Using NXFilter as DNS blocks Apple updates

[pben...@shcsprescott.com]

Hi

We are using NXFilter as DNS and this consistently blocks all Apple updates, along with apps like Kahoot and Code Squad.

I had turned off NXFilter for a month, and everything was running great, but then the kids started bringing up porn from Google searches.

I tried to whitelist *.symcb.com but the Test Run of s2.symcb.com returns 

InvalidContentTypeException : Content-Type = application/ocsp-response

I expect that is why NXFilter is ignoring the Whitelist.

Not sure what to do at this point. I have to have the updates but I cannot have the porn.

[Jahastech]

I don't think 'symcb.com' has its website to be viewed on a browser and that's why you get that content type error.

You don't want to whitelist '*.apple.com'? I thought that's the domain we whitelist for apple update.

[Jahastech]

But in the first place, why your NxFilter blocks Apple updates? Which category do you block?

[pben...@shcsprescott.com]

Hi

See Attached images

We use remote management with Tabpilot. When I get a new iPad, I turn it on and it loads our configuration.

We also use Untangle. If I set NXFilter as DNS Override then the iPads will not load our configuration. 

Looking at the logs of what is being blocked by NXFilter while the iPad is attempting to load our configuration

I see blocked requests to s2.symcb.com

I have not tested what requests are being blocked when the teachers attempt to use Kahoot and Code Squad apps.

[Jahastech]

s2.symcb.com seems to be a Phishing/Malware site or at least Adware. The right one for SSL related things would be 'symcd.com'.

And I see you already bypassed '*.apple.com'. Do you not see other sites blocked? There may be some CDN site blocked. Do these steps.

1. Create a user account for you iPad.

2. Create a policy for the user.

3. Allow everything on the policy.

4. See if your iPad working.

5. If it's working apply your old policy for the user and see the blocked sites.

[Jahastech]

It's not so clear to confirm if it's a malware site or not. Some says it is but others no. Anyway try the steps I suggested.

[pben...@shcsprescott.com]

OK I did it.

The Policy checkboxes that were blocking my iPads from receiving the Remote Management configuration were:

1. Ad-remove "Block adware with blank-page."

2. Under Blocked Categories:

    a. Ads

    b. ad-remove

None of the other categories affected the iPads as far as I was able to test.

I tested with 15 brand new iPads. I have not tested the Kahoot and Code Squad apps yet.

Thanks!

[Jahastech]

Did you not check the log-view then? Probably some domains in Ads are related to your iPads update.