Safe Search not being enforced

[pkley]

FWF40C running 5.0.1. Webfilter is configured on my outbound policy and is working as it does block " blocked" web pages. If I do a search with Google or Bing I' m able to turn safe search off thru the browser, IE 9 or Firefox 18. It will show regular results for " porn" but it does block me if I try clicking on a actual link, great. However, it doesn' t block Images on either Google or Bing if I disable safe search in the browser, that' s NOT GOOD. If I try it thru Yahoo, I' m blocked two ways, first if I try to save the change to safe search it leads to a Unrated page block. If I disable Unrated pages in the firewall, I' m able to change the preference and save it but all results still show like safe search is on, which is as it should be. How to I get Google and Bing to force safe search?

[pkley]

In further testing it only works partially in 4.2.7 as well. In 4.2.7 you can' t bypass Google Safe Search in the browser even if you disable it under Settings. Then no results are found in Web or Images. However, Bing safe search if you disable Safe Search, it blocks it in Web but not Images. Also, in 5.0.1 Bing web search via mobile doesn' t get blocked at all, web or images.

[billp]

I don' t have a complete resolution for you, but I have some general suggestions. I am not using 5.0.1, but here are some things I' ve found helpful in troubleshooting this previously: 1. Is the URL encrypted? If so, that could be part of the problem. 2. For Bing, block *.explicit.bing.net -- that' s similar to enforcing SafeSearch since all or most explicit images originate from that domain. 3. Use the IPS functions to block signatures for Google.Safe.Search.Off and similar. I have had problems with enforcing SafeSearch on earlier firmware versions. The Fortigate is supposed to rewrite the Google URL with &safe=on, but that' s rarely if ever worked for me. I was hoping any problems had been resolved in 5.0.1. I know there are more CLI options for configuring it now, but I have not played with them. If you open a support ticket to resolve, please let us know how it goes.

[Dave_Hall]

Under 4.3, the Web Filter Profile (under UTM Profiles) has a " Enable Safe Search (Support Search Engines: Google, Yahoo, and Ping)" option that suppose to append the correct flag or variable to the end of the search URL. For the most part it works well accept when using Google in HTTPS mode, though I understand this is suppose to be fixed in 5.0.

[pkley]

Bob: Thanks for the Bing tip URL Filter, that did work in Firefox but unfortunately not in IE9 or a mobile client, which is weird because when I hold on an image and get the details, it also shows http://ts4.explicit.bing.net and I would think would be blocked too. Why it works in Firefox and not IE baffles me... Could you be more specific on what you do with IPS to block Google Safe=off? Dave: Unfortunately while the WFP SHOULD enforce SafeSearch when enabled, it doesn' t, either in 4.2 or 5.0.1. It partially works in 4.2 unless you use https://google.com, then it fails. It isn' t fixed AT ALL in 5.0. To all, there are more features in 5.0 re web filtering, you can actually see the wildcards, but apparently they just don' t work. I' ll post the default below from the CLI. I have created a ticket and tech support is likely going to be submitting a bug. config webfilter search-engine edit " google" set hostname " .*\\.google\\..*" set url " ^\\/((custom|search|images|videosearch|webhp)\\?)" set query " q=" set safesearch url set safesearch-str " &safe=active" next edit " yahoo" set hostname " .*\\.yahoo\\..*" set url " ^\\/search(\\/video|\\/images){0,1}(\\?|;)" set query " p=" set safesearch url set safesearch-str " &vm=r" next edit " bing" set hostname " www\\.bing\\.com" set url " ^(\\/images|\\/videos)?\\/search\\?" set query " q=" set safesearch url set safesearch-str " &adlt=strict" next edit " yandex" set hostname " yandex\\..*" set url " ^\\/yandsearch?\\?" set query " text=" set safesearch url set safesearch-str " &fyandex=1" next edit " youtube" set hostname " .*\\.youtube\\..*" set safesearch header next edit " baidu" set hostname " .*\\.baidu\\.com" set url " ^\\/s?\\?" set query " wd=" set charset gb2312 next edit " baidu2" set hostname " .*\\.baidu\\.com" set url " ^\\/(ns|q|m|i|v)\\?" set query " word=" set charset gb2312 next edit " baidu3" set hostname " tieba\\.baidu\\.com" set url " ^\\/f\\?" set query " kw=" set charset gb2312 next end

[billp]

Could you be more specific on what you do with IPS to block Google Safe=off?

I made a mistake. It' s Application Control. I would go to UTM, Intrusion Protection, Application Control, Application Control List. Open or create a new list. Then add Google.Search_Safe.Off as an application and set the action to Block. Assign the Application profile to the applicable Firewall rule. I found that this solution worked to a degree. It was not consistent, though. And if someone had turned off safe search, it would completely block their access to Google Images with a timeout error. You then need to instruct the user on how to change the safe search setting. Additionally, once they got access to the Google Images site again, they appeared to be able to change the Safe Search setting to Off. My guess is the behavior varies with different browsers. I also played around with making my own IPS sensors for this traffic with some success. Google changes their site and parameters often enough, though, that this was a moving target and I gave up. Would you be willing to post your support ticket # to the forums? The link below has information on how to block Google SSL searching for your entire domain. [link=]http://support.google.com/websearch/bin/answer.py?hl=en&answer=186669[/link]

[pkley]

This partially works. On Bing, it works fine it blocks the images in Firefox IF I also have a URL filter for *.explicit.bing.net. Otherwise Firefox will let you mouse-hover and see the image. However, in IE it blocks them but if you hover the mouse it displays the image, even with the URL filter. On an Android with Dolphin browser it' ll block the images but if you click More then they' re revealed??? What the heck??? Same on the stock browser Bing will show if you click More. On Google search there' s a larger issue where it will always redirect to HTTPS if you' re signed in with any Google service like email. On Android by default it' s http, so safe search does actually work. If you manually go to HTTPS://google.com it' ll show anything you want on image search. ...edit... Ok, so there is a way thru config system dns-database to add a cname record which absolutely works...unless you have a 40C on 5.0 and they stripped out the ability to run the DNS server on the FortiGate...YOU' VE GOT TO BE KIDDING ME...