What Your School Firewall Can Tell You About E-Safety (And What It Can't)

Firewalls are a cornerstone of school IT infrastructure. They block malicious websites, filter adult content, and help prevent network-based attacks. But when it comes to e-safety—the day-to-day well-being of students online—firewalls can only go so far. 

This article explores what firewalls can and can't tell you about student behavior online, particularly in relation to online safety, and how dedicated tools like Fastvue fill the gaps with actionable insights gleaned from your school's network to help pastoral care, wellbeing, and safeguarding teams keep students safe online.

What firewalls do well

Let's start with what firewalls are designed for:

Threat Protection

Firewalls utilize techniques like deep packet inspection (DPI), intrusion prevention systems (IPS), and integration with threat intelligence to detect and mitigate sophisticated cyber threats. They are capable of handling known and unknown threats, including malware, ransomware, and zero-day exploits.

Application Control & Content Filtering

Firewalls offer granular control over applications, allowing organizations to manage traffic based on specific applications rather than just ports and protocols. Firewalls can also block internet access to categories of inappropriate websites and content, such as pornography, gambling, and violence, which is crucial for ensuring internet safety.

User and Device Access Control

Firewalls also give you enhanced control over user activities and network traffic. Firewalls govern what types of traffic are allowed into or out of specific networks based on user identity, device type, location, and other factors. This helps manage web traffic and ensure compliance with security policies.

Where firewalls fall short on e-safety

While firewalls are excellent at blocking threats and filtering content, they weren’t built to decode student behaviour or provide the context that pastoral teams need. Let’s look at the critical areas where firewalls struggle and how dedicated monitoring tools can step in to help.

1. Website visits: Lots of noise, not much clarity

Firewalls log all kinds of internet traffic, but they lack the depth of monitoring software: everything from websites visited to background services, content delivery networks (CDNs), ad tracking pixels, and social media plugins. When reviewing logs, actual websites like YouTube or National Geographic often get buried under entries for 'Google Video', 'Akamai', or 'Twitter Widgets', even if the students never visited sites directly.

This creates cluttered reports full of irrelevant data, making it hard to identify which websites students actually accessed.

Fastvue's SiteClean technology filters out the noise. It provides a clean, human-readable view of browsing activity, making it clear whether a student was watching the footy or trying to access something inappropriate and possibly illegal.

2. Search terms: Most firewalls don’t show them

Most firewalls don’t actually log search terms; they just record the full URL. This looks like a long, horrible string (like https://www.google.com/search?q=my+search+term&asdl;kjasdf;ljasdf;lkjasdf;lkajsdf;lkajsdf) that’s hard to interpret, especially at scale. Fortinet FortiGate is currently the only firewall that logs search terms as a separate, searchable field. 

This means schools often have little to no visibility into what students are actively searching for online, whether for help, out of curiosity, or something more concerning. 

3. Keyword matching: False positives and unnecessary noise

Most firewalls rely on simple keyword matching in URLs without any kind of contextual filter or exclusion. That means URLs containing strings like ‘sex’— msexchange.com (Microsoft Exchange) is a classic example—can be flagged, even when the content is completely harmless.

This issue, known as the Scunthorpe Problem, has been plaguing filters for decades. It causes false positives, clutters reports with irrelevant alerts, and makes it harder for teams to focus on real risks. 

In many cases, monitoring and reviewing user activity provides a more balanced (and accurate) approach than blanket blocking, giving schools a better context to decide when and how to step in, without overwhelming staff with false alarms.

4. Video monitoring: Limited and incomplete

While firewalls may log that a student accessed YouTube, they typically don't provide:

• The video title

• The thumbnail

• The YouTube channel

• Watch duration

• Whether the video was viewed in full

This becomes problematic when a harmful or disturbing videos go viral amongst classmates, particularly if the video involves violence, suicide, or extremism. In these cases, knowing a student clicked on a video isn't enough. Schools need detailed reports showing who watched it and for how long.

Fastvue solves this by retrieving YouTube video metadata, including titles, thumbnails, and watch time, so school administrators can quickly determine which students were exposed to high-risk content.

5. Messaging apps: A blind spot for firewalls

Most modern messaging apps, such as Snapchat, TikTok, Discord, Instagram, and WhatsApp, are end-to-end encrypted, meaning firewall monitoring is effectively blind to message content or recipients. In many cases, attempts to decrypt this traffic simply break the apps altogether due to certificate pinning.

Even school-approved platforms like Google Chat and Microsoft Teams fall outside the reach of standard firewall filtering and monitoring.

Fastvue is actively developing secure, API-based integrations that will give schools meaningful, permission-controlled visibility into student communications across platforms like Microsoft Teams and Google Chat—bridging the current gap in safeguarding oversight. Stay tuned!

6. AI Prompts: Hidden in plain sight

With the rise of AI tools like ChatGPT, many schools initially tried to block access to AI altogether. But AI is increasingly embedded in unexpected places like Google Sheets Extensions, Notion, and a growing number of educational and productivity platforms, with no signs of slowing down.

Therefore, many schools are taking the approach of embracing AI and educating students on how to use these tools effectively to improve their understanding of complex subjects, brainstorm ideas, and start mastering the nuanced world of ‘prompt engineering’ to improve the speed of their learning. At the time of writing, Fortinet FortiGate is the only firewall that logs prompts entered into common AI chat applications such as ChatGPT, Claude, and Gemini. Fastvue has developed dedicated AI prompt monitoring for FortiGate, giving schools clear, actionable insight into how students are using tools like ChatGPT. Whether it’s responsible research or attempts to shortcut assignments, Fastvue helps schools stay ahead of emerging risks with full context and visibility.

The real impact of internet monitoring and reporting: From protection to prevention

Firewall logs alone can't give pastoral care and safeguarding staff the clarity they need to act quickly. They're often too technical, too noisy, and too general. Meanwhile, issues like self-harm, suicide ideation, impersonation, cyberbullying, and exposure to inappropriate content continue to rise in schools.

Fastvue is designed to bridge this gap. It transforms technical data into clear, contextual insights that help schools:

• Spot early warning signs of risky behaviour

• Prioritise follow-up with affected students

• Create a simple and repeatable process for daily well-being monitoring

Final thoughts: Why firewalls alone can’t protect student wellbeing online

Firewalls are vital to school cybersecurity, but they're not designed for e-safety monitoring. Expecting a firewall to reveal the full picture of student online behavior is like trying to understand a movie by looking at the network cables behind the screen.

Tools like Fastvue complement your existing setup, offering the visibility and context your wellbeing teams need, without overwhelming them with irrelevant data.