topic Re: Blocking YouTube channel - looking for working solution in General Topics

Blocking YouTube channel - looking for working solution

Animex — Tue, 20 Dec 2016 11:35:41 GMT

I'm trying to block all YouTube channels and allow to pass only few of them.

For first look it should be easy, one rule for passing allowed channels and second rule for blocking all other channels.

But it doesn't work .

Youtube of course use URL to open channel but later downloading streaming from others addresses .

Not sure how to isolate addresses from which YouTube download video and pass only them .

I've seen many cases and helps but maybe it worked in 2015 but on December 2016 all of them just don't work.

What is worse transmission is encrypted and PaloAlto decrypting works strange and sometimes even not at all with Google .

So I'm asking you if maybe someone has working solution how to deal with YouTube channels ?

Best Regards

Re: Blocking YouTube channel - looking for working solution

BPry — Tue, 20 Dec 2016 15:05:25 GMT

To get this to work correctly you are going to have to disable QUIC across all chrome installs, then and only then will decrypting Google traffic work 100%.

Re: Blocking YouTube channel - looking for working solution

Animex — Wed, 21 Dec 2016 13:32:43 GMT

I've disabled QUIC some times ago and we are talking about Internet Explorer .

Still no working solution for youtube channels blocking. 😞

Re: Blocking YouTube channel - looking for working solution

BPry — Wed, 21 Dec 2016 14:42:27 GMT

You should be able to get this working then, although not at all easily. If your disabling all of YouTube that should be working failry well if you decrypt traffic. Allowing select channels is where you are really going to begin running into issues as the content tends to move around a lot for low volume channels. You'll need to monitor the URLs that are being used and then create an allow rule for them. Simply getting users to the channel page as you have no doubt figured out isn't that difficult, loading those videos and making sure that you allow those sources is tricker and will involve a fair amount of time.

Re: Blocking YouTube channel - looking for working solution

Animex — Thu, 22 Dec 2016 11:10:20 GMT

It's more complicated than people thought.

Block all youtube channel is easy. Allowing few youtube channels is easy by allowing strict URL .

Here problems started. Video streaming is downloading from google cloud and have nothing with allowed URL.

If you allow url you still block google cloud and you won't see anything. If you allow google cloud you allow all youtube streaming regardless of not allowed youtube channels .

Thinking and thinking how to resolve this puzzle .

Adresses from which youtube streams video has nothing with allowed URLs and you cant allow adresses from youtube cloud because it's allow all youtube streaming .

Of course I decrypt all youtube transmission.

Any thoughts ?

Best Regards

Re: Blocking YouTube channel - looking for working solution

Animex — Tue, 27 Dec 2016 09:20:27 GMT

Any idea how to allow downloading from youtube cloud but only allowed youtube video.

Still no idea how to do it.

Best Regards

Re: Blocking YouTube channel - looking for working solution

BPry — Wed, 28 Dec 2016 14:50:41 GMT

You won't be able to. If your blocking where YouTube holds the actual videos from an applicaiton level then even when you allow access to the URL your still going to be blocking the video that is needed.

If this needs to be done for training I would recommend seeing if the content creator will allow you to download the video from YouTube using one of the many download programs and storing them on a file share that everyone can access.

Re: Blocking YouTube channel - looking for working solution

jdelio — Wed, 28 Dec 2016 23:31:01 GMT

This is a confusing topic, You can refer to this if it will help at all, this shows how to allow 1 video but block others..

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Allow-a-Single-YouTube-Video-and-Block-All-Other-Videos/ta-p/58944

Re: Blocking YouTube channel - looking for working solution

Animex — Thu, 29 Dec 2016 10:15:15 GMT

@BPry

I think you are right alone I can't do this alone without help from PaloAlto . As long as youtube will separate channel and video streaming. Sad :(( I pay a lot for one of best NGFW and can't do simple filtering 😞 Shame

@jdelio

The article is very old , useless in 2016 and if you read comments you will see that it doesn't work and people still looking for working solution .

Re: Blocking YouTube channel - looking for working solution

BPry — Thu, 29 Dec 2016 13:48:57 GMT

@Animex, I just wanted to make it clear that you can actually make this work. This isn't by any means quick and you will likely need to keep the policies updated due to Google itself switching things around to keep them up. Like any website if you block a part of it from loading (such as the video) you only recieve what you actually have access to; since you are blocking YouTube from pulling that content it won't be displayed unless you build a rule allowing access to the storage source, and allow the application through.

ONe thing that people seem to forget with NGFW is that everything we want these boxes to do is actually really complicated due to the services that we want them to 'filter'. Dynmaic sources and service providers moving things around makes everything even harder; so when you want to block all of an application but this one little thing then it just keeps getting harder and harder to do it.

To be clear, you can accomplish this with a PaloAlto device. The upkeep to keep a rule as complicated as this working when Google decides to move things around gets a lot more difficult because you won't realize that it's broken until someone brings it up.

Re: Blocking YouTube channel - looking for working solution

Animex — Thu, 29 Dec 2016 14:10:23 GMT

Maybe I "CAN" but when from one IP adress youtube stream video for few chanels it won't allow only one youtube channel but at leat few, at least .

Of course I can isolate only few IP address fom which youtube streams video but still I can watch much more youtube channels than I want .

Later you have to watch it and change all the time IPs when youtube it changes.

For me still I can't do exactly what I want . Doing more or less what I want = tricky but doable .

Best Regards

Re: Blocking YouTube channel - looking for working solution

jdelio — Thu, 29 Dec 2016 17:32:03 GMT

@BPry, You said that perfectly. It is like a shape shifting target to shoot for. Just when you think you have it, it changes.

Re: Blocking YouTube channel - looking for working solution

xhoms — Fri, 07 Jul 2017 06:45:30 GMT

An article describing how to achieve this goal with the experimental MneMeld miner at https://github.com/PaloAltoNetworks/youtube-miner is available at Filtering YouTube videos to only approved playlists