Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 19 replies
  • Answers 3 answers
  • Subscribers 41 subscribers
  • Views 83583 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Web content filtering breaks Hulu and Netflix.

BrandonRiffel

There are numerous posts with an identical issue.  None have an actual solution, at least not one that Sophos has recommended.  Seems like there should be a checkbox or an easy policy to allow this sort of traffic.  The rules I've seen posted in here seem to be reporting mixed results.  Sophos, please provide DETAILED instructions for allowing Hulu, Netflix, iTunes, Amazon, and any other mainstream streaming services through your HTTP, HTTPS, Malware, Web Content Filters.

Thank you!!!



This thread was automatically locked due to age.
  • 0

    Jhawk44:

    Were you able to get this to work?

    --

    Dan

  • 0 in reply to JohnnySlos

    Zombie thread: but I wanted to say that almost a year later, this still works with UTM 9.409-9.  Thanks!

  • 0 in reply to TimothyTrace

    Same here! On UTM 9.411-3 and we still had the same issue by March 2017. Application Control seems to have absolutely 0 impact on allowing NetFlix.

    This list works great. Thanks a lot!

  • 0

    I got this working on Sophos XG with both the Netflix App on Android and in the browser with the following regex. It is basically using the same stuff that worked for Sophos UTM with the docco of Sophos XG here: https://community.sophos.com/kb/en-us/125061

    Basically once the http and https bits are removed, the error about an invalid web address goes away and it works fine.

    ^([A-Za-z0-9.-]*\.)?ne?t?fli?x(img|ext|video)?\.(com|net)/
    ^[A-Za-z0-9.-]*netflix.com/
    ^[A-Za-z0-9.-]*nflximg.com/
    ^([A-Za-z0-9.-]*\.)?nflximg\.com\.?/
    ^([A-Za-z0-9.-]*\.)?nflxvideo\.net\.?/
    ^([A-Za-z0-9.-]*\.)?netflix\.com/
    ^([A-Za-z0-9.-]*\.)?netflix-*.vo.llnwd.net/.*
    ^secure\.netflix\.com/*
    ^uiboot\.netflix\.com/*
    ^23.246.[0-63].*
    ^37.77.1(8[4-9])|(9[0-1])].*
    ^45.57.([0-1][0-1][0-9])|(12[0-7]).*
    ^64.120.(12[8-9])|(1[3-9][0-9])|(2[0-4][0-9])|(25[0-5]).*
    ^66.197.(12[8-9])|(1[3-9][0-9])|(2[0-4][0-9])|(25[0-5]).*
    ^108.175.(3[2-5,8,9])|(4[0-4,6,7]).*
    ^185.2.22[0-3].*
    ^185.9.(188)|(19[0-1]).*
    ^192.173.(6[4-9])|([7-9][0-9])|(10[0-9])|(11[0-7]).*
    ^198.38.(9[6-9])|(10[2-3,8-9])|(11[0-9])|(12[0-5]).*
    ^198.45.(4[8-9])|(5[2-8])|(6[1-3]).*

  • 0 in reply to Stephen Rothery

    I found that the regex filter ^([A-Za-z0-9.-]*\.)?ne?t?fli?x(img|ext|video)?\.(com|net)/ needs to tweaked to escape the subdomain . and \

    Using this regex ^([A-Za-z0-9\.\-]*\.)?ne?t?fli?x(img|ext|video)?\.(com|net)/ works for me

  • 0 in reply to Stefan B

    does that work for HULU as well.  My Apple TV would drop the stream after a minute.  iPad and Mac were fine with Hulu.   I had to turn off HTTP scan to get it to work.   It seemed like Hulu was all over the web seeing how many ip addresses it hit.   So would this work and where in XG do I put it.

  • 0

    I doubt that SFOS do not support HTTP 1.1 byte range request feature
    that generally enabled by most video streaming and large file download service,
    so it resulted in all the required complicated regex exceptions!
    If this happens to be true, a checkbox to enable HTTP byte range could be possible?

  • 0 in reply to JohnnySlos

    JohnnySlos said:

    This list did the trick for me.

     

    ^https?://([A-Za-z0-9.-]*\.)?ne?t?fli?x(img|ext|video)?\.(com|net)/
    ^http?://[A-Za-z0-9.-]*netflix.com/
    ^http?://[A-Za-z0-9.-]*nflximg.com/
    ^https?://([A-Za-z0-9.-]*\.)?nflximg\.com\.?/
    ^https?://([A-Za-z0-9.-]*\.)?nflxvideo\.net\.?/
    ^https?://([A-Za-z0-9.-]*\.)?netflix\.com/
    ^http?://([A-Za-z0-9.-]*\.)?netflix-*.vo.llnwd.net/.*
    ^https?://secure\.netflix\.com/*
    ^https?://uiboot\.netflix\.com/*
    ^http?://23.246.[0-63].*
    ^http?://37.77.1(8[4-9])|(9[0-1])].*
    ^http?://45.57.([0-1][0-1][0-9])|(12[0-7]).*
    ^http?://64.120.(12[8-9])|(1[3-9][0-9])|(2[0-4][0-9])|(25[0-5]).*
    ^http?://66.197.(12[8-9])|(1[3-9][0-9])|(2[0-4][0-9])|(25[0-5]).*
    ^http?://108.175.(3[2-5,8,9])|(4[0-4,6,7]).*
    ^http?://185.2.22[0-3].*
    ^http?://185.9.(188)|(19[0-1]).*
    ^http?://192.173.(6[4-9])|([7-9][0-9])|(10[0-9])|(11[0-7]).*
    ^http?://198.38.(9[6-9])|(10[2-3,8-9])|(11[0-9])|(12[0-5]).*
    ^http?://198.45.(4[8-9])|(5[2-8])|(6[1-3]).*

    Ip-ranges might change over time. Check them at :

    http://ipinfo.io/AS2906#blocks

     

     

    Remarkable and thank you!  This worked perfectly for Netflix streaming to my mobile Netflix apps behind my UTM 9.503-4.   I had previously added my Roku's to a transparent skip list (that worked too), but the mobile devices needed some help. :-)