Whitelisting URLs gives access to other websites

Whitelisting URLs gives access to other websites

Whitelisting URLs gives access to other websites
Whitelisting URLs gives access to other websites
2024-05-25 10:39:43
Tags: #DNS
Model: OC300  
Hardware Version: V1
Firmware Version: 5.13.30.20

Some clients are able to access websites other than what I whitelist.

 

I have a network made of an ER8411, an SG2218P, several SG2210Ps, and a bunch of EAP225s, all managed by an OC300 controller. It's a BYOD network, with around 300 clients at any given time. We're a blue ocean ship, and spend about half of our time on a metered connection while at sea, and about half of our time on a non-metered connection while in port.

 

While at sea, I'm trying to give the crew access to messaging like WhatsApp, text messaging, Messenger, ect, because the quality of life from being able to call home is huge while we're away from home port. However, I have several services that I need to have data for, so I can't just let the whole internet rip for them, as they'd eat through the data cap in a few days.

 

I've set up a whitelist of devices that works great. The people who need it for work have it while underway. This is done with a MAC whitelist set to block all traffic on the LAN and to the WAN that isn't whitelisted, and a DHCP reservation corresponding to their MAC. The DHCP reservations are given an IP in the upper half of the subnet. DHCP automatic IPs are restricted to the bottom half. It isn't pretty, nor will it stop anyone determined enough to get access to the internet, but it works until I can get a lot smarter on VLANs and how to run two separate networks on the same hardware. (I'm not a professional IT, I just do this in my spare time.)

 

My problem is that when I turn off the MAC filter, I think my URL and ACL rules should block all traffic from non-whitelisted devices besides to WhatsApp. But it's letting some, not all, people access other sites. Turning off the URL permit rule causes intermittent WhatsApp connectivity, because I don't have all the IPs on the ACL rule, and still allows some people to access other sites, thought it's much more limited.

 

I added the WAN/LAN4 IN blocks after I had turned the MAC filter back on, so I'm not sure if that fixed it, and I'll be trying it tomorrow. But regardless, they still shouldn't have been able to get out in the first place. So what did I miss?

 

My ACL rules:

 

My URL filter:

 

  0      
  0      
#1
Options
2 Reply
Re:Whitelisting URLs gives access to other websites
2024-05-27 08:34:06

 

BHJohnson wrote

Some clients are able to access websites other than what I whitelist.

 

I have a network made of an ER8411, an SG2218P, several SG2210Ps, and a bunch of EAP225s, all managed by an OC300 controller. It's a BYOD network, with around 300 clients at any given time. We're a blue ocean ship, and spend about half of our time on a metered connection while at sea, and about half of our time on a non-metered connection while in port.

 

While at sea, I'm trying to give the crew access to messaging like WhatsApp, text messaging, Messenger, ect, because the quality of life from being able to call home is huge while we're away from home port. However, I have several services that I need to have data for, so I can't just let the whole internet rip for them, as they'd eat through the data cap in a few days.

 

I've set up a whitelist of devices that works great. The people who need it for work have it while underway. This is done with a MAC whitelist set to block all traffic on the LAN and to the WAN that isn't whitelisted, and a DHCP reservation corresponding to their MAC. The DHCP reservations are given an IP in the upper half of the subnet. DHCP automatic IPs are restricted to the bottom half. It isn't pretty, nor will it stop anyone determined enough to get access to the internet, but it works until I can get a lot smarter on VLANs and how to run two separate networks on the same hardware. (I'm not a professional IT, I just do this in my spare time.)

 

My problem is that when I turn off the MAC filter, I think my URL and ACL rules should block all traffic from non-whitelisted devices besides to WhatsApp. But it's letting some, not all, people access other sites. Turning off the URL permit rule causes intermittent WhatsApp connectivity, because I don't have all the IPs on the ACL rule, and still allows some people to access other sites, thought it's much more limited.

 

I added the WAN/LAN4 IN blocks after I had turned the MAC filter back on, so I'm not sure if that fixed it, and I'll be trying it tomorrow. But regardless, they still shouldn't have been able to get out in the first place. So what did I miss?

 

My ACL rules:

 

My URL filter:

 

Hi @BHJohnson 

For your request that 'But it's letting some, not all, people access other sites', could you please try to provide more details and give an example? From the ACL rules, there are deny all rules, generally all the traffic except the permit rules will be blocked.

Best Regards! >> Omada EAP Firmware Trial Available Here << >> Get the Latest Omada SDN Controller Releases Here << *Try filtering posts on each forum by Label of [Early Access]*
  0  
  0  
#2
Options
Re:Whitelisting URLs gives access to other websites
2024-05-27 09:38:45

  @Hank21 

 

For example, people were getting notifications from all of their apps, not just WhatsApp. Lots of people's phones updated (we've been at sea for about a week and a half). Some people were able to access Facebook and Instagram. Signal was working on a few people's phones. A couple people got to their banking websites. But it was very inconsistent. Most people's weren't able to. I for instance wasn't able to get to anything on my phone, which I keep off the internet while we're at sea unless I have a reason to put it on. And there wasn't a trend between Apple or Android or a certain brand of hardware or AP they were connecting to or even a common switch they were going through.

 

When we rerun the test with all of the incoming blocks on as well, is there anywhere that I should be looking to get more information on how people are getting around the blocks? Right now I just watch the client list sorted by Download value and make sure we don't blow through our data cap.

  0  
  0  
#3
Options

Information

Helpful: 0

Views: 354

Replies: 2

Tags

Related Articles