Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 5 replies
  • Answers 1 answer
  • Subscribers 4 subscribers
  • Views 12001 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

MP4 Videos being blocked on iPhone

Alex_P_01 
2014:01:19-03:16:10 HIDDEN_WALL httpproxy[5367]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.2.16" dstip="198.151.161.47" user="" statuscode="302" cached="0" profile="REF_HttProFreedom (Freedom)" filteraction="REF_HttCffConteFilteDarkn (Content Filter - Darknet Style Super)" size="280" request="0xee71820" url="www.omnigroup.com/.../html"

2014:01:19-03:16:10 HIDDEN_WALL httpproxy[5367]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.2.16" dstip="198.151.161.47" user="" statuscode="302" cached="0" profile="REF_HttProFreedom (Freedom)" filteraction="REF_HttCffConteFilteDarkn (Content Filter - Darknet Style Super)" size="278" request="0xee71820" url="www.omnigroup.com/.../html"

2014:01:19-03:16:10 HIDDEN_WALL httpproxy[5367]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.2.16" dstip="54.230.123.210" user="" statuscode="200" cached="0" profile="REF_HttProFreedom (Freedom)" filteraction="REF_HttCffConteFilteDarkn (Content Filter - Darknet Style Super)" size="79640" request="0xe2cd0e60" url="downloads2.omnigroup.com/.../mp4"

2014:01:19-03:16:11 HIDDEN_WALL httpproxy[5367]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.2.16" dstip="54.230.123.210" user="" statuscode="200" cached="0" profile="REF_HttProFreedom (Freedom)" filteraction="REF_HttCffConteFilteDarkn (Content Filter - Darknet Style Super)" size="50133" request="0xf0a3af8" url="downloads2.omnigroup.com/.../mp4"


I am trying to find out why the Web Protection is blocking MP4 video files on my iPhone. Noticed this when trying to view a video on OmniFocus 2, and figured if they created a website where the videos are viewable for iPhones. Switch over to cellular and it works just fine. Figured it was Web Protection, and sure enough if I disable it, works fine on the network. 

Currently using UTM
Firmware version: 9.107-33
Pattern version:  56192

Created a special profile for it as well, where nothing is being blocked aka 
(Content Filter - Darknet Style Super)
. 

Created an exception to see if it would help.. Not sure if the rule is written 100%, but won't work with this rule ..  
^https?://([A-Za-z0-9.-]*\.)?mp4

Skipping:	Antivirus / MIME type blocking / URL Filter / Content Removal


Only other thing that I found that would work without disabling Web Filtering is, if I add the iPhone to the Web Filtering > Advanced > Transparent mode skiplist.
It will play videos just fine. But this defeats the point of having it turned on.. 

I would like the Web Filtering to work for the iPhone devices, as this is the only major issue I have with it currently. 

The source URL for further inspection
OmniFocus - Video - The Omni Group


Many thanks,
Alex P


This thread was automatically locked due to age.
  • 0
    Not sure why it isn't playing.

    I know that sometimes there are problems with streaming media - partly this is due to the fact that there are a hundred different ways of doing it and no standards.  Mobile devices just multiply the combinations.

    The log lines you posted don't show a failure in and of themselves.  Were they other lines as well?

    I have seen one case where if you have a maximum download size it can fail.  You could try turning that off.

    The exception you have written will not apply to that url.  You should use this (will apply to any url that ends in .mp4):
    \.mp4$

    Note that you can see if an exception has been applied by looking at the log line.  exceptions="" means no exceptions.
  • 0
    Michael,

    Thank you so much for posting this fix - it worked for us! We were having issues with mp4 playback that were looping backgrounds on a webpage. We added a rule for any site matching: \.mp4$ and boom. No more issues. Weirdly, it would only work in Firefox before, but now it works in all browsers.

    Cheers!
  • 0
    Everyone please remember to post complete log lines. Also, alone among the logs, the Firewall Live Log presents abbreviated information in a format easier to read quickly. Usually, you can't troubleshoot without looking at the corresponding line from the full Firewall log file.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to Michael Dunn

    I tried this and saw the same behaviour.

    Looking at a packet dump, what I see is that when it tries to start the video, the browser is doing a range request, to download a subset of the whole MP4 file.

    When AV scanning is disabled via an exception, the range request is allowed and the we see a HTTP status code of 206 (Partial Content) coming back. The browser understands this OK and plays the video

    When AV scanning is enabled, the UTM does not usually allow range requests because it can't conclusively malware scan a partial file. This would create a loophole where a malicious app on the desktop could download a malware file bit by bit and bypass our filtering.

    What happens then is that the UTM removes the range request header from the HTTP request and the server consequently responds with the whole file and an HTTP 200 response. The browser on the iPhone doesn't expect this and so the video doesn't play back.

    The different behaviours of different devices and different browsers probably vary based on (a) whether the device/browser does a range request or tries to download the whole MP4 in one go, and (b) If it does a range request, whether the browser can handle a full-file response.

    GET /c/198252.512p.mp4 HTTP/1.1

    Host: b1.vestifinance.ru

    Accept-Language: en-ca

    X-Playback-Session-Id: 3C2B2963-5AAF-44D8-A610-B63EAE6AC278

    Cookie: _ga=GA1.2.2102615505.1455910228; _gat=1; _ym_isad=0; _ym_uid=1455910228699311060; hpmd_session=1; hpmd_tmp=0.5797367240302265; hpmd_uid2=632629543

    Range: bytes=917504-220941462

    Accept: */*

    User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 9_2_1 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Version/9.0 Mobile/13D15 Safari/601.1

    Referer: www.vestifinance.ru/.../25026

    Accept-Encoding: identity

    Connection: keep-alive

    HTTP/1.1 206 Partial Content

    Server: nginx

    Date: Fri, 19 Feb 2016 19:53:08 GMT

    Content-Type: video/mp4

    Content-Length: 220023959

    Last-Modified: Fri, 04 Dec 2015 18:22:43 GMT

    ETag: "5661d9f3-d2b4c97"

    Content-Range: bytes 917504-220941462/220941463

    Connection: keep-alive

    Without AV exception:

    GET /c/198252.512p.mp4 HTTP/1.1

    Host: b1.vestifinance.ru

    Accept-Language: en-ca

    X-Playback-Session-Id: A44D65F3-4C44-4578-9201-94A5568CBE70

    Cookie: _ga=GA1.2.2102615505.1455910228; _gat=1; _ym_isad=0; _ym_uid=1455910228699311060; hpmd_session=1; hpmd_tmp=0.9600498070940375; hpmd_uid2=632629543

    Range: bytes=917504-220941462

    Accept: */*

    User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 9_2_1 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Version/9.0 Mobile/13D15 Safari/601.1

    Referer: www.vestifinance.ru/.../25026

    Accept-Encoding: identity

    Connection: keep-alive

    HTTP/1.1 200 OK

    Server: nginx

    Date: Fri, 19 Feb 2016 19:52:36 GMT

    Content-Type: video/mp4

    Content-Length: 220941463

    Last-Modified: Fri, 04 Dec 2015 18:22:43 GMT

    ETag: "5661d9f3-d2b4c97"

    Accept-Ranges: bytes

    Connection: keep-alive

     

  • 0 in reply to RichBaldry
    Thanks, Rich, for the explanation of what's happening. Had I seen a complete log line in Alex' post, I would have just said to first try an Exception for Anti-Virus without knowing why.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Unfiltered HTML