Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Alternative for MS TMG 2010 = pfSense ???

    Scheduled Pinned Locked Moved Problems Installing or Upgrading pfSense Software
    90 Posts 9 Posters 61.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      rmpf
      last edited by

      Hi, Marcello, you said firewall rules only apply to ips/ networks, but with proxy servers like squid/squidguard/dansguardian http rules can be apply to users. Ok, I have read
      "Tutorial PFFense 2.0: Active Directory -> User Manager - http://forum.pfsense.org/index.php/topic,44689.0.html" but how to apply and specific dansguardian or squidguard rule to an specific user or group??? I don't see any space to assign an active directory user or group???? Because our inmediate situation with ISA we already have some groups created on Active Directory Like Internet Users and IT so the question is how to implement dansguardian or squidguard to limit or allow traffics to specific sites on those groups?

      1 Reply Last reply Reply Quote 0
      • R
        rmpf
        last edited by

        @marcelloc:

        @rmpf:

        For example when creating a new rule you have the possibility to specify to whom apply that rule, maybe a user, maybe a group. How do Pfsense work with that???

        AFAIK, you can only apply firewall rules to ips/ networks.

        Using proxy servers like squid/squidguard/dansguardian you can apply http rules to users.

        att,
        Marcello Coutinho

        1 Reply Last reply Reply Quote 0
        • marcellocM
          marcelloc
          last edited by

          Dansguardian has an ldap tab to fetch users from ad based on groups, take a look on dansguardian topic at packages to see how it works.

          with auth popup, you can follow this how-to(it's in portuguese but translate.google.com can help you)
          http://www.pfsense-br.org/blog/2012/01/pfsensesquidsquidguard-logando-no-active-directory/

          without auth popup, you will need a more advaced setup to apply it, including installing and configuring samba on pfsense.

          Treinamentos de Elite: http://sys-squad.com

          Help a community developer! ;D

          1 Reply Last reply Reply Quote 0
          • R
            rmpf
            last edited by

            Thanks!!! So then is possible to install samba for no auth popup but samba is not on the listed packages… Am I correct?

            1 Reply Last reply Reply Quote 0
            • marcellocM
              marcelloc
              last edited by

              This is the topic(in portuguese again  :)) with a smailll tutorial to setup ntlm authentication on squid

              http://forum.pfsense.org/index.php/topic,47532.msg249812.html#msg249812

              Treinamentos de Elite: http://sys-squad.com

              Help a community developer! ;D

              1 Reply Last reply Reply Quote 0
              • R
                rmpf
                last edited by

                Thanks for the tip!! After completing the configuration witn samba It is possible to log the usernames for audit purposes?????

                1 Reply Last reply Reply Quote 0
                • marcellocM
                  marcelloc
                  last edited by

                  @rmpf:

                  Thanks for the tip!! After completing the configuration witn samba It is possible to log the usernames for audit purposes?????

                  Sure. You can use sarg to create reports.

                  Treinamentos de Elite: http://sys-squad.com

                  Help a community developer! ;D

                  1 Reply Last reply Reply Quote 0
                  • S
                    Supermule Banned
                    last edited by

                    What will then happen if some of the packages get updated and it breaks the config that replaces TMG??

                    1 Reply Last reply Reply Quote 0
                    • marcellocM
                      marcelloc
                      last edited by

                      @Supermule:

                      What will then happen if some of the packages get updated and it breaks the config that replaces TMG??

                      In this case, package maintainers or anyone else can fix the problem or depending on the package and the problem, you can buy some commercial support hours and ask to fix it.

                      And what will then happen if microsoft decides to stop TMG development and keep it just fixing bugs?

                      Treinamentos de Elite: http://sys-squad.com

                      Help a community developer! ;D

                      1 Reply Last reply Reply Quote 0
                      • C
                        canefield
                        last edited by

                        Dear all,

                        I was on holiday a couple of days. I'm back and did a lot of testing and thing are actually working ::). Still I have some questions.

                        1. Has somebody thorough tested the build in OWA functionality? I encounter problems regarding the 'Outlook Anywhere' and 'AutoDiscover' aspects. It can not verify the servers nor the auto configuration. Only the webbased functionality is working like it suppose to be.

                        2. I also could use the 'webservers' and 'mappings' instead. But is it not so that I should than configure all URI's Exchange is using? Or can I use wildcard after the domain, e.g.: ;mail.domain.com/ ?

                        3. Than something else but related ofcourse. Is it possible to create some kind of redirect from HTTP to HTTPS? More specific, when browsing to 'http://webmail.domain.com' it get redirected to 'https://webmail.domain.com/owa'? Yes, all regarding M$ Exchange ;)

                        4. I'm hosting some kind of test-website right now (.NET ASPX). When browsing to that site I get some parts of the page, but seconds later IE is complaining and wants to reload the page. Why is not everything loaded into the page? Pictures especially and links won't work? How, why?

                        5. Related to #4, should I configure Squid Proxy first? Instead of currently only using Reverse Proxy? Anybody a good manual for Squid Proxy with caching, Windows Update, etc.?

                        Thanks a lot,
                        Canefield

                        1 Reply Last reply Reply Quote 0
                        • marcellocM
                          marcelloc
                          last edited by

                          @canefield:

                          1. Has somebody thorough tested the build in OWA functionality? I encounter problems regarding the 'Outlook Anywhere' and 'AutoDiscover' aspects. It can not verify the servers nor the auto configuration. Only the webbased functionality is working like it suppose to be.

                          I didn't  :(

                          @canefield:

                          1. I also could use the 'webservers' and 'mappings' instead. But is it not so that I should than configure all URI's Exchange is using? Or can I use wildcard after the domain, e.g.: ;mail.domain.com/ ?

                          I think wildcards are accepted by config but there are so many paths for owa?

                          @canefield:

                          1. Than something else but related ofcourse. Is it possible to create some kind of redirect from HTTP to HTTPS? More specific, when browsing to 'http://webmail.domain.com' it get redirected to 'https://webmail.domain.com/owa'? Yes, all regarding M$ Exchange ;)

                          The easiest way to do this is and redirect html on webserver

                          @canefield:

                          1. I'm hosting some kind of test-website right now (.NET ASPX). When browsing to that site I get some parts of the page, but seconds later IE is complaining and wants to reload the page. Why is not everything loaded into the page? Pictures especially and links won't work? How, why?

                          take a look on access log file for access_denied urls using tail -f

                          @canefield:

                          1. Related to #4, should I configure Squid Proxy first? Instead of currently only using Reverse Proxy?

                          You can use only reverse functions. I'm planning to build when time permits two conf files one for normal proxy and one for reverse proxy with no changes on gui. This way you can have two log files, one for normal proxy and other for reverse.

                          @canefield:

                          Anybody a good manual for Squid Proxy with caching, Windows Update, etc.?

                          Squid3 package on local cache tab, has these dynamic options o gui.

                          Treinamentos de Elite: http://sys-squad.com

                          Help a community developer! ;D

                          1 Reply Last reply Reply Quote 0
                          • C
                            canefield
                            last edited by

                            @marcelloc:

                            @canefield:

                            1. Has somebody thorough tested the build in OWA functionality? I encounter problems regarding the 'Outlook Anywhere' and 'AutoDiscover' aspects. It can not verify the servers nor the auto configuration. Only the webbased functionality is working like it suppose to be.

                            I didn't  :(
                            Somebody…please

                            @canefield:

                            1. I also could use the 'webservers' and 'mappings' instead. But is it not so that I should than configure all URI's Exchange is using? Or can I use wildcard after the domain, e.g.: ;mail.domain.com/ ?

                            I think wildcards are accepted by config but there are so many paths for owa?
                            I've checked it with the primary paths (/owa, /rpc, /autodiscover, /Microsoft-Server-ActiveSync, /ews, /ecp), without luck. Can sombody help?

                            @canefield:

                            1. Than something else but related ofcourse. Is it possible to create some kind of redirect from HTTP to HTTPS? More specific, when browsing to 'http://webmail.domain.com' it get redirected to 'https://webmail.domain.com/owa'? Yes, all regarding M$ Exchange ;)

                            The easiest way to do this is and redirect html on webserver
                            I want to mange this by pfSense…can that be done?

                            @canefield:

                            1. I'm hosting some kind of test-website right now (.NET ASPX). When browsing to that site I get some parts of the page, but seconds later IE is complaining and wants to reload the page. Why is not everything loaded into the page? Pictures especially and links won't work? How, why?

                            take a look on access log file for access_denied urls using tail -f
                            Could you give me additional information/instructions? I don't now much about Linux.

                            @canefield:

                            1. Related to #4, should I configure Squid Proxy first? Instead of currently only using Reverse Proxy?

                            You can use only reverse functions. I'm planning to build when time permits two conf files one for normal proxy and one for reverse proxy with no changes on gui. This way you can have two log files, one for normal proxy and other for reverse.
                            Perfect!

                            @canefield:

                            Anybody a good manual for Squid Proxy with caching, Windows Update, etc.?

                            Squid3 package on local cache tab, has these dynamic options o gui.
                            Any suggestions how to configure Squid for caching movies (YouTube), pictures, ISO's and Windows Updates?

                            All thank you very much,
                            Canefield

                            1 Reply Last reply Reply Quote 0
                            • marcellocM
                              marcelloc
                              last edited by

                              @canefield:

                              Could you give me additional information/instructions? I don't now much about Linux.

                              go to console/ssh, and do tail -f /var/squid/logs/access.log

                              @canefield:

                              Any suggestions how to configure Squid for caching movies (YouTube), pictures, ISO's and Windows Updates?

                              All options that I saw on tutorials are coded on gui, select these options on local cache tab and traffic mgmt

                              Treinamentos de Elite: http://sys-squad.com

                              Help a community developer! ;D

                              1 Reply Last reply Reply Quote 0
                              • C
                                canefield
                                last edited by

                                Dear Marcello and others,

                                @marcelloc:

                                @canefield:

                                Could you give me additional information/instructions? I don't now much about Linux.

                                go to console/ssh, and do tail -f /var/squid/logs/access.log
                                I've checked the log but is completely blanc

                                @canefield:

                                Any suggestions how to configure Squid for caching movies (YouTube), pictures, ISO's and Windows Updates?

                                All options that I saw on tutorials are coded on gui, select these options on local cache tab and traffic mgmt
                                You mean under 'Services=>Proxy server=>Local Cache'

                                Furthermore I'm trying configuring Squid3 with HAVP and SquidGuard. I read a lot of topics but don't have a clue what to use.
                                INET -> HAVP -> SQUID -> NETWORK or INET -> SQUID -> NETWORK
                                I want the internal network completely secured (HAVP), cached (SQUID) and filtered (SquidGuard).

                                I've tried several configurations, but all without my desires/wishes. Meaning trying to setup HAVP working with Squid and vise versa. Using transparent proxy and so on…no luck at all.
                                So first only used Squid as transparent proxy...but is transparent working. With everything configured I don't see/notice that Squid is my proxy. I did a check on 'whatismyip.com' and nothing illustrates I'm using a proxy; only if I configure it manually. So my first question, how to test if I'm really using the proxy? Second how to combine that with HAVP and SquidGuard? In which order (INET -> HAVP -> SQUID -> NETWORK or INET -> SQUID -> NETWORK) and why would you use/suggest that?

                                Also played around with Postfix. I've tried lots of possibilities, but can't get it to work. What to do for accepting domains and forward those to the appopriate servers? Do I need using the whitelists? Other configurations to keep in mind? When I want Postfix to scan on virusses etc. what is the best thing to use? Mailscanner? Do I need both or just Postfix?

                                And at last…no luck with configuring the reverse proxy. I can't get MS Exchange 2010 working with Outlook Anywhere (Outlook over RPC) nor my test website on ASPX and different host-headers.

                                I appreciate your time and effort,
                                Canefield

                                1 Reply Last reply Reply Quote 0
                                • marcellocM
                                  marcelloc
                                  last edited by

                                  canefield,

                                  I think it's better to split these questions on package forum topics.

                                  att,
                                  Marcello Coutinho

                                  Treinamentos de Elite: http://sys-squad.com

                                  Help a community developer! ;D

                                  1 Reply Last reply Reply Quote 0
                                  • C
                                    canefield
                                    last edited by

                                    Okay will do.

                                    Thx

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.