Youtube restriction by channel - sort of works

Hi,

please change you Source to LAN and Network to the IP address range of the network your children's devices connect to? Also tick logging and is the rule at the top of your  firewall list?

Ian

Hi Ian

Change source to LAN and network to kids device subnet but still allowing it through if you hit retry a number of times.

thx

David

Hi,

thank you for the update. After you made the changes did the kid's devices perform a restart or were they still connected? Another change is to reduce the port range to http and https because any will allow the devices to access ports outside to the proxy controlled ports.  Also you might try restarting the XG.

After the above please post a copy of the updated firewall rule and the log entries showing the rule in use.

Ian

Hi

No device restart but i did close my browser and restart it.

here are some extra observation 

It is hitting quota /video host web rule   which should stop the load

but if I look at Chrome in developer mode the URL is getting through

I already restrict service to https only

and traffic is hitting that firewall rule

thx

David

Hi.

thank you for the update. Please post the bottom half of that rule.
ian

Hi,

in your policy you have a number of items with v=, what does the v= do, it is not part of the url?
ian

Hi Ian

This is the bottom half of the rule

As to V=? that is the permitted channel the kids can watch without any quota

only youtube matching the keyword should be allowed through

but as you can see from previous post, the keyword filter works (sort of) as you get the "connect retry" message but if you hit the refresh enough time chrome somehow bypass the keyword filter and loads up youtube homepage or a video not in the keyword list

thx
David

Hi David,

You need tick the other boxes in the web proxy. Also the v= is in a string field where the string is referenced against the url, v= is not part of the url. Do you have IPS enabled using LAN to WAN and application to allow all.

The retry succeeds because the browser has found a path to the sites through another rule. Other rules that the kids use need to have a block function for the web sites enabled.

The decrypt  https only works if you have installed the XG CA on the chrome books.

Ian

Please read this KBA.

https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/121482/sophos-firewall-https-decrypt-and-scan-faq

Ian

I have disable all other rules except allow youtube

enable all ticks in the web filtering option

Yes i have the man in the middle Cert working

so now that i have disabled all the rule except youtube allow

nothing goes through, youtubei and allowed keyword in test show it goes through right policy

but in reality is block by a quota rule which should not happen 

Hi David,

youtube is also an application, you will need to enable Application - ALLOW ALL, then create an application file for YouTube. Then change the ALLOW ALL to your application filter policy.

Where is your quota setup and how is it applied, looks like to all?

Ian