How To Block Youtube In Fortigate Firewall

By Manny Fernandez

April 20, 2020

Restricting YouTube to Specific Channels on FortiGate Firewalls

Please note that YouTube is changing the manner it categorizes content to comply with COPPA (Children'due south Online Privacy Protection Act). Yous will need to either set your video or the entire channel as "Made for Kids". When a video is categorized as "Fabricated for Kids" there will exist some features not available:

Comments
Personalized Ads
Info Cards
End Screens

When the entire channel is "Made for Kids" other features will not exist available either such as:

Stories
Customs Tab
Notification Bong
Relieve to watch later
Save to playlist

Here is a smashing video explaining the details By: Head of Family Partnership at YouTube

Lets go started.

Getting Channel ID

First matter we need to do is place the the YouTube channel-ID. To do this, you will need to go to the YouTube channel and copy the URL

https://www.youtube.com/channel/UCzQUP1qoWDoEbmsQxvdjxgQ

In the case in a higher place, the aqueduct ID is UCzQUP1qoWDoEbmsQxvdjxgQ

This is the channel ID for Joe Rogan Experience one of my favorite podcaster/YouTuber.

2020-04-20_20-02-55

Now lets become to the ForitGate

FortiGate Configuration

2020-04-20_22-35-07

You will need to go to:

Security Profiles
Spider web Filter
In my case, MonkeyBusiness-Spider web

2020-04-20_22-39-46

We volition focus on three locations inside the Web Filter profile. Next I will show the details of what needs to be modified.

Restrict YouTube Admission

In gild for this to work correctly, you volition demand to ready the Restrict YouTube Admission to Moderate

2020-04-20_22-43-22

Enable it be clicking the radio button and selecting Moderate

URL Filtering

Side by side you will demand to enable URL filtering by clicking the radio button.

2020-04-20_20-39-14

Next you will need to select Create New

2020-04-20_20-38-16

Enter *.youtube.com and ensure that you select the Wildcard blazon, and finally set the action to Block.

This volition cake all of YouTube except for the whitelist below.

Whitelist YouTube Channel

We volition need to enable this section by again clicking the radio button to plough it on.

2020-04-20_20-39-14

Next you volition need to Create New

2020-04-20_20-39-41

As you can encounter in the screenshot, the Channel ID matches the Joe Rogan Experience channel ID from the first section UCzQUP1qoWDoEbmsQxvdjxgQ. Optionally, only recommended, you can add a comment. Click OK to save the channel ID.

Save this Spider web Filtering Profile to be used next.

Creating the IPv4 Policy

We will at present need to create a policy to put it all together.

2020-04-20_20-41-32

Hither are the components for my policy.

Requite the policy a name
Incoming Interface (This is my SSID where I have my test Windows 10 machine)
Outgoing Interface (My 1Gb Internet Connection)
This is an accost object representing the IP address of my Windows 10.
Make sure this policy is in Proxy-based inspection manner. In older versions of FortiOS, you volition need to set this globally.
Choose the Web Filter contour we created earlier.

Additionally, you lot volition need to take Deep Package Inspection enabled likewise.

Optional (If you do not accept this already pushed to PC)

In my case, I had not installed my FortiGate document for SSL decryption.

Snag_1ab5b59d

I logged into the FortiGate from my Windows 10 machine. Went to Security Profiles then SSL/SSH Inspection . Next I chose the Manny-DPi contour and cull to Download from this screen.

I downloaded it to the Desktop and then double clicked on it. Information technology displayed the certificate and I chose to Install Document from the bottom of the window.

Snag_1ab57dc4

You will be presented with a Security Warning and you volition need to choose Yes

Snag_1ab53e69

You will demand to install information technology into the Trusted Root Certificate Regime store.

Snag_1ab54d0f

Cull Finish

Snag_1ab543b8

Results

These are the results

Snag_a77bf

Here nosotros can see a YouTube channel I tried to lookout man and information technology was blocked with the standard (in my case, custom) Block Page.

Snag_a8888