Websites blocking on Android

[Bock]

Hello, I am having a problem with Fortigate.

It seems like some websites are being blocked only on Android, when I use a laptop or Ios everything is working fine. When I try to see the logs I can't see that a website is being blocked.

I would apprentice any help.

[sw2090]

Do you have AppControl active on your internet policies? Then the App Signatures may cause that...

[Bock]

Thanks for the reply. Yes AppControl is active. By going on Chrome settings and changing the Use Secure DNS to Google (Public DNS) instead of current service DNS the websites that were being blocked are working.

Is it possible to fix this issue from Fortigate please? Instead of having to change the Secure DNS from Chrome. Thank you.

[Bock]

On Fortigate by switching off TLS and switching on DNS from DNS settings solved the issue. I am not sure if this will effect other things.

[abarushka]

Hello,

Can you please elaborate what you are referring to by switch off TLS on FortiGate side?

[Bock]

Hello, I used the setting below. Before only TLS was switched on.

[pbangari]

Hi,

Please help us with DNS packet captures to see what is happening when you use TLS protocol for DNS service.

# diag sniffer packet any "(host <Android user IP address> or host <public IP address on the FGT) and port 853" 6 0 a   ---------------ctrl+c to stop the pcap

Fortigate

[kaman]

As you informed after switching on DNS (UDP/53) from DNS settings you are able to access the website.

DNS primarily uses the UDP protocol on port 53 to serve the address resolve requests.

The FortiGate DNS Filter inspects the UDP protocol on port 53 traffic that traverse FortiGate, and based on the DNS Filter profile configuration, makes the Allow/Monitor/Block or Redirect decision for the inspected traffic.

DNS over TLS (DoT) is a security protocol for encrypting and encapsulating DNS queries and responses over the TLS protocol. DoT increases user privacy and security by preventing eavesdropping and manipulation of DNS data via man-in-the-middle attacks.

Before enabling DoT or DoH, ensure that they are supported by the DNS servers. The legacy FortiGuard DNS servers (208.91.112.53 and 208.91.112.52) do not support DoT or DoH queries, and will drop these packets. Disabling DoT and DoH is recommended when they are not supported by the DNS servers.

Please refer to the below documents for more understanding:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Changing-nbsp-the-nbsp-DNS-nbsp-protocol-n...
https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/42181/dns-over-tls-and-https....

[Wordgamer22]

Here are some ways to block websites on your Android phone:-

1. Parental Control Apps:-

• Download a parental control app like Qustodio, Kaspersky Safe Kids, or Google Family Link.
• These apps offer website filtering features where you can specify websites to block.
• They often come with additional features like app blocking, screen time management, and location tracking.

2. Website Blocker Apps:- Apps like BlockSite, Freedom, or Stay Focused allow you to create a blocklist of specific websites, & some offer features like scheduling website blocking or password protection for the blocklist.
3. Google Chrome:-

• Open Chrome settings (three dots in the top right corner).
• Go to "Settings" > "Privacy and security".
• Under "Safe Browsing", enable "Enhanced protection". This helps block malicious and dangerous websites.

4. Third-party Browsers:- Some browsers like Firefox or Edge offer built-in content blocking features, & check your browser's settings for options to restrict access to certain websites.

5. Change DNS Settings:- You can configure your phone's DNS settings to use a service like OpenDNS that offers website filtering options, & this method applies to all internet traffic on your phone.
6. Router-Level Blocking:- If your router supports website blocking, you can configure it to restrict access to specific websites for all devices connected to your network, & this is a more comprehensive solution but requires accessing your router's settings.

More details instruction below.

https://www.youtube.com/watch?v=sOlUyyIsHDA&ab_channel=TheGeekPage