Students have found MIT App Inventor projects which emulate a web browser and completely bypass our web filtering. Both our proxy based filtering and GoGuardian don't seem to stop this. Are there any available controls that could stop this or prevent App Inventor apps from being able to access the internet?
Thank You
Probably not. The students have found the WebViewer. 
MIT developers have been asked to provide more definitive advice; stay tuned
@JustSomeAdminGuy Can you provide us more information about your setup? Specifically, are the students running the AI Companion on physical devices or are you using the emulator? If they are using the emulator, which version of the setuptools package are you using and on which operating system and version?
For physical devices, one option would be to have the devices set up on a separate VLAN where you can control the firewall rules, filtering etc. Your options w.r.t. the emulator configuration are more complicated so it would be useful to know more first.
From my understanding this is being done using the MIT AI2 Companion app on Chromebooks. Here is what we have set in Google Admin...
Thanks for the information. The Android apps in the Chromebook, which includes our companion app, should be running in a sandbox on the Chromebook. My understanding is that this sandbox still routes through the Chromebook's existing network connection. Is your blocking mainly at the ChromeOS level or are you blocking at the network level, such as IP addresses, ports, etc.?
Thank you for following up. We use iBoss and GoGuardian. GoGuardian looks directly at what the browser is accessing so the fact it cant see what is going on inside of App Inventor doesn't surprise me. iBoss sets a proxy in ChromeOS. So nothing at the network level outside of the ChromeOS, except DNS filtering but that isn't enough to stop these kids from doing much.
If iBoss works with Android, it might be possible to deploy the proxy configuration within the Android sandbox as well. I haven't dug much into the Android on ChromeOS options in the GAE console but there may also be a way to push the proxy config that way.
A Google search yield this help article, although it is unclear to me whether the settings also get applied to the Android side of the ChromeBook or if they'd just take affect on ChromeOS.
In line with what you mentioned...
An foums post where an admin discusses installing the Zscaler app into the emulated android environment. So I may try the same with iBoss.
