Whitelisting a specific URL

[ZanG]

Hi,

I would like to know if there is a possibility to whitelist only a specific url - for example a specific video on Youtube.

We have Youtube blocked for most of our users, but would like to allow all of them to see only videos from our youtube channel.

I've tried with this rule:

I've entered the url in a few different ways (with and without the protocol, with * at the end, etc):

And it doesn't work - I get a blocked screen.

I would like to point out that the rule works if I choose url.host as criteria and put in only the domain (www.youtube.com) - but then the wole youtube is accessible, which I don't want.

Thank you and best regards,
Zan

[mkutrieba]

Hello,

at first, we have a youtube API v3 filtering rule set for better managing:
https://contentsecurity.mcafee.com/ruleset_library?q=%22youtube+api+v3%22

Regarding the request, this is depending on how you block youtube videos.

If you block by category Streaming media for example, then this is nearly impossible on this way. Problem is that multiple requests are made in background for single youtube video and the video itself is not coming from youtube but from googlevideocontent or googleusercontent or similar. Means, you also would need to allow these URL hosts. This is a lot of work and complicated.
This could be checked with rule traces.

If you only block youtube URL host and not by category streaming media, then most-likely the CONNECT requests is already blocked. The full URL can only be seen on MWG if SSL Scanner was triggered and content inspection was made.
The order is 1) CONNECT request to youtube.com (and here often the youtube block rule hits), 2) CERTVERIFY request and 3) GET request to youtube.com (here you see the full URL which you can use for filtering.
So this means, that a bypass rule needs to be made, to allow CONNECT and CERTVERIFY cycle for such URL hosts in the rule set where you block youtube by URL.Host property. Once this is allowed, the CONNECT will be bypass and not be blocked, same for CERTVERIFY, then content inspection is made, full URL is seen and the GET request should run into your bypass rule where you want to allow specific URLs and should match.

Example:
Rule set "URL Filtering"
1. bypass CONNECT and CERTVERIFY for special URL hosts
(Command.Name equals CONNECT OR Command.Name equals CERTVERIFY) AND URL.Host equals youtube.com (alternatively "is in list <listname>"), Action: Stop Rule set
2. Bypass specific Youtube URLs
URL matches/is in list <list with full URL>, Action: Stop Rule Set
3. Block Youtube
URL.Host equals youtube.com, Action: Block

So, CONNECT and CERTVERIFY would be allowed in first rule, then GET request comes in and goes to second rule. Here it is bypassed if it is matching and if not, it will be blocked in third rule. If you do not have this, CONNECT request is running in second rule but not matching as it only sees CONNECT youtube.com and then it would be blocked in third rule already.

It is little bit complicated to understand only by text. So if there are open questions or you still cannot get it to work, would advise to create a ticket and attach feedback file, rule trace and call the URL you want to bypass.

Regarding the youtube filtering rule set, this, of course, also only works if streaming media is allowed. If you block streaming media in total, all other URL hosts where videos are coming from are blocked, means the filtering rule set would also not help.

Hope this helps a little bit and let me know if you have further questions.

[ZanG]

Thank you for your quick reply.

Yes, we block content by category. I tried with rule trace and it shows me only that youtube domain was blocked by category blocklist:

I tried to combine both rules - the one that allows certain users to access whole youtube (1st one, url.host - this one by its own works) and the one that should only allow certain urls (2nd one, URL):

But it still doesn't work.

Thank you.

[aloksard · Accepted solution]

@ZanG 

PFA

[ZanG]

Thank you both! At the end I tried importing aloksard's rule. I had to modify it a bit (for the needs of our organisation) and it works!

Thanks again!

[mkutrieba]

Hello,

yes rest of the URLs like googleusercontent is now shown as youtube.com is already blocked and the other URLs would be requested from youtube in the background, therefore you do not see them yet.

So special whitelisting for certain URL hosts is needed and Alok provided a rule set which you can import doing such tasks. Might be possible that it perfectly works, might be possible that some things needs to be update in case on youtube's end something has changed. But this rule set refers to my mentioned point 1, that multiple things needs to be bypassed from category block as youtube videos are coming from other resources.

Have a look and try it out, let us know if you have further questions.