Unofficial E2guardian package for pfSense

[pfsensation]

@jetberrocal:

Pfsensation

Have you used logmein behind the e2g using mitm?

Nope, however I have used TeamViewer etc, no issues. If you have problems with logmein, just add it to the exceptions.

@Marcelloc, which one is the correct E2Guardian config that we use now? I see a tonne of them in "/usr/local/etc/e2guardian"

I'm asking because FredB, over at GitHub recons that the blacklist categories not showing maybe due to not having the following :

# List categorisation
#listcategory: "Banned Sites"

Check it here: https://github.com/e2guardian/e2guardian/issues/244

[jetberrocal]

@pfsensation:

@jetberrocal:

Pfsensation

Have you used logmein behind the e2g using mitm?

Nope, however I have used TeamViewer etc, no issues. If you have problems with logmein, just add it to the exceptions.

Next week I am going to test with version 4.  With v3 I add it to the exceptions but Logmein did not work.  Teamviewer did worked.  It seems some apps are more strict with MITM.

[marcelloc]

@pfsensation:

@Marcelloc, which one is the correct E2Guardian config that we use now? I see a tonne of them in "/usr/local/etc/e2guardian"

All of them. E2guardian.conf is the main conf and there is a fx.conf for each group conf

[marcelloc]

@jetberrocal:

It seems some apps are more strict with MITM.

Sure they are. Some like skype are not http.

[pfsensation]

@jetberrocal:

@pfsensation:

@jetberrocal:

Pfsensation

Have you used logmein behind the e2g using mitm?

Nope, however I have used TeamViewer etc, no issues. If you have problems with logmein, just add it to the exceptions.

Next week I am going to test with version 4.  With v3 I add it to the exceptions but Logmein did not work.  Teamviewer did worked.  It seems some apps are more strict with MITM.

Use pfSense packet capture under diagnostics in order to log where the traffic is trying to connect to, then use that info in order to add exceptions to it being MITM'd.

@marcelloc:

@jetberrocal:

It seems some apps are more strict with MITM.

Sure they are. Some like skype are not http.

Could you test out getting the blocked categories to work with ShallaList? Based on what Fred suggested on GitHub.

[jetberrocal]

@pfsensation:

Use pfSense packet capture under diagnostics in order to log where the traffic is trying to connect to, then use that info in order to add exceptions to it being MITM'd.

That is an idea.

What I do is set the Device to connect directly to Squid instead of going through E2g, then I look the Real Time log of Squid to see the sites that are needed by the connection.  Then I can add those sites to the E2g exceptions, and return the Device to the normal connection through E2g.

But Logmein is really strict with MITM  and for some reason adding the sites to the exceptions on v3 was not enough.  The sites are connected but then are dropped.  It seems that having the sites in the exceptionsitelist still are processed for MITM then the sites get the forged SSL certificate which the App does not like.

If I could find a way to say to the E2g to use MITM by default on most sites and not use it for some specific sites then those strict sites or Apps will not break.

[marcelloc]

@jetberrocal:

If I could find a way to say to the E2g to use MITM by default on most sites and not use it for some specific sites then those strict sites or Apps will not break.

Did you tried to add this site on exceptionsitelist?

[marcelloc]

@pfsensation:

I'm asking because FredB, over at GitHub recons that the blacklist categories not showing maybe due to not having the following :

# List categorisation
#listcategory: "Banned Sites"

Check it here: https://github.com/e2guardian/e2guardian/issues/244

try pkg 0.4.1.2

https://github.com/marcelloc/Unofficial-pfSense-packages/commit/113159cbac10e68568b77b8a0a22c65fdf4607ec

[marcelloc]

pkg 0.4.2 is almost done too with realtime tab.

[jetberrocal]

@marcelloc:

@jetberrocal:

If I could find a way to say to the E2g to use MITM by default on most sites and not use it for some specific sites then those strict sites or Apps will not break.

Did you tried to add this site on exceptionsitelist?

Yes I tried on v3 but still did not work.

[jetberrocal]

@marcelloc:

pkg 0.4.2 is almost done too with realtime tab.

The squidanalyser, provide the information like that?

SARG could do it except the reason.

[jetberrocal]

@marcelloc:

pkg 0.4.2 is almost done too with realtime tab.

The log is showing the data from access.log?
In what format? Dans format os squid format or squid extended format or other?

[marcelloc]

@jetberrocal:

The log is showing the data from access.log?

yes. original e2guardian format.  If you want to see or grep the log, it's in /var/log/e2guardian/access.log

[marcelloc]

@jetberrocal:

The squidanalyser, provide the information like that?

Not in realtime.

[jetberrocal]

@marcelloc:

@jetberrocal:

The log is showing the data from access.log?

yes. original e2guardian format.  If you want to see or grep the log, it's in /var/log/e2guardian/access.log

This can represent a problem. If the access.log file has to be in e2g format, then squidanalyser and SARG can not use it.

So using the real time gui will bring conflict with permanent reports.

[pfsensation]

We actually need a page that can save the data in real time, and can be filtered down based on user, IP address, banned category, or time.

An actual page in list view with a search function is what I had in mind… :P  Not a realtime tab like Squid.

EDIT: I tried adding HOST, FilterGroup back into my block page. And it caused my pfSense to crash again, and E2Guardian did not start up again, even with the watchguard script.

[jetberrocal]

@marcelloc:

@jetberrocal:

The squidanalyser, provide the information like that?

Not in realtime.

Real time is nice and is needed but permanent reports are also needed. Every time the access.log is recycled the data is lost and for business use you need to have long periods of data retantion.

[jetberrocal]

By the way, how is the access.log and dst something log being recycled. If its not then we have a huge problem. It will grow until Disc is full.

[pfsensation]

@jetberrocal:

@marcelloc:

@jetberrocal:

The squidanalyser, provide the information like that?

Not in realtime.

Real time is nice and is needed but permanent reports are also needed. Every time the access.log is recycled the data is lost and for business use you need to have long periods of data retantion.

Now we're getting somewhere. This is why I suggested having a page where all the data would be logged in real time, and we can filter and search based on user, blocked category, and see what site was blocked, why, banned phrase detected etc.

@Marcelloc, now I'm unable to turn off SSL certificate forging for certain groups. What's going on? Before I was able to easily turn it on or off in group settings, now whether SSL forging is on or off for a group. It still intercepts.

[marcelloc]

@pfsensation:

@Marcelloc, now I'm unable to turn off SSL certificate forging for certain groups. What's going on? Before I was able to easily turn it on or off in group settings, now whether SSL forging is on or off for a group. It still intercepts.

Did you closed the browser after changing it? Mozilla keeps "certificate cache" until you close the app.