Web filters logs

Product Discussion Feature Requests
1

Hi all…

keeping on testing with BR1 devices, playing with filters

I already asked for a “denied page” (see Peplink | Pepwave - Forum)…

I’d like to know:

  1. which rules/filters are used, with the higher detail (if possible)
  2. if is there any log available… I have customers helping us in the testing, but it’s hard to debug problems without logs… let’s say I have a web page with ADs… some of them may be blocked by filters… if so, customer reports me “the page is not working, our customers are complaining that web browsing doesn’t work”

thank you in advance

S.

2

Hi,

URL logging is supported for firmware version 6.3.1 & above. You can enable URLs logging to keep users browsing history at the syslogs server.

504×543 40.3 KB

Beside the requested block page/denied page feature, firmware version 6.3.2 also allow users to download the content filtering database from the device. User can search thought the content filtering list to know which URLs is block by which Web Blocking Categories. For more information, please refer to the screenshot below:

How to download content filtering database:

774×478 37.1 KB

Blocked Lists

622×543 18.9 KB

The above feature will help you to troubleshoot the web blocking issue.

3

nice, thank you

BTW, trying to download the blk_list*.csv file from the web interface accessed via incontrol just gives me a white page (maybe a timeout somewhere)
I have to connect directly to my device

4

just enabled url logging on a test BR1

logs look like:

Jul 18 15:26:36 my_BR1_name URL Logging: Domain <mobile.pipe.aria.microsoft.com> has been blocked by content filter category <updatesites>
Jul 18 15:26:36 my_BR1_name URL Logging: Domain <mobile.pipe.aria.microsoft.com> has been blocked by content filter category <updatesites>
Jul 18 15:27:40 my_BR1_name URL Logging: Domain <mobile.pipe.aria.microsoft.com> has been blocked by content filter category <updatesites>
Jul 18 15:27:40 my_BR1_name URL Logging: Domain <mobile.pipe.aria.microsoft.com> has been blocked by content filter category <updatesites>
Jul 18 15:27:40 my_BR1_name URL Logging: Domain <mobile.pipe.aria.microsoft.com> has been blocked by content filter category <updatesites>

and that’s fine enough… but I don’t know anything about IP/MAC address of the connected device…

5

Hi,

The URL logs will shown/separated into 2 lines …
Access:
Jul 19 10:13:12 mfa-379f URL Logging: URL=http://www.porn.com/ SRC=172.16.200.12 DST=127.0.0.1 SNATIP=172.16.200.12 SRCMAC=38:aa:3c:73:14:5f SPT=42509 DPT=8080

Blocked:
Jul 19 10:13:12 mfa-379f URL Logging: Domain <www.porn.com> has been blocked by content filter category <porn>

Access:
Jul 19 10:13:24 mfa-379f URL Logging: URL=http://www.playboy.com/ SRC=172.16.200.12 DST=127.0.0.1 SNATIP=172.16.200.12 SRCMAC=38:aa:3c:73:14:5f SPT=42827 DPT=8080

Blocked:
Jul 19 10:13:24 mfa-379f URL Logging: Domain <www.playboy.com> has been blocked by content filter category <porn>

Thank You