HTTP 405 Error: Signal with GIPHY

I think you nailed it.  The only option is to skip the proxy for that FQDN.

Cheers - Bob

Bob,

I'm not sure how to do this. I added the URL api.giphy.com to the "Transparent Skip List" as a DNS host:

But it's still blocked. Same log entries as before. What did I wrong? Is there another option to skip a URL?

Jas

EDIT: Oh, forgot to write that the web filter profil for my mobile phone works in transparent mode.

Is 'Allow HTTP/S traffic for listed hosts/nets' selected under that?  If so, then you will want to watch the Web Filtering and Firewall Live Logs when you test.

Cheers - Bob

No, it's not.

I've enabled it for a test. But regarding to the web filter log the target is still blocked by the web proxy. This means in my opinion that this exception is not working. Either it is not working because it works only with local addresses, or I did something wrong.

Please post a picture of your Exception and a representative log line from Web Filtering.

Cheers - Bob

Please post a picture of your Exception and a representative log line from Web Filtering.

Cheers - Bob

Object

Exceptions

Logs

So, the  problem here is statuscode="405" - "method not allowed."  The device is sending an incorrect request that is blocked by the Proxy, but why is the Proxy handling this request if the IP is in the Skiplist?

The most likely is that the phone is configured to use the Proxy explicitly, and that's the first thing to rule out.

It's possible that the IP address changes too rapidly.  It's difficult to say because the UTM has obviously cached the IP (dnstime="0").  I queried api.giphy.com and got, 151.101.49.127 - not the same IP as the one in your picture.

Cheers - Bob

I aggree, the problem is the method how the Signal client is request the URL (POST and not GET). I tried to install tcpdump on my phone to capture the request, but I had some problems to get this to work. I will try to capture the traffic on my wifi router now. However, a proxy is not configured in my phone.

In my opinion the web proxy blocks the request before it resolves the DNS name, because the field dstip="" in the logs is empty. That would also explain why the DNS time is zero.

EDIT: I've just tested the exception under "Transparent Mode Skiplist" with another site which is blocked by the web filter profile, and it works. As soon as I add the site to the "Transparent Mode Skiplist" the site is accesible. So the proxy blocks the URL request by Signal before it checks the skiplist.

I managed to capture the traffic and I saw, that the client requests giphy-proxy-production.whispersystems.org and not api.giphy.com. I changed the exception to this new URL and now it's working.

Still one question: why I see the URL api.giphy.com in the logs, and not the one which Signal is calling?