Technical Tip: How to block Youtube using Static URL filter

Description

This article describes how to block YouTube using a Static URL filter and how to allow YouTube embedded URLs while blocking YouTube.

Scope

FortiGate.

Solution

Blocking YouTube on a static URL filter is typically required when the Streaming Media and Download category is allowed, but there is a need to block YouTube.

Part 1: How to block YouTube.

Configuration :

URL: '.*googlevideo.*'.
Type: Regex.
Action: Block.

URL: '.*youtube.*'.
Type: Regex.
Action: Block.

URL: '.*ytimg.*'.
Type: Regex.
Action: Block.

Both URLs are required to be added to avoid bypassing the blockade due to browser cache or searching for the YouTube video through a search engine.

The YouTube website may still load, but users affected by this Webfilter profile will not be able to load videos.

Create a Deny-based firewall rule with the UDP 443 port.

Blocking QUIC forces the browser to use TLS instead, preventing clients from bypassing transparent proxies and ensuring UTM features work properly. For more ways and details to block QUIC, refer to Technical Tip: How to block/disable QUIC.

 Follow the steps mentioned below to block the website:

1. Go to Security Profiles -> Web Filter.

2. Select a web filter to edit.

3. Under Static URL Filter, enable URL Filter, and select Create New.

4. Enter the URL, without the 'http', for example, www.example*.com.

5. Select a Type: Simple, Regular Expression, or Wildcard. In this example, select Wildcard.

6. Select the Action to take against matching URLs: Exempt, Block, Allow, or Monitor.

7. Select 'Enable'.

8. Select 'OK'.

Once the Web Filter profile is configured:

• Go to Policy & Objects -> IPv4 Policy.

• Apply the Web Filter profile to the firewall policy that handles traffic from users.

Part 2: How to allow YouTube embedded URLs while blocking YouTube:

The profiles below are created assuming only YouTube needs to be blocked while allowing YouTube embedded URLs and the rest of the internet.

Step 1: Create the following Webfilter profile:

FortiGuard categories are disabled, and the URL filter is enabled. While allowing the rest of the internet with *.

Step 2: Create the following application control profile: 

Step 3: Create a firewall policy with deep inspection and add the above web filter and application control profile.

Related article: 

Technical Tip: Disabling / Blocking QUIC Protocol to force Google Chrome to use TLS