Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 1 subscriber
  • Views 741 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

HTTPS content filter intermittantly working

jhoefker
I've got a content filter rule for an HTTPS that seems to work some of the time using transparent mode proxy.  My other explicit blocks seem to work ok.  The only category blocked is Web Ads (which also didn't catch doubleclick, which was moderately surprising).  I do have the Home Proxy CA installed on the machine.

The explicit block rule is pretty simple:  doubleclick\.net

Successful blocks look as you would expect in the log:
2009:03:18-20:17:56 zzzz httpproxy[31582]: id="0062" severity="info" sys="SecureWeb" sub="http" name="web request blocked, forbidden url detected" action="block" method="GET" srcip="***.***.***.***" user="" statuscode="403" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2413" time="5822 ms" request="0x82c1b78" url="fls.doubleclick.net/activityi;src=2062732;type=gener014;cat=priva106;ord=1;num=6476383581247.924

Failed blocks throw the following error in the proxy log:
2009:03:18-20:19:01 zzzz httpproxy[31582]: [ 0x8174aa8] ssl_log_errors (ssl.c:41) C: 31582:error:140ED0E5:SSL routines:SSL23_PEEK:ssl handshake failure:s23_lib.c:165:

I've got Bluecoat K-9 Web Protection installed locally on the machine, which winds up catching the request when it passes through the Astaro box.

I'm probably missing something simple, but any help or thoughts would be appreciated.


This thread was automatically locked due to age.
Parents
  • 0
    I get confused about where you're supposed to use regular expressions now.  Try with just 'doubleclick' alone.  Still, it looks like you're bumping into a bug in the new https proxy.
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0
    I get confused about where you're supposed to use regular expressions now.  Try with just 'doubleclick' alone.  Still, it looks like you're bumping into a bug in the new https proxy.
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
  • 0 in reply to BAlfson
    For a good while I thought it was just me messing up the search string, even using 'doubleclick'.  Things finally worked at least a little with the 'doubleclick\.net' expression I'm using now, though I figure that is a just a coincidence of it not failing vs. valid filter syntax.