Skip to main content
aley
aley
New Member
November 3, 2017
Solved

DNS Filter: Enable Safe search for Google, but don't restrict YouTube

  • November 3, 2017
  • 2 replies
  • 35543 views

We're using a few FortiGate 50E with FortiOS 5.6.2 and DNS filtering, which works great (properly enforces SafeSearch over SSL/TLS without requiring a local certificate to be installed).

 

However, when Safe search is enforced, YouTube restrictions must be set to "strict" or "moderate". Even moderate YouTube restriction blocks LOTS of videos that aren't in any way problematic for a school.

 

Is there a way to have Safe search enabled for search engines (Google, Bing, etc.) but not restrict YouTube?

    Best answer by jonathanaxford

    Hi all,

     

    I've had confirmation from Fortinet that the DNS filter is an 'all or nothing' setting, its not possible to remove the youtube restrictions and keep the google restrictions on. The only way to cover this is to use SSL inspection and apply the requirements via a webfilter. 

     

    Cheers

    Jon

    2 replies

    sub7even
    sub7even
    New Member
    November 7, 2017

    looking forward to get updated reply from this as well..

    gabriel
    gabriel
    New Member
    October 2, 2018

    Hi, anyone have solved this?

    blackhole_route
    blackhole_route
    New Member
    October 13, 2018

    It looks like this is possible at the CLI, at least on FortiOS 6.0.2. You can set safe-search enable on the dnsfilter profile, but not set youtube restricted.

    config dnsfilter profile

    edit profilename

    set safe-search enable

    unset youtube-restrict

    end

     

     

    Another option which requires a bit of work is to set up an internal recursive DNS server to do this. Rewrite the documented google.com domains (using something like BIND RPZ's) to forcesafesearch.google.com (https://support.google.com/websearch/answer/186669?hl=en) , and depending on internal client address, rewrite www.youtube.com (and other associated domains) to restrict.youtube.com or restrictmoderate.youtube.com. Google use to publish the list of domains to rewrite publicly but now apparently have restricted access to that information only to GSuite Admin accounts. If you need it, I can dig it up from config files I'm running currently....

    golemb
    golemb
    New Member
    October 15, 2018

    I would love a easy built in solution for this, educational environment.   The Enforce Safe Search works great for Google / Bing search engines, users can't turn it off via the browser.   Works on every device.   My users hate it so I know its working

     

    The YouTube filter is way to restrictive even on moderate, this is where the problem is for my users.   I tried the above CLI commands on one of my FortiGates firewalls as were running FortiOS 6.02.  They do execute without error in the CLI but when browsing to YouTube after making the changes via the CLI YouTube still in restricted mode.   I don't know if someone else can confirm this.

     

    If there was an option via DNS filtering to leave YouTube unfiltered that would be super.   Three options for YouTube  Strict, Moderate, Unfiltered.   Could this be a feature request?

     

    I have looked at the cookbook for the internal recursive DNS setup, don't really want to go down that path if I don't have too.

    Silver
    Silver
    New Member
    May 24, 2019

    Dear All,

    anyone can help to block safe search without ssl deep inspection. but users should not be able to have the options to turn off safe search into there browsers.

     

    Thanks

    silver

    Terms & ConditionsAccessibility statement