Unofficial E2guardian package for pfSense

navarre

Hi Marcello,

you are great! I love V5.

Found a little mistake:

I change logfile format to "squid style". Because I want to you lightsquid to parse logfiles.

In the squid format there is a bug: internal ip of requestor is missing. :-(

Seems this was a bug on V4 who was already fixed, but is in V5 here again.

Addition: Just read about fixed issue in your former post - I´ll give it a try

Another question:

Can someone give me a hint how to send e2guardian access.log to remote server?

I have graylog up and running. The Pfsense Logfiles could be sending to graylog sever, but I have no idea how to send e2guardians log.

Best Regards,
Kai

marcelloc

try latest pkg version. E2guardian team fixed it today

https://github.com/e2guardian/e2guardian/issues/359

About remote syslog, I did not tried any tool yet.

susamlicubuk

@marcelloc:

try latest pkg version. E2guardian team fixed it today

https://github.com/e2guardian/e2guardian/issues/359

About remote syslog, I did not tried any tool yet.

I think I made a mistake
some sites do not open
Can you share configuration screenshots

thanks.

marcelloc

Other tabs are on default values

Capturar01.PNG_thumb

Capturar02.PNG_thumb

Capturar03.PNG_thumb

susamlicubuk

marcello
congratulations and thanks
I did not test mobile devices but the pc works very well
but realtime logs look empty
why

marcelloc

@susamlicubuk:

I did not test mobile devices but the pc works very well
but realtime logs look empty
why

check if you box has the e2guardian logs on /var/log/e2guardian.

You can also try to change log type under Report and Logs tab.

marcelloc

Amazing performance

8k_connections.PNG_thumb

8k_connections_system.PNG_thumb

susamlicubuk

Marcello
Congratulations on your work
it works fine but it will be my responsibility
Do not have user (ip) site login authorization section? ips only has one group. why?
for example:
192.168.1.10 facebook block
192.168.1.11 facebook pass - youtube block
SquidGuard is very flexible and accomplished in this way
but with SSL proxy problem

marcelloc

@susamlicubuk:

Do not have user (ip) site login authorization section? ips only has one group. why?
for example:
192.168.1.10 facebook block
192.168.1.11 facebook pass - youtube block

Just create another group and change acl combination.

@susamlicubuk:

SquidGuard is very flexible and accomplished in this way

Definitely not. You will need more time to understand it's config style but e2guardian config is full featured.

marcelloc

Version 5 can really be scaled both horizontally and vertically.

I have a box with 15k working process running really nice.

Amazing work e2guardian team did on it.

pfsensation

@marcelloc:

Version 5 can really be scaled both horizontally and vertically.

I have a box with 15k working process running really nice.

Amazing work e2guardian team did on it.

You're right. I just jumped in today, taking extra precautions. I cloned my pfSense VM twice and then jumped in. So far the transparent proxy is working brilliantly and exactly how I wanted it. I've got my pfSense box entirely virtualised in ESXi and it's running brilliantly so far at home. Hopefully it continues to run stable, I've got it running under Squid for some light caching. In addition to this, when changing the settings around in the GUI, E2Guardian no longer lags or locks up like 4.1, it applies the config nearly instantly and is back up and running.

@Marcelloc could we add some filters to the logs? It would be really useful to go through denied websites based on groups, logs, times and categories. And would help tune E2Guardian better.

MR-NT

@marcelloc:

Here are install instructions for UNOFFICIAL e2guardian package for pfSense(R) software 2.3.x

Install
You can enable Unoffical repo creating or downloading the file below using diagnostics -> command prompt -> Execute Shell Command prompt menu:

2.3 AMD64
fetch -q -o /usr/local/etc/pkg/repos/Unofficial.conf https://raw.githubusercontent.com/marcelloc/Unofficial-pfSense-packages/master/Unofficial.conf
2.3 I386
fetch -q -o /usr/local/etc/pkg/repos/Unofficial.conf https://raw.githubusercontent.com/marcelloc/Unofficial-pfSense-packages/master/Unofficiali386.conf
2.4
fetch -q -o /usr/local/etc/pkg/repos/Unofficial.conf https://raw.githubusercontent.com/marcelloc/Unofficial-pfSense-packages/master/Unofficial.24.conf
After fetching the repo file, you can see these packages under System -> Package Manager

Without enabling Unofficial repo, you can add it using console/ssh with
cd /root
fetch https://raw.githubusercontent.com/marcelloc/Unofficial-pfSense-packages/master/pkg-e2guardian/files/install_e2guardian_23.sh
sh ./install_e2guardian_23.sh
E2guardian requires a cache/upstream server , so if you do not want to use squid together with e2guardian, point e2guardian proxy configuration to 127.0.0.1 port 8888 to use tinyproxy cache server instead.

http://www.shallalist.de/Downloads/shallalist.tar.gz is one of compatible blacklists for e2guardian. Configure it under blacklist tab.

Once it finishes, all must be in place. If you do not see the menu after it finishes, try to install any pfSense package from GUI, like cron for example.

WARNING

Use it at your own risk.

This script install packages from freebsd and change your config file.

Excellent , i think this is the only i can block based on Page content , am right or wrong ?

marcelloc

@MR-NT:

Excellent , i think this is the only i can block based on Page content , am right or wrong ?

Right !

susamlicubuk

Hello Marcello
The e2 guardian does not work after the pfsense firewall is restarted.
e2Guardian from the interface does not work without pressing the save and apply button.
Do you have a solution?

pfsensation

@susamlicubuk:

Hello Marcello
The e2 guardian does not work after the pfsense firewall is restarted.
e2Guardian from the interface does not work without pressing the save and apply button.
Do you have a solution?

Have you got the blacklist downloaded and the watch dog turned on? Turning on the watchdog should make sure that E2guardian is running.

GoldenShark

@pfsensation:

@susamlicubuk:

Hello Marcello
The e2 guardian does not work after the pfsense firewall is restarted.
e2Guardian from the interface does not work without pressing the save and apply button.
Do you have a solution?

Have you got the blacklist downloaded and the watch dog turned on? Turning on the watchdog should make sure that E2guardian is running.

I have same problem also.

I tried watch dog it doesnt work for this issue.

The problem is when you restart your pfsense its going to show to you : APPLY CHANGES.

If i will not apply it , it wont be work.

I have to apply every after restart pfsense

I can send you picture what he need : http://prntscr.com/iu6tr5

pfsensation

@GoldenShark:

@pfsensation:

@susamlicubuk:

Hello Marcello
The e2 guardian does not work after the pfsense firewall is restarted.
e2Guardian from the interface does not work without pressing the save and apply button.
Do you have a solution?

Have you got the blacklist downloaded and the watch dog turned on? Turning on the watchdog should make sure that E2guardian is running.

I have same problem also.

I tried watch dog it doesnt work for this issue.

The problem is when you restart your pfsense its going to show to you : APPLY CHANGES.

If i will not apply it , it wont be work.

I have to apply every after restart pfsense

I can send you picture what he need : http://prntscr.com/iu6tr5

You're right. i've been having this from the start, but it's one of those things that didn't really bother me too much because it only occurs when you do a full restart. pfSense is not really something you need to restart often at all, furthermore, I somehow managed to get it to auto startup using a combination of Service watchdog from the package manager and E2G's own watchdog. This way, after a reboot, I still get the prompt to save the configurations, but it still starts up the service automatically and everything seems to work as normal.

@Marcelloc, I'm having problems with Regex for enforcing Youtube Restricted. Do you use this on your network? Anyone else here using it? It seemed to be working fine on 4.1, but on v5, that's stopped working. I've yet to pin down if its a change Youtube made on their end or if its E2G for sure.

The below is what I'm using for YouTube:

# Enforce restricted mode in YouTube
#
"(^https://www.youtube.com)"->"https://restrict.youtube.com"
"(^https://m.youtube.com)"->"https://restrict.youtube.com"
"(^https://youtubei.googleapis.com)"->"https://restrict.youtube.com"
"(^https://youtube.googleapis.com)"->"https://restrict.youtube.com"
"(^https://www.youtube-nocookie.com)"->"https://restrict.youtube.com"
#

marcelloc

@pfsensation:

s to work as normal.

@Marcelloc, I'm having problems with Regex for enforcing Youtube Restricted. Do you use this on your network? Anyone else here using it? It seemed to be working fine on 4.1, but on v5, that's stopped working. I've yet to pin down if its a change Youtube made on their end or if its E2G for sure.

The below is what I'm using for YouTube:
# Enforce restricted mode in YouTube
#
"(^https://www.youtube.com)"->"https://restrict.youtube.com"
"(^https://m.youtube.com)"->"https://restrict.youtube.com"
"(^https://youtubei.googleapis.com)"->"https://restrict.youtube.com"
"(^https://youtube.googleapis.com)"->"https://restrict.youtube.com"
"(^https://www.youtube-nocookie.com)"->"https://restrict.youtube.com"
#

Acls on v5 has changed a lot. I'll put it on my check list to do as soon as possible

pfsensation

@marcelloc:

@pfsensation:
s to work as normal.

@Marcelloc, I'm having problems with Regex for enforcing Youtube Restricted. Do you use this on your network? Anyone else here using it? It seemed to be working fine on 4.1, but on v5, that's stopped working. I've yet to pin down if its a change Youtube made on their end or if its E2G for sure.

The below is what I'm using for YouTube:
# Enforce restricted mode in YouTube
#
"(^https://www.youtube.com)"->"https://restrict.youtube.com"
"(^https://m.youtube.com)"->"https://restrict.youtube.com"
"(^https://youtubei.googleapis.com)"->"https://restrict.youtube.com"
"(^https://youtube.googleapis.com)"->"https://restrict.youtube.com"
"(^https://www.youtube-nocookie.com)"->"https://restrict.youtube.com"
#

Acls on v5 has changed a lot. I'll put it on my check list to do as soon as possible

Hi Marcello,

Thanks for your reply. Is this something that's just affecting the pfSense package you've made? I've raised it on Github so I'd be glad if you could provide some input there: https://github.com/e2guardian/e2guardian/issues/365

marcelloc

@pfsensation:

Thanks for your reply. Is this something that's just affecting the pfSense package you've made? I've raised it on Github so I'd be glad if you could provide some input there: https://github.com/e2guardian/e2guardian/issues/365

I guess yes. A lot of acls code needs to be reviewed to match v5 configuration style.

It's better if we can first confirm if it's a gui code issue or a binary issue before creating a ticket on e2guardian project.