SafeSearch Enforcement Issue on Mobile Devices

[AravindhN]

Requirement
The enforcement is working correctly on laptops with both the web filter and DNS filter enabled. However, on mobile devices, the Chrome browser loads the homepage initially, but subsequent pages are blocked. The expected behavior is that SafeSearch should be enforced right from the homepage, ensuring that even the homepage loads through the enforced SafeSearch..

Use case: College, School

Step-1
Create the loopback interface for enforcing DNS.
Note: The IP address should not be configured anywhere else.



Step 2: Enable the DNS Database under Feature Visibility.



Step 3: Block the P**ography category in the Web Filter and enable SafeSearch.

Step 4: Block the P**ography category in the DNS Filter as well, and enable Enforce SafeSearch.

Step 5: For the DNS-Loopback interface, enable the DNS Filter and set the mode to Recursive.

Step 6: Create the DNS entry for SafeSearch-Google.
I.II.

CLI commands for creating the DNS entry to enforce SafeSearch

config system dns-database

    edit "SafeSearch-Google"

        set domain "google.com"

        set authoritative disable

        config dns-entry

            edit 1

                set type CNAME

                set hostname "www"

                set canonical-name "forcesafesearch.google.com"

            next

        end

    next

    edit "google.com"

        set domain "google.cat"

        set authoritative disable

        config dns-entry

            edit 1

                set hostname "www"

                set ip 216.239.38.120

            next

        end

    next

end



Step 7: Policy Creation

You need to assign the DNS server IP as the Loopback interface IP to the devices. Then, create a DNS allow policy above the internet policy. Make sure that NAT is disabled for the DNS service.

Results:

The Result will be enabled the Enforce search by default to all browsers as mentioned below Screenshot.

DNS filter Logs:

[mamatka6]

It sounds like what you really want is some kind of content blocking at the network level. What you're talking about sounds like deploying an agent of some kind to individual hosts. IMO the network based solution is going to be easier to administrate than an agent master/slave type application.

[Sivaramakrishna]

Here, no agent is required. He tried to block a category (for example, the Adult category), which is successfully blocked on systems but not on mobile devices. To address this, he enforced Safe Search by creating a DNS loopback interface in the firewall, which is mapped to the DNS filter and applied in the policy. This way, users receive the DNS server IP as the loopback interface IP configured in the firewall. Whenever a user tries to access adult content, the DNS server enforces Safe Search.