A way around the block?

[oleanhosting]

Not sure if this is a bug or something I have configured wrong. An example is I have Facebook and Facebook Apps blocked. So if I browse to https://www.facebook.com it shows up as page not loading. That is all good. But if I refresh the page a bunch of times really quick the Facebook page secure page shows up and I can login. I am using the latest Google Chrome Browser.

[sky-knight]

Does application control deal with the HTTPs version?

As far as I know if you want to stop that access you have to use the Web Filter.

[oleanhosting]

There is a Facebook and Facebook Game entry in there to block it

[WebFooL]

Application control will block https as well at least in my testing.

But it sounds like it dosen't categorize it correct under stress.
Look in the event log to see the protochange of the sessions that passes.

[oleanhosting]

Dug a little deeper into it. If my Client IP is not on the passed list on the WebFilter and Facebook is blocked on the WebFilter and is blocked on Application Control I am unable to access Facebook. But if I have my client IP in Passed List on the Web Filter and Facebook still blocked on Application Control, I am blocked at first but if I refresh a few times quickly I am able to access Facebook

[ezhess]

I just tested on three computers, all with different user accounts, and all of them could get to Netflix.com and Hulu.com if I kept reloading the page. I just put a block in the Web Filter for both those sites, but still it isn't very reassuring that Application Control only works some of the time.

[sky-knight]

1.0 Release? bugzilla.untangle.com

File a bug!

[dmorris]

The application categorization is done out-of-stream after the packet has been forwarded to avoid latency. As such it really depends on if the categorization finishes before the "packet" leaves the server.
Even if categorization finishes later the next packet in the session will be dropped anyway, it just happens to be after the page partially rendered. Its mostly moot because at this point the sessions has been dropped anyway, you just happened to see some of the page first, but the application is still unusable.

I'd use Web Filter, its custom designed for filtering web sites.
Application Control is for identifying and controlling application usage.

[HVGS]

When application control was first announced it sounded like it would help control difficult applications like Google Plus on SSL. This is impossible (in our testing) to block if you allow access to any SSL Google services.

But from Dirk's reply it seems that application control is not suitable for this and web filter should be used for site blocking

In our extensive testing of application control it is totally ineffective at blocking any web sites reliably. This includes facebook , you tube, google etc.

For example try to control youtube and after a couple of browser refreshes at most you can play any video you want.

We also have web filter premium so we can use this to control SSL facebook and SSL youtube. (site comes up but no videos play). But things like GOOGLE plus cannot be handle by Web Filter with or without Application Control.

We are in education market so really need this to work.

A few of the more upmarket (in price anyway) solutions are now doing a MITM SSL hack so they can see the actual URL being passed. This involves pushing a trusted cert to clients. The vendors say it also works on tablets etc.

Maybe this is the only effective way for Untangle to move forward in this area.

[dmorris]

bug #10059 filed

I think I see the issue and we'll look into a solution.