This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Master List of Web Exceptions

Many Greetings!
I have gathered and put together working HTTP/S proxy rule sets for allowing many different online services to function without the need for port forwarding, provided that you've setup the firewall to allow all outgoing connections on both your 'Internal' and IPv6 Broker interfaces.
Web Protection -> Web Filtering -> Exceptions
For each of these, I have the following setup with these specific exceptions (skips, generally everything except Caching and Logging):

Authentication / Block by download size / Antivirus / Extension blocking / MIME type blocking / URL Filter / Content Removal / SSL scanning / Certificate Trust Check / Certificate Date Check / Do not display Download/Scan progress page

These are for online gaming services and even HTTPS services (where the client may throw SSL certificate errors due to it not obeying trusted root certificate on the system)... So far, they all work for me with no errors since I've created these proxy rule-sets. I hope they will become of use to even you.
If you have any that you have created for services not listed, please post it and I will include it in the post below!

This thread was automatically locked due to age.

Parents

Linkz0rs over 13 years ago
This post will be updated when new working rule sets are discovered

Here's what I have so far...

Nintendo Network (Wii U & 3DS)
^https?://portal-us\.olv\.nintendo\.net/
^https?://nintendojp\.d1\.sc\.omtrdc\.net/
^https?://account\.nintendo\.net/
^https?://discovery\.olv\.nintendo\.net/
^https?://api-us\.olv\.nintendo\.net/
^https?://ninja\.wup\.shop\.nintendo\.net/
^https?://geisha-wup\.cdn\.nintendo\.net/
^https?://ias\.wup\.shop\.nintendo\.net/
^https?://nus\.wup\.shop\.nintendo\.net/
^https?://samurai-wup\.cdn\.nintendo\.net/
^https?://idbe-wup\.cdn\.nintendo\.net/
^https?://pushmore\.wup\.shop\.nintendo\.net/
^https?://ecs\.wup\.shop\.nintendo\.net/
^https?://olvus\.cdn\.nintendo\.net/
^https?://mii-secure.account\.nintendo\.net/
^https?://npvk\.app\.nintendo\.net/
^https?://ccs\.wup\.shop\.nintendo\.net/
^https?://nppl\.app\.nintendo\.net/
^https?://mii-images\.account\.nintendo\.net/
^https?://tagaya\.wup\.shop\.nintendo\.net/
^https?://pls\.wup\.shop\.nintendo\.net/
^https?://npts\.app\.nintendo\.net/
^https?://mii-secure\.cdn\.nintendo\.net/
^https?://samurai\.wup\.shop\.nintendo\.net/
^https?://web-us\.l1\.us\.vino\.wup\.app\.nintendo\.net/
^https?://tvii-prod\.l1\.us\.vino\.wup\.app\.nintendo\.net/
^https?://tagaya-wup\.cdn\.nintendo\.net/
https://54.236.89.112/
https://54.236.187.223/
https://54.236.167.22/
^https?://d1eqyqhzpk1v17\.cloudfront\.net/
^https?://cdn\.mxpnl\.com/
^https?://api\.mixpanel\.com/

These domains were grabbed while playing on the WiiU console. Did multiple tests, opened different games and applications and even installed a system update.
Cloudfront and Mixpanel urls are used in the Nintendo TVii application and are (unfortunately) required for it to function.

Minecraft (Only what's necessary for playing the game)
https://authserver.mojang.com/
https://libraries.minecraft.net/
https://sessionserver.mojang.com/
https://s3.amazonaws.com/
AmazonAWS is used for updating the Minecraft launcher and unfortunately is required for the game to retrieve updates.

World of Warcraft:
^https?://([A-Za-z0-9.-]*\.)?worldofwarcraft\.com\.edgesuite\.net/
^https?://([A-Za-z0-9.-]*\.)?blizzard\.com/
^https?://([A-Za-z0-9.-]*\.)?blizzard\.vo\.llnwd\.net/
^https?://([A-Za-z0-9.-]*\.)?blizzard.com\.edgesuite\.net/
^https?://([A-Za-z0-9.-]*\.)?battle\.net/
With these in place, WoW works without any problems, the patcher, actual game, and even a 'vent' server.

MSN/Win. Live Messenger:
^https?://([A-Za-z0-9.-]*\.)?wlxrs\.com/
^https?://([A-Za-z0-9.-]*\.)?messenger\.hotmail\.com/
^https?://([A-Za-z0-9.-]*\.)?messenger\.live\.com/
^https?://([A-Za-z0-9.-]*\.)?login\.live\.com/
^https?://([A-Za-z0-9.-]*\.)?contacts\.msn\.com/
^https?://([A-Za-z0-9.-]*\.)?storage\.msn\.com/
^https?://207\.46\.125\.29:*
^https?://207\.46\.124\.144:*
^https?://64\.4\.35\.57:*
^https?://65\.54\.*\.*:*
I've obtained these recorded from Proxy logs, so I don't know if I'm missing anything or not... But MSN/Win. Live Messenger does work.

Skype:
^https?://204\.9\.163\.181:*
^https?://78\.141\.177\.124:*
Skype seems to work just fine without these, but they did come up in the logs [as soon as I logged into Skype] with the error "Failed to verify server certificate"... So I added them as an exception... I did a who-is on them, and they are owned by Skype.

Playstation Network (PSN):
^https?://([A-Za-z0-9.-]*\.)?playstation\.com/
^https?://([A-Za-z0-9.-]*\.)?playstation\.net/
^https?://([A-Za-z0-9.-]*\.)?playstation\.org/
^https?://125\.199\.254\.51
^https?://198\.107\.*\.*
^https?://184\.84\.65\.*
^https?://173\.230\.216\.*
^https?://50\.19\.100\.125
^https?://209\.251\.*\.*
I've obtained these from proxy logs, and now PSN works without error... I've tested CoD: Black Ops, and Red Faction: Armageddon online with them. I have also downloaded updates, and even game demos under these rule sets without error.

TwitchTV:
https://199\.9\.[0-9][0-9][0-9]\.[0-9][0-9][0-9]/
https://199\.9\.[0-9][0-9][0-9]\.[0-9][0-9]/
https://199\.9\.[0-9][0-9]\.[0-9][0-9][0-9]/
https://199\.9\.[0-9][0-9]\.[0-9][0-9]/
This fixes the chat in TwitchTV when using SSL Scanning.

Various Google services (Google+, Google Music, Google Voice, etc):
^https?://173\.194\.*\.*
^https?://74\.125\.*\.*
^https?://([A-Za-z0-9.-]*\.)?google\.com/
^https?://([A-Za-z0-9.-]*\.)?googleusercontent\.com/
Google+ and Google Music seem to have problems loading with HTTPS scanning enabled, so this fixed many of the issues caused by it.
Please note that you may need to add these to the Proxy Transparent Mode Exceptions list... Due to some issues that standard exceptions cannot fix. Just in case
74.125.226.0/24
74.125.91.0/24

TomTom GPS 'Home' App:
^https?://([A-Za-z0-9.-]*\.)?tomtom\.com/
^https?://85\.90\.*\.*
These will allow TomTom Home to connect, and download map updates and the like without errors.

PlayerIO Games:
https://98\.137\.[0-9][0-9][0-9]\.[0-9][0-9][0-9]/
https://98\.139\.[0-9][0-9][0-9]\.[0-9][0-9][0-9]/
https://98\.137\.[0-9][0-9][0-9]\.[0-9][0-9]/
https://98\.139\.[0-9][0-9][0-9]\.[0-9][0-9]/
https://98\.138\.[0-9][0-9][0-9]\.[0-9][0-9][0-9]/
https://98\.138\.[0-9][0-9][0-9]\.[0-9][0-9]/
PlayerIO is a gaming service that hosts flash-based game servers.

Raxco Perfect Disk:
^https?://([A-Za-z0-9.-]*\.)?raxco\.com/
This should allow Perfect Disk to retrieve updates without any issues.

Netflix:
^https?://([A-Za-z0-9.-]*\.)?nflximg\.com\.?/
^https?://([A-Za-z0-9.-]*\.)?nflxvideo\.net\.?/
^https?://([A-Za-z0-9.-]*\.)?netflix\.com/
^https?://[\d+(\.\d+){3}/]*/[0-9]{8}\.ism
^https?://[\d+(\.\d+){3}/]*/[0-9]{9}\.ism
^https?://[\d+(\.\d+){3}/]*/[0-9]{10}\.ism
^https?://([A-Za-z0-9.-]*\.)?netflix-*.vo.llnwd.net/.*
^https?://secure\.netflix\.com/*
^https?://uiboot\.netflix\.com/*
^https?://nintendo.nccp.netflix.com/
^https?://customerevents.netflix.com/
^https?://api-global.netflix.com/
^https?://([A-Za-z0-9.-]*\.)?nflxvideo.net/
^https?://ipv6_1.lagg0.c[0-9]{1,3}.[A-Za-z][A-Za-z][A-Za-z][0-9]{1,3}.ix.nflxvideo.net/
^https?://([A-Za-z0-9.-]*\.)?nflximg\.net\.?/
^https?://cdn[0-9].nflximg.com/
^https?://cdn[0-9].nflximg.net/
^https?://108.175.[0-9]{1,3}.[0-9]{1,3}/\?o=([A-Za-z0-9.-]*\.)?

Also, add another "OR" to that rule for 'Coming from these User Agents':
Mozilla/5.0 (compatible; U; Nflx) Netflix/[0-9].[0-9].[0-9]
Gibbon/[0-9]{1,4}.[0-9]{1,4}.[0-9]{1,4}/[0-9]{1,4}.[0-9]{1,4}.[0-9]{1,4}: Netflix/[0-9]{1,4}.[0-9]{1,4}.[0-9]{1,4} (DEVTYPE=NFX[0-9]{1,4}-[0-9]{1,4}-; CERTVER=[0-9]{1,4})
Netflix seems to work perfectly with all of these exceptions in place.

Youtube:
https://www\.youtube\.com/
https://www\.youtube-nocookie\.com/
^https?://[A-Za-z0-9.-]*\.ytimg\.com/
^https?://[A-Za-z0-9.-]*\.youtube\.com/
^https?://[A-Za-z0-9.-]*\.ggpht.com/
https://www\.googleapis\.com/
Youtube app on consoles will NOT work without these exceptions, while https scanning is enabled. These rules will fix that.

Steam Gaming:
^https?://(?:\d{1,3}\.){3}\d{1,3}/depot/571/
Microsoft/Windows Update:
^https?://([A-Za-z0-9.-]*\.)?windowsupdate\.com/
^https?://([A-Za-z0-9.-]*\.)?microsoft\.com/
^https?://64\.4\.18\.19
^https?://157\.56\.134\.97
I know there's already built-in exceptions for this, but the 2 IP addresses listed fixes occasional issues with checking for updates while HTTPS (SSL) Scanning is enabled.

Facebook:
^https?://173\.252\.110\.27
^https?://31\.13\.77\.42
^https?://66\.220\.152\.19
^https?://173\.252\.100\.27
Facebook with HTTPS (SSL) Scanning enabled occasionally throws errors in logs and some pages on Facebook is un-viewable, these IP addresses should fix the issues.

----
If anyone else has any other addresses or rules to add that helps unblock these, please post them! I would be interested to see what anybody else might have [:)]
Or if I'm missing anything, please post!

Thanks!
Cancel
Vote Up 0 Vote Down

Cancel

Reply

Linkz0rs over 13 years ago
This post will be updated when new working rule sets are discovered

Here's what I have so far...

Nintendo Network (Wii U & 3DS)
^https?://portal-us\.olv\.nintendo\.net/
^https?://nintendojp\.d1\.sc\.omtrdc\.net/
^https?://account\.nintendo\.net/
^https?://discovery\.olv\.nintendo\.net/
^https?://api-us\.olv\.nintendo\.net/
^https?://ninja\.wup\.shop\.nintendo\.net/
^https?://geisha-wup\.cdn\.nintendo\.net/
^https?://ias\.wup\.shop\.nintendo\.net/
^https?://nus\.wup\.shop\.nintendo\.net/
^https?://samurai-wup\.cdn\.nintendo\.net/
^https?://idbe-wup\.cdn\.nintendo\.net/
^https?://pushmore\.wup\.shop\.nintendo\.net/
^https?://ecs\.wup\.shop\.nintendo\.net/
^https?://olvus\.cdn\.nintendo\.net/
^https?://mii-secure.account\.nintendo\.net/
^https?://npvk\.app\.nintendo\.net/
^https?://ccs\.wup\.shop\.nintendo\.net/
^https?://nppl\.app\.nintendo\.net/
^https?://mii-images\.account\.nintendo\.net/
^https?://tagaya\.wup\.shop\.nintendo\.net/
^https?://pls\.wup\.shop\.nintendo\.net/
^https?://npts\.app\.nintendo\.net/
^https?://mii-secure\.cdn\.nintendo\.net/
^https?://samurai\.wup\.shop\.nintendo\.net/
^https?://web-us\.l1\.us\.vino\.wup\.app\.nintendo\.net/
^https?://tvii-prod\.l1\.us\.vino\.wup\.app\.nintendo\.net/
^https?://tagaya-wup\.cdn\.nintendo\.net/
https://54.236.89.112/
https://54.236.187.223/
https://54.236.167.22/
^https?://d1eqyqhzpk1v17\.cloudfront\.net/
^https?://cdn\.mxpnl\.com/
^https?://api\.mixpanel\.com/

These domains were grabbed while playing on the WiiU console. Did multiple tests, opened different games and applications and even installed a system update.
Cloudfront and Mixpanel urls are used in the Nintendo TVii application and are (unfortunately) required for it to function.

Minecraft (Only what's necessary for playing the game)
https://authserver.mojang.com/
https://libraries.minecraft.net/
https://sessionserver.mojang.com/
https://s3.amazonaws.com/
AmazonAWS is used for updating the Minecraft launcher and unfortunately is required for the game to retrieve updates.

World of Warcraft:
^https?://([A-Za-z0-9.-]*\.)?worldofwarcraft\.com\.edgesuite\.net/
^https?://([A-Za-z0-9.-]*\.)?blizzard\.com/
^https?://([A-Za-z0-9.-]*\.)?blizzard\.vo\.llnwd\.net/
^https?://([A-Za-z0-9.-]*\.)?blizzard.com\.edgesuite\.net/
^https?://([A-Za-z0-9.-]*\.)?battle\.net/
With these in place, WoW works without any problems, the patcher, actual game, and even a 'vent' server.

MSN/Win. Live Messenger:
^https?://([A-Za-z0-9.-]*\.)?wlxrs\.com/
^https?://([A-Za-z0-9.-]*\.)?messenger\.hotmail\.com/
^https?://([A-Za-z0-9.-]*\.)?messenger\.live\.com/
^https?://([A-Za-z0-9.-]*\.)?login\.live\.com/
^https?://([A-Za-z0-9.-]*\.)?contacts\.msn\.com/
^https?://([A-Za-z0-9.-]*\.)?storage\.msn\.com/
^https?://207\.46\.125\.29:*
^https?://207\.46\.124\.144:*
^https?://64\.4\.35\.57:*
^https?://65\.54\.*\.*:*
I've obtained these recorded from Proxy logs, so I don't know if I'm missing anything or not... But MSN/Win. Live Messenger does work.

Skype:
^https?://204\.9\.163\.181:*
^https?://78\.141\.177\.124:*
Skype seems to work just fine without these, but they did come up in the logs [as soon as I logged into Skype] with the error "Failed to verify server certificate"... So I added them as an exception... I did a who-is on them, and they are owned by Skype.

Playstation Network (PSN):
^https?://([A-Za-z0-9.-]*\.)?playstation\.com/
^https?://([A-Za-z0-9.-]*\.)?playstation\.net/
^https?://([A-Za-z0-9.-]*\.)?playstation\.org/
^https?://125\.199\.254\.51
^https?://198\.107\.*\.*
^https?://184\.84\.65\.*
^https?://173\.230\.216\.*
^https?://50\.19\.100\.125
^https?://209\.251\.*\.*
I've obtained these from proxy logs, and now PSN works without error... I've tested CoD: Black Ops, and Red Faction: Armageddon online with them. I have also downloaded updates, and even game demos under these rule sets without error.

TwitchTV:
https://199\.9\.[0-9][0-9][0-9]\.[0-9][0-9][0-9]/
https://199\.9\.[0-9][0-9][0-9]\.[0-9][0-9]/
https://199\.9\.[0-9][0-9]\.[0-9][0-9][0-9]/
https://199\.9\.[0-9][0-9]\.[0-9][0-9]/
This fixes the chat in TwitchTV when using SSL Scanning.

Various Google services (Google+, Google Music, Google Voice, etc):
^https?://173\.194\.*\.*
^https?://74\.125\.*\.*
^https?://([A-Za-z0-9.-]*\.)?google\.com/
^https?://([A-Za-z0-9.-]*\.)?googleusercontent\.com/
Google+ and Google Music seem to have problems loading with HTTPS scanning enabled, so this fixed many of the issues caused by it.
Please note that you may need to add these to the Proxy Transparent Mode Exceptions list... Due to some issues that standard exceptions cannot fix. Just in case
74.125.226.0/24
74.125.91.0/24

TomTom GPS 'Home' App:
^https?://([A-Za-z0-9.-]*\.)?tomtom\.com/
^https?://85\.90\.*\.*
These will allow TomTom Home to connect, and download map updates and the like without errors.

PlayerIO Games:
https://98\.137\.[0-9][0-9][0-9]\.[0-9][0-9][0-9]/
https://98\.139\.[0-9][0-9][0-9]\.[0-9][0-9][0-9]/
https://98\.137\.[0-9][0-9][0-9]\.[0-9][0-9]/
https://98\.139\.[0-9][0-9][0-9]\.[0-9][0-9]/
https://98\.138\.[0-9][0-9][0-9]\.[0-9][0-9][0-9]/
https://98\.138\.[0-9][0-9][0-9]\.[0-9][0-9]/
PlayerIO is a gaming service that hosts flash-based game servers.

Raxco Perfect Disk:
^https?://([A-Za-z0-9.-]*\.)?raxco\.com/
This should allow Perfect Disk to retrieve updates without any issues.

Netflix:
^https?://([A-Za-z0-9.-]*\.)?nflximg\.com\.?/
^https?://([A-Za-z0-9.-]*\.)?nflxvideo\.net\.?/
^https?://([A-Za-z0-9.-]*\.)?netflix\.com/
^https?://[\d+(\.\d+){3}/]*/[0-9]{8}\.ism
^https?://[\d+(\.\d+){3}/]*/[0-9]{9}\.ism
^https?://[\d+(\.\d+){3}/]*/[0-9]{10}\.ism
^https?://([A-Za-z0-9.-]*\.)?netflix-*.vo.llnwd.net/.*
^https?://secure\.netflix\.com/*
^https?://uiboot\.netflix\.com/*
^https?://nintendo.nccp.netflix.com/
^https?://customerevents.netflix.com/
^https?://api-global.netflix.com/
^https?://([A-Za-z0-9.-]*\.)?nflxvideo.net/
^https?://ipv6_1.lagg0.c[0-9]{1,3}.[A-Za-z][A-Za-z][A-Za-z][0-9]{1,3}.ix.nflxvideo.net/
^https?://([A-Za-z0-9.-]*\.)?nflximg\.net\.?/
^https?://cdn[0-9].nflximg.com/
^https?://cdn[0-9].nflximg.net/
^https?://108.175.[0-9]{1,3}.[0-9]{1,3}/\?o=([A-Za-z0-9.-]*\.)?

Also, add another "OR" to that rule for 'Coming from these User Agents':
Mozilla/5.0 (compatible; U; Nflx) Netflix/[0-9].[0-9].[0-9]
Gibbon/[0-9]{1,4}.[0-9]{1,4}.[0-9]{1,4}/[0-9]{1,4}.[0-9]{1,4}.[0-9]{1,4}: Netflix/[0-9]{1,4}.[0-9]{1,4}.[0-9]{1,4} (DEVTYPE=NFX[0-9]{1,4}-[0-9]{1,4}-; CERTVER=[0-9]{1,4})
Netflix seems to work perfectly with all of these exceptions in place.

Youtube:
https://www\.youtube\.com/
https://www\.youtube-nocookie\.com/
^https?://[A-Za-z0-9.-]*\.ytimg\.com/
^https?://[A-Za-z0-9.-]*\.youtube\.com/
^https?://[A-Za-z0-9.-]*\.ggpht.com/
https://www\.googleapis\.com/
Youtube app on consoles will NOT work without these exceptions, while https scanning is enabled. These rules will fix that.

Steam Gaming:
^https?://(?:\d{1,3}\.){3}\d{1,3}/depot/571/
Microsoft/Windows Update:
^https?://([A-Za-z0-9.-]*\.)?windowsupdate\.com/
^https?://([A-Za-z0-9.-]*\.)?microsoft\.com/
^https?://64\.4\.18\.19
^https?://157\.56\.134\.97
I know there's already built-in exceptions for this, but the 2 IP addresses listed fixes occasional issues with checking for updates while HTTPS (SSL) Scanning is enabled.

Facebook:
^https?://173\.252\.110\.27
^https?://31\.13\.77\.42
^https?://66\.220\.152\.19
^https?://173\.252\.100\.27
Facebook with HTTPS (SSL) Scanning enabled occasionally throws errors in logs and some pages on Facebook is un-viewable, these IP addresses should fix the issues.

----
If anyone else has any other addresses or rules to add that helps unblock these, please post them! I would be interested to see what anybody else might have [:)]
Or if I'm missing anything, please post!

Thanks!
Cancel
Vote Up 0 Vote Down

Cancel

Children

techuser over 13 years ago in reply to Linkz0rs
Skype:
^https?://204.9.163.181:*
^https?://78.141.177.124:*

Skype seems to work just fine without these, but they did come up in the logs [as soon as I logged into Skype] with the error "Failed to verify server certificate"... So I added them as an exception... I did a who-is on them, and they are owned by Skype.

Hi
It seems that skype uses a wide range of IP addresses, most of the times it takes a long time to connect to one of them, and sometimes it fails.

I've tested your IP addresses but they didn't make skype connect faster

I think using Socks proxy might be a better solution for skype

Thanks
Cancel
Vote Up 0 Vote Down

Cancel
Linkz0rs over 13 years ago in reply to techuser

Hi
It seems that skype uses a wide range of IP addresses, most of the times it takes a long time to connect to one of them, and sometimes it fails.

I've tested your IP addresses but they didn't make skype connect faster

I think using Socks proxy might be a better solution for skype

Thanks

Thanks for the input!
The IP addresses I have are ones I've obtained from proxy logs while connecting to Skype...Using Socks proxy may be a better solution, but not all users inside the network are aware of the Socks proxy.
Cancel
Vote Up 0 Vote Down

Cancel