Content Filter Blocking Everything After Firmware Update

Options
MeatPopsicle
MeatPopsicle image  Freshman Member
First Comment Fourth Anniversary
edited August 12 in Security

USG500H firmware v1.38

Content filter Business Productivity Protection with only the following checked:
Potential Criminal Activities
Sexual Materials
Dating Personals
Nudity
Potential Hacking Computer Crime
Potential Illegal Software
Violence
P2P File Sharing
Pornography
Web Ads

I've created Allow exceptions for:
*.msftconnecttest.com (Microsoft heartbeat URL)
*.apple.com (Apple Music was being blocked)
Heartbeat service for non-Zyxel cloud management (switches)
CC management service (improperly classified as P2P)

Also being blocked per the Content Filter log:
connectivitycheck.gstatic.com
1d.tlu.dl.delivery.mp.microsoft.com
crl2.microsoft.com
dropbox.com
multiple xxx.digicert.com
ctldl.windowsupdate.com
c.pki.goog

The list just goes on and on with blocked URLs that simply do not fall under any of the categories we intend to block.

Prior to the firmware update, there were no entries in the Content Filter logs because none of our employees were surfing porn at work.

How do I get my content filter back under control without having to create exceptions for these background services from Microsoft, Google, digicert, etc.?

UPDATE: if anything, this issue is getting worse. I added an Allow exception for *.google.com after seeing multiple BLOCK entries in the Content Filter log. Even after adding that Allow exception, there are multiple *.google.com BLOCK entries in the Content Filter log. I have added at least a half dozen more Allow exceptions today as many sites that should not be blocked are being blocked.

All Replies

  • Zyxel_Tina
    Zyxel_Tina image  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Switch 100 Answers 500 Comments
    Options

    Hi @MeatPopsicle,

    Please test again using the latest firmware and kindly let us know the results. Thank you.

    Zyxel Tina

  • MeatPopsicle
    MeatPopsicle image  Freshman Member
    First Comment Fourth Anniversary
    Options

    Firmware applied Saturday 8/15 just before 8:40AM.

    Monday morning, Content Filter active, Allow exceptions still in place: numerous sites including URLs that are explicitly allowed, are being blocked. We use a web printing service for our warehouse handheld devices and that print service is being blocked indirectly as the certificate validation is being blocked.

    Disbaled the Content Filter to get the warehouse printing back online.

    I will send screenshots & logs by message.

  • Zyxel_Tina
    Zyxel_Tina image  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Switch 100 Answers 500 Comments
    Options

    [Update]

    We've identified the root cause of the unexpected Content Filter blocking. It was due to the Allow HTTP(S) traffic for allow lists only setting being enabled in the Content Filter profile. This setting restricts access to only URLs explicitly defined in its allow list. Disabling this feature has resolved the issue.

    image.png

    Zyxel Tina

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）