unblocker" proxy bypass sites that manage to get around Smoothwall Cloud Filter - we've had reports of links supplied as part of YouTube videos eg: @tom_newton

We're the same in terms of being invoiced by them in GBP - we purchased using the G Cloud framework as there was a substantial discount.

There's so many things it could be that us diagnosing it on here is going to be really difficult - have you tried Aruba support? Are you experienced with WiFi or is this the first time you've done anything like this?

Not a good idea - it sounds like you might want some more support with this - did you do the work yourself or pay a contractor?

Since with Chromebooks you push extensions to users rather than devices, but they do link to Google Classroom if that helps? You can assign user OUs into "rooms" but you can't say that Chromebook is always in room 52 for example.

We have taken the view - and had this supported by some consultancy we pay for in Safeguarding etc that if you are using our Internet connection you will go through our filter and we will not allow VPNs. For WiFi you need something like RADIUS or a captive portal as you must know who did what. In 2024 if you're not using MITM then you're blind to so much traffic. If you are a third party on our site and you are in an area of the building that does not have access to students and your company provide a dedicated connection for you use - eg. 4G hotspot then this is acceptable but running them through a VPN on our WiFi or even hard-wired is not since they would be using the school Internet connection and this requires filtering and monitoring.

Yes we apply HTTPS decryption to all devices using our connection. If a device cannot accept our certificate (usually because a user doesn't have admin priviliges) then it cannot use our WiFi. We handle onboarding by referring people to the internal Smoothwall page that has the certificate and instructions for each OS - we use a DNS redirect so that they just have to enter sw.co/getmitm and it takes them to the page they need. We will sometimes do the onboarding for people if they have issues following the instructions or they are VIPs such as Ofsted inspectors - we have found they often have a device from their school and so cannot use our WiFi because they cannot add the certificate but Ofsted supplies them with a 4G hotspot - truth be told Ofsted should really be supplying them with a device, they shouldn't be using their school device for Ofsted inspections IMHO. I think we're clutching at straws with the piggy backing comments. - - - Updated - - - If you allow and acccept VPN usage you have no idea what sites they're accessing and you have no control over it.

Good luck defending yourself when you've got an issue and you're deliberately not following DfE guidance/standards. Through a bit of engagement with Smoothwall we've had great success blocking VPNs on our guest network - I routinely test VPNs and I haven't been able to get any to connect in a long time now - as an aside when we were doing work on this it was several years ago and as a result of becoming aware of VPN usage by students on our WiFi to bypass our filters (something we now prevent entirely by not allowing them to use the WiFi). I was sitting in an office in one of our schools and finalising the settings etc. As I applied them I sat back and thought to myself "I wonder how long this will take to take effect", only to hear a student loudly shouting in the corridor "They've f-ing blocked our VPN!"

Yet by allowing this you are not following the standard which says: Your filtering system should be active, up to date and applied to all: school or college-managed devices, including those taken off-site unmanaged devices under a bring your own device (BYOD) scheme guests who have access to the school internet Because you are blind to their traffic you have no evidence to support the assertion that they won't compromise safeguarding.

Very true - that isn't how I read their posts however and also once you're aware that VPNs are working you ought to be doing something about it. It may be like whack-a-mole but that doesn't mean you give up.

From comments made on this thread it doesn't appear IMHO that the people concerned have taken reasonable steps - they appear to be aware of people using their WiFi with VPNs and are happy for them to do so.

Filtering is entirely bypassed if you allow them to use a VPN... - - - Updated - - - Not if you allow them to use a VPN.

Furthermore: Your filtering system should be active, up to date and applied to all: school or college-managed devices, including those taken off-site unmanaged devices under a bring your own device (BYOD) scheme guests who have access to the school internet

The standard specifically mentions blocking technologies such as VPNs that can be used to get around the filtering.

Given recent changes to DfE guidance to be more specific you may need to revisit this.

We wouldn't be doing that - I think it's still unclear as to whether that's legal isn't it?

They are meant to have NHS 4G hotspots they can use - not our problem. They've never not carried out vaccinations as a result.

We've withdrawn BYOD for students, we still allow it for staff and visitors but with a MITM certificate installed and VPNs blocked for everyone. This obviously causes problems where people don't have permission to add a certificate to a device and where staff require a VPN eg. our auditors or NHS nurses running vaccinations.

Is it worth flipping this back to the problem - have new users put onto the MIS by whoever is responsible for that and automatically sync against it for user creation and suspension?

Glad you're ok, I too have issues turning off and tend to be always connected/contactable but have recently begun to see how harmful it can be. Being able to switch off is vital and perfectly reasonable.

Does anyone have documentation confirming SCA can be spent on these items please?

If you set it to "Always show user names and photos" on the sign in screen and you also set "Do not erase local user data" that should do what you want.

👀 * Has a Bromcom email address * Has dozens of pages/blogs on Bromcom websites * Has been their "Marketing Manager" * Has been their "Product Owner for UI/UX" * Has worked on Bromcom stalls at Bett/London Acadmies etc 👀

Depends on how you interpret it - we have no need of stacking therefore it's appropriate that they're not.

On this, has anyone seen any work funded by DfE recently where they meet their own spec fully - I'm particularly thinking of diverse fibre routes?