9.1 build2 available!

[CADman_ks]

If they aren't in the event log (even as passed) then web filter didn't see them. If this is the case they definitely won't be blocked.

This is probably because you have a web cache running some where or they are cache in your browser, or the traffic is going some other router through a different gateway or policy/rack or is bypassed.

OK. I do NOT have that going on.

redtube.com IS showing up in the log, and they are showing up as "passed, no rule applied", and they are showing up as blocked and flagged false. I've tried penthouse and youporn, and they are flying thru the filter as well. (I'm not allowed to add attachments, or I would. on edit: I realized that I can't post new threads or add attahcments to the announcements section.)

So, that means that the browser cache isn't in play, because the filter DID see them, and it decided to take no action. However, redtube is in the Uncategorized category, and I do NOT have that blocked, nor have I ever had that blocked in the past. Also, I have never even tried to access penthouse before typing this message, so browser cache isn't in play here either.

This web filter MUST block these sites!, and it has always done that in the past without fail.

For the record, my setup is a routed setup and not bridged.

CADman_ks

[dmorris]

Interesting. Like I said, please post your steps to replicate the issue and we'll try it.

[CADman_ks]

Interesting. Like I said, please post your steps to replicate the issue and we'll try it.

These are my steps:

install
change the internal IP range to 172.16.0.X
router mode
DHCP server enabled
Install Lite package, nothing changed or altered on any of the settings in any of the modules.

100% stock out of the box. Same thing in 9.1 beta 1, machine repaved to 9.1 beta 2, same results.

playboy.com will ALWAYS block
other pornography sites will not block
tested on various machines, all with the same result

logs indicate that redtube, penthouse, youporn, etc are being caught as "Uncategozied", and are NOT blocked, because I don't have Uncategorized category blocked, or logged.

Here's the other thing that I didn't state. Any site that goes thru my beta server, will be blocked when I go back to my production server. As soon as I switch it back to the beta server, they will go thru again, so it's not something on the client computers.

I not for sure what more you might need, because I don't really have any "steps" to replicate, other than installing the software, and then using client computers to access sites that should be blocked.

CADman_ks

[CADman_ks]

I just repaved my non-prod box to 9.1 rc2, and it exhibits the same results.

playboy is blocked, everything else I tried got thru.

This time, when I repaved it, I accepted the defaults on EVERYTHING, including the internal address range 0f 192.xxxx (whatever it is)

For verification, Pornography and Proxy Anonymizers are the only two things that are blocked, and were set that way by default.

CADman_ks

[dmorris]

Gotcha, now take a deep breath...
Like I said, we just need steps to replicate.

Heres what we know:
1) Install untangle with "EVERYTHING" defaults.

Heres an example/suggestion of what I need:
2) Install "Web Filter Lite" and keep defaults? any other apps? The Lite Package?
3) Go on some machine behind untangle (192.168.2.100?) that uses Untangle as DNS running some Operating system. Which OS? Windows XP? IBM OS/2? MS DOS 3.3?
4) Open some browser I assume? Are you using firefox? curl? wget? telnet? What version?
5) Type "http://penthouse.com" in the URL bar? Open a link? Open a bookmark? "penthouse" is a magazine, its not a valid URL. What URL are you opening? is it http? is it https? is it some subdomain of penthouse?
6) You see something? What? you see porn? You see text? You see a blockpage?
7) You see something in the event log? What? You're seeing "redtube.com" as "passed"? Can you post a screenshot?

The only thing I can think of is a subdomain issue, which has since been fixed, but may have been after build2. That shouldn't matter though if you're just typing "redtube.com" in firefox.

Please just keep in mind, details matter. We just need the steps to replicate.

[abulaski]

Hi dmorris,

Thanks for your help. I can echo what CADman_ks is saying. I have been using 9.02 with complete success. The web filter lite is working fine. I am installing 9.1 on the same system and network. Using the defaults setting on 9.1 as a bridge and I install web filter lite, spam filter, phishing, spyware blocker and reports. I have tried with a win 7 machine and firefox and a mac book pro with firefox and safari with the same results. The porn site is not blocked and the whole web site shows up in the browser. It appears to me that the filter is allowing more web sites compare to the one with 9.02. The only categories that are checked in the web filter are porn and proxies which is the defaults settings. All other programs that have been installed are using their defaults settings also.

Thanks,
Arnie

[CADman_ks]

...

Heres what we know:
1) Install untangle with "EVERYTHING" defaults.

Heres an example/suggestion of what I need:
2) Install "Web Filter Lite" and keep defaults? any other apps? The Lite Package?
3) Go on some machine behind untangle (192.168.2.100?) that uses Untangle as DNS running some Operating system. Which OS? Windows XP? IBM OS/2? MS DOS 3.3?
4) Open some browser I assume? Are you using firefox? curl? wget? telnet? What version?
5) Type "http://penthouse.com" in the URL bar? Open a link? Open a bookmark? "penthouse" is a magazine, its not a valid URL. What URL are you opening? is it http? is it https? is it some subdomain of penthouse?
6) You see something? What? you see porn? You see text? You see a blockpage?
7) You see something in the event log? What? You're seeing "redtube.com" as "passed"? Can you post a screenshot?

The only thing I can think of is a subdomain issue, which has since been fixed, but may have been after build2. That shouldn't matter though if you're just typing "redtube.com" in firefox.

...

My bad. I wasn't thinking about those type of details. I was thinking more along the lines of the actual UT details.

2) Total Lite install, installing all apps in that Package. Not using Captive Portal or VPN. They are turned off. Everything else is on, and ALL using stock defaults. As a point of reference, with my 9.0.2 install I installed all of the apps one by one from the Lite package, but did NOT install the Lite package per se. I also did NOT install Captive Portal or VPN in my 9.0.2 since I did it manually, and I don't use those apps. I had an issue with Phish Blocker on my 9.0.2 install, so I've removed it from that rack.
3) OSes tested on: WinXP, SP3, and Win7. All OSes exhibit the same behavior.
4) Tested FF and IE on both OSes and both programs exhibit the same behavior.
5) All links typed in, are not stored as bookmarks. Not using https. Not sure about subdomains, though. Possible that typing www.penthouse.com redirected to something like party.penthouse.com. I did not specifically check that or pay attention to that.
6) You see EVERYTHING, and everything comes thru. No block pages, or anything indicating that UT is trying to at least block something.
7) I'm not at that box now, but the logs indicate that redtube / penthouse / etc are being passed as Uncategorized, passed by rule. That's what it says in the logs. I would post a screenshot, but I'm not allowed to post screen shots in announcements, or start new threads.

Here's the other thing that I have not specifically mentioned in this thread, my computer specs:

2.4GHz Intel P4
2G RAM
80GB HD
Internal Intel NIC for WAN
External 3Com NIC for LAN

CADman_ks

[dmorris]

Possible that typing www.penthouse.com redirected to something like party.penthouse.com. I did not specifically check that or pay attention to that.

Waaaait...
Are you typing "www.penthouse.com" in the URL bar or "penthouse.com" ?
Are you typing "www.redtube.com" or "redtube.com" ?

If you are typing "www." in front of everything then you are accessing a subdomain and that will be fixed in the next build. If this is the case though, you most certainly won't see "penthouse.com" in the event log - you'll see "www.penthouse.com."
These two URLs are different, please don't use them interchangeably.

Please just post screenshots of the block page and the eventlog.

[hlarsen]

i just verified it Dirk, "penthouse.com" is blocked but not "www.penthouse.com" - you're saying it's fixed in build3?

[dmorris]

i just verified it Dirk, "penthouse.com" is blocked but not "www.penthouse.com" - you're saying it's fixed in build3?

Yeah, that issue is. (If a subdomain fails to be categorized it tries the domain)
I don't think thats their issue though, as then it would say "www.penthouse.com" and "www.redtube.com" in the event log and the URL bar.