Zyxel USG Flex 50 Content Filter not applying to Chromebooks

electsystech

We have a customer with a USG Flex 50 router with the latest 5.39 firmware on it. They have 5 Chromebooks and we just discovered that the content filter policy on the router does not apply to them. The windows computers are filtered properly. DNS filter is setup. I also added a firewall rule to block QUIC ports 80 and 443. What's the solution for this?

PeterUK

if they have a VPN extension they can get around the filter 

electsystech

I'm quite certain there's no vpn on the chromebooks.

mMontana

Maybe a "private DNS" option on ChromeOS?

If content filtering is acting on DNS…

Zyxel_Kay

Hi @electsystech

The Content Filtering feature on the USG FLEX 50 works by inspecting the URLs from HTTPS packets. However, if DNS over HTTPS (DoH) or similar secure protocols are enabled, the firewall may be unable to capture and filter the content effectively.

To troubleshoot, please try the following steps:

1. Clear the browser cache on all Chromebooks.
2. Reboot the Chromebooks and check if the content filter starts working.

If the issue persists, we kindly ask you to capture packets for further analysis. Here's how:

1. Go to MAINTENANCE > Diagnostic > Packet Capture in the local GUI.
2. Select the LAN interface connected to the Chromebooks.
3. Click Capture to start.
4. Visit a website that should be filtered.
5. Stop the capture and download the packet files from the Files tab.

After collecting the packets, please send them to us via private message, and kindly provide the IP address of the PC used during the test. We'll investigate the issue further.

electsystech

We setup a DNS content filter policy from Lan to Zywall, source, Ips of chromebooks and that seems to have solved it.