Troubleshooting macOS Web Protection in Nebula

Issue

Web Protection for macOS is not properly allowing and blocking domains.

Environments

• Nebula
• macOS
• Google Chrome
• Mozilla Firefox
• Safari

Symptoms

End users are able to access blocked domains, or are not allowed to access excluded domains.

Cause

• Missing network extensions
• Network filter disabled
• Full Disk Access not granted
• DNS cached

Resolution

Open a web browser and navigate to http://iptest.malwarebytes.com to verify if Web Protection is working. If you are able to reach the page, that means Web Protection is not working on the endpoint.

Follow the steps below to resolve this issue.

Check Network extension is installed and active

1. Open Terminal
2. Run the following command
   systemextensionsctl list | grep ncep.engine.sys
3. Output should look similar to this
   * * GVZRY6KDKR com.malwarebytes.ncep.engine.sys.ext (5.6.0/5.6.0.0) Malwarebytes Engine [activated enabled]

Check Network filter is enabled and green.

1. Open System Settings.
2. Go to Network.
3. Look for MB-EngineHostApp-NCEP Content Filter. 
4. Verify there is a green dot next to it.

For more information, see Allow system extension for Web Protection on macOS devices - Nebula.

Check Full Disk Access permissions

1. Go to System Settings.
2. Go to Privacy & Security > Full Disk Access.
3. Verify Full Disk Access is enabled for Malwarebytes Endpoint Agent and Malwarebytes Protection.

For more information, see Grant Full Disk Access on Mac devices in Nebula.

Enable Debug logging

1. Hold the Control key and left-click on the endpoint agent icon in the menu bar.
2. Select Enable debug logging.

For more information, see Enable debug logging on the Endpoint Agent.

Flush DNS Cache

1. Quit your web browsers.
2. Open terminal
3. Run the following commands:
   1. dscacheutil -flushcache
   2. sudo killall -9 mDNSResponder
   3. sudo killall -9 com.malwarebytes.ncep.engine.sys.ext

Note: If you don't have access to use sudo commands, reboot the machine instead.

Clear DNS cache

Follow the instructions below to clear the DNS cache for the impacted browser.

Safari

1. Open Safari
2. Go to Settings > Advanced.
3. Check Show develop menu in menu bar.
4. In the Menu bar, go to Develop > Empty Caches.
5. Restart Safari.

Chrome

1. Open Chrome.
2. Enter the following address in the address bar:
   chrome://net-internals/#dns
3. Click Clear host cache.

Firefox

1. Open Firefox
2. Enter the following address in the address bar:
   about:networking#dns
3. Click Clear DNS Cache.

Attempt to access the conflicting website in the web browser that saw the initial failure again. If the issue is resolved, disable debug logging by holding the Control key and left clicking on the endpoint agent icon in the menu bar, then clicking Disable debug logging.

If the issue persists, continue on to gather configuration info for support. 

Gathering configuration and state

Follow the steps below to gather additional information on the machine and browser configuration to provide to support. This helps to further diagnose and resolve the issue.

1. Open Terminal.
2. Execute the following commands and take note of the output:
   1. nslookup www.example.com
   2. nslookup example.com
   3. dig www.example.com
   4. dig example.com
   5. curl -i www.example.com
      Only take note of the output if the command fails and there is no body in the response.
   6. ifconfig
3. Open System Settings and search for DNS Servers. Take note of all DNS servers that are configured.
4. If the failure occurs in Chrome:
   1. Open Chrome.
   2. Enter the following address into the address bar
      chrome://settings/security?search=dns
   3. Take note of the Safe Browsing setting
   4. Take note of the Use secure DNS setting.
5. If the failure occurs in Firefox:
   1. Open FireFox.
   2. Revisit the problematic domain.
   3. Enter the following address into the address bar
      about:networking#dns
   4. Take note of DNS Suffix, DoH URL, DoH Mode
   5. Check the list of resolved domains for the failing domain and take note of the resolved hostname, addresses, and the Expires (Seconds) value.
6. Collect Endpoint Agent diagnostics. For more information, see Collect Endpoint Agent diagnostic logs in Nebula
7. Disable Debug logging.