My Mac is bypassing a website filter... How can I stop it?

Question

Level 1

9 points

My Mac is bypassing a website filter... How can I stop it?

I am a computer technician at our local high school. Right now, the school has about 800 Dell computers, but we are planning on introducing a few Macintosh labs within the next school year.

Since they lack educational value, the school district's director of technology (my boss) has a web filter (Deep Nine) that blocks myspace, facebook, youtube, proxy sites, and other similar sites.

Myspace is blocked via a keyword filter, any page containing the word "myspace" in the url, or in the document a set number of times, is automatically blocked. The other sites are simply blocked by URL. This filter works perfectly on our Dells, no one can access Myspace, Facebook, Proxies, etc.

I brought my Macbook to work today, plugged it into the network, and logged onto the internet. I noticed instantly that my homepage (Facebook) loaded without being blocked at all. Curious, I tested myspace and youtube, and I could get on youtube fine, but myspace remained blocked.

I checked on the Dell next to me, and all those sites will still being filtered and blocked. Yet my Macbook was able to access them without issue. So it would appear that my Macbook has some mystic ability to bypass the web address filter, but it can not bypass the keyword filter.

I do not have any proxies configured. My Macbook connects to the network (and thus, the internet) the same exact way the other computers within the school do, with the exception of the other computers being within Active Directory.

I need to find out if it is an issue with the Mac or with our Filter. I don't have any other Macs available to test with (Our only other Mac in the school is our DHCP server, and we do not use servers as "lab rat" computers).

Has anyone had any similar issues with this? Or does anyone know of any way I can diagnose this with only one Mac and only one Filter?

Specs: OS 10.5.5, Safari 3.1.2, wired networking.

Message was edited by: Joey Hogan

Message was edited by: Joey Hogan

Macbook, Mac OS X (10.5.5), 2.4Ghz Core 2 Duo, 2GB Ram, 160GB HD

Posted on Oct 8, 2008 7:50 PM

Reply

Answer 1

orangekay

Level 5

4,085 points

Oct 8, 2008 8:08 PM in response to Joey Hogan

I've never heard of anything called "Deep Nine" and can't seem to find any references to it on Google. What exactly does it do and where does it do it?

Reply

Answer 2

Tim Haigh

Level 7

24,198 points

Oct 9, 2008 1:29 AM in response to Joey Hogan

If your not using a proxy server to filter content then I presume it is done via a dns server.

Check to see that the mac's are using the same dns server as the dells.

Reply

Answer 3

Joey Hogan Author

Level 1

9 points

Oct 9, 2008 7:32 AM in response to orangekay

Deep Nine is our web filtering system. Their website is http://www.deepnines.com/products/Content_Filtering.php

Our filter is located at the local community college, which we have strong ties with, and they provide our district with internet access. I am not the network tech, but to my understanding, this is how it is set up

(high school computers) > (high school router) > (school district core router) > (deep nine filter at college) > (college router) > internet

The filter sits right in between our district's main router (which all district computers go through), and the college's router. There are no bypass connections, so absolutely every packet of data used by the district should be going through the filter.

Reply

Answer 4

Joey Hogan Author

Level 1

9 points

Oct 9, 2008 7:41 AM in response to Tim Haigh

The high school has it's own private router, and there is only one DNS server, provided by one of our Dell servers.

I took the laptop to an elementary school, and same issue happened there. It was the same laptop, but it was using the elementary school's DNS and DHCP servers (both provided by the school's active directory server).

Reply

Answer 5

Dogcow-Moof

Level 8

36,833 points

Oct 9, 2008 10:59 AM in response to Joey Hogan

This isn't something silly like the machines on those networks are setup to use Deep Nine as a proxy server, and the IT folks have for some reason left routing open so you can still get to the Internet without routing through the proxy, is it?

It could also be that your Mac simply has the address for say facebook cached, and the filtering may be taking place at the DNS level (pretty poor implementation if it is, but I digress.)

Try doing a:

sudo dscacheutil -flushcache

from Terminal and see if you can still get around the filter.

Reply

Answer 6

orangekay

Level 5

4,085 points

Oct 9, 2008 12:18 PM in response to Joey Hogan

I just sat through a webcast of what felt like ten hour's worth of some stuttering Texan pitching this product and based on what I learned there I'd be prone to say your employer is getting fleeced here. My understanding of their game is:

1. They show you some videos of college kids talking about how easily they bypass their school's security system and offer you a free, week long security audit.

2. At the end of this audit they give you a big scary report of all the ways your network is being abused and costing you tons of money.

3. They tell you they have a magic, invisible packet filtering solution which you absolutely must have, but refuse to tell you anything about how it actually works beyond demonstrating some hideous Java configuration application ad nauseum and claiming how much better it is than the competition.

4. They get you to agree to let them install one of these magic devices and bill you for every packet that flows over them thanks to their bandwidth-based pricing model.

If you ask how it works or how much it costs they change the subject. You've certainly proven that it doesn't work very well, so I'd be interested to find out how much you're paying.

Reply

Answer 7

Joey Hogan Author

Level 1

9 points

Oct 9, 2008 6:53 PM in response to Dogcow-Moof

There are no proxy settings stored on the computers. Several of the computer labs at the school are using images that I created myself, and I certainly did not configure any proxy information.

I'll try the dscacheutil tomorrow morning, thanks.

Reply

Answer 8

Joey Hogan Author

Level 1

9 points

Oct 9, 2008 6:59 PM in response to orangekay

Last I heard, it was $900 a month, but I'm sure they've created some kind of upgrade since than that requires another $500 a month.

I'm sure that is pretty much how the sales deal went. And most computer lab teachers are getting annoyed by the filter to the point where they've spent hours creating "allowed site lists" in vision (our classroom management software suite).

Reply

Answer 9

orangekay

Level 5

4,085 points

Oct 9, 2008 7:32 PM in response to Joey Hogan

Sounds about right--the guy seemed like a complete huckster to me. If the product actually lived up to its hype, any real security professional would be so obnoxiously proud of their work that it'd be impossible to shut them up about all the technical obstacles they'd overcome in getting something like this on the market. Instead he just stammers, mispronounces simple, non-technical terms and shoves a water bottle in his mouth to avoid going into any detail whatsoever.

I don't doubt that it could conceivably do something genuinely beneficial, but their claims seem more than a bit exaggerated, and when something like this goes wrong I imagine you have little recourse aside from calling them up and asking them to send out a certified consultant/partner to diagnose the problem at $200/hr. I would not be the slightest bit surprised if someone told me they were pilfering some open source traffic shaper and slapping their logo on it.

Reply

Answer 10

Joey Hogan Author

Level 1

9 points

Oct 9, 2008 9:10 PM in response to orangekay

Unfortunately, that is what it's starting to sound like right now. Our network expert took a look at it, and he had no idea what was going on at all. But we are all leaning towards the filter being the issue.

Deepnines is not a reliable system in my opinion, as some students found that if the website they are accessing supports https, Deepnines will not filter it at all. So just by adding one character to the URL field, you pretty much defeated the entire filter system.

Reply

Answer 11

Hokiebob

Level 1

0 points

Dec 12, 2008 6:58 AM in response to Joey Hogan

The DeepNines product works well and does much more than a simple URL filter. The problem lies entirely in your district setup and not in their product. If you're not using a proxy filter, then you have all access and routes designed to head out on typical port 80 traffic to your isp and ultimately the internet hence no proxy configs. The filter is integrated with LDAP accounts at each of your locations to tell it which users and groups are to get filtered at what level. That tie in is what breaks down who goes where. If you introduce new macs onto the network and they have not been configured to work with the DN appliance and are going out unfiltered... then there are 2 problems here. #1 is that you have computers attaching to the network, receiving leases and doing what they want. Use DHCP reservations or a whitelist to control who gets on your network. #2 is that your DeepNines filter has not been set to failover to BLOCK. Instead, it's allowing unknown users to bypass freely simply because it doesn't recognize their group/account. And Orange, stop slamming the company. They are a smaller business that has taken a much better approach to filtering than any other large corporation. Standard database driven URL filters DO NOT WORK....PERIOD! I challenge you to call any district that is running their appliance to get their opinion of it in comparison to any of the other basic url filters out there. I did just that last week and they had absolutely nothing but high praises for the DN product. One even laughed at Websense which they had before switching simply for the lack of ability to block anonymouse proxies.

Reply

Answer 12

orangekay

Level 5

4,085 points

Dec 12, 2008 7:58 AM in response to Hokiebob

You registered just to post that? You must work for DeepNines, in which case I challenge you to produce a single piece of documentation that describes what it is your product actually does. Failing that, I challenge you to find a 6th grade English textbook and study up.

Reply

Answer 13

Hokiebob

Level 1

0 points

Dec 12, 2008 8:08 AM in response to orangekay

Actually yes I did after reading your misinformed replies. Sitting through a boring and near brainwashing demo of a product doesn't mean that the product is bad. I've sat through the same demo and no I do not work for the company. I work for a large school division that conveniently enough does not use their product. Web filtering is my job and has been for the previous 5 years. I challenge you to grab a few technology textbooks and read up before posting comments about website filtering....which is what this thread is about.

Reply