Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Unofficial E2guardian package for pfSense

    Scheduled Pinned Locked Moved Cache/Proxy
    1.2k Posts 70 Posters 1.5m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      pfsensation
      last edited by

      @marcelloc:

      @pfsensation:

      s to work as normal.

      @Marcelloc, I'm having problems with Regex for enforcing Youtube Restricted. Do you use this on your network? Anyone else here using it? It seemed to be working fine on 4.1, but on v5, that's stopped working. I've yet to pin down if its a change Youtube made on their end or if its E2G for sure.

      The below is what I'm using for YouTube:

      # Enforce restricted mode in YouTube
      #
      "(^https://www.youtube.com)"->"https://restrict.youtube.com"
      "(^https://m.youtube.com)"->"https://restrict.youtube.com"
      "(^https://youtubei.googleapis.com)"->"https://restrict.youtube.com"
      "(^https://youtube.googleapis.com)"->"https://restrict.youtube.com"
      "(^https://www.youtube-nocookie.com)"->"https://restrict.youtube.com"
      #
      
      Acls on v5 has changed a lot. I'll put it on my check list to do as soon as possible
      

      Hi Marcello,

      Thanks for your reply. Is this something that's just affecting the pfSense package you've made? I've raised it on Github so I'd be glad if you could provide some input there: https://github.com/e2guardian/e2guardian/issues/365

      1 Reply Last reply Reply Quote 0
      • marcellocM
        marcelloc
        last edited by

        @pfsensation:

        Thanks for your reply. Is this something that's just affecting the pfSense package you've made? I've raised it on Github so I'd be glad if you could provide some input there: https://github.com/e2guardian/e2guardian/issues/365

        I guess yes. A lot of acls code needs to be reviewed to match v5 configuration style.

        It's better if we can first confirm if it's a gui code issue or a binary issue before creating a ticket on e2guardian project.

        Treinamentos de Elite: http://sys-squad.com

        Help a community developer! ;D

        1 Reply Last reply Reply Quote 0
        • S
          susamlicubuk
          last edited by

          I think the config xml is broken when it restarts
          or embedded squid does not start
          works with save and applly
          service watchdog does not solve the problem
          Is there a custom configuration?
          Could you please look into this problem

          1 Reply Last reply Reply Quote 0
          • P
            pfsensation
            last edited by

            @marcelloc:

            @pfsensation:

            Thanks for your reply. Is this something that's just affecting the pfSense package you've made? I've raised it on Github so I'd be glad if you could provide some input there: https://github.com/e2guardian/e2guardian/issues/365

            I guess yes. A lot of acls code needs to be reviewed to match v5 configuration style.

            It's better if we can first confirm if it's a gui code issue or a binary issue before creating a ticket on e2guardian project.

            Sure, I'll be glad if you could have a look when you have time. I've closed the issue on the E2Guardian Project page on GitHub for now until we can confirm where the problem is. Furthermore, Philip did push out some extra fixes/updates so we need to rebuild the binaries anyways.

            1 Reply Last reply Reply Quote 0
            • marcellocM
              marcelloc
              last edited by

              @susamlicubuk:

              I think the config xml is broken when it restarts
              or embedded squid does not start
              works with save and applly
              service watchdog does not solve the problem
              Is there a custom configuration?
              Could you please look into this problem

              Except if you need custom squid configuration on this parent daemon, select direct mode on e2guardian config.

              Treinamentos de Elite: http://sys-squad.com

              Help a community developer! ;D

              1 Reply Last reply Reply Quote 0
              • S
                susamlicubuk
                last edited by

                Parent mode: direct connect selected
                pfsense restarting filtering is not working
                I click on save and apply
                working

                1 Reply Last reply Reply Quote 0
                • L
                  lavd
                  last edited by

                  E2guardian works, thank you

                  How come we can't make SSL bump to work with Squid+SquidGuard, making it cripple SSL on google etc., but here it works fine?

                  Can this be made an official module already?

                  1 Reply Last reply Reply Quote 0
                  • marcellocM
                    marcelloc
                    last edited by

                    @lavd:

                    How come we can't make SSL bump to work with Squid+SquidGuard, making it cripple SSL on google etc., but here it works fine?

                    With e2guardian you can do both (filter ssl and intercept ssl), just like bump all and splice all on squid. You do not need squidguard in any way while working with e2guardiand. It's a full replacement with an age of improvements. Squid is optional too as e2guardian v5 doesn't need a parent proxy.

                    @lavd:

                    Can this be made an official module already?

                    It still need some work before it.

                    Treinamentos de Elite: http://sys-squad.com

                    Help a community developer! ;D

                    1 Reply Last reply Reply Quote 0
                    • L
                      lavd
                      last edited by

                      @marcelloc yes, all I am saying is that whatever version and setting of Squid is on Pfsense so far - SSL peek and splice doesn't work. So either Alex Rousskov did a bad job, which I doubt, or Squid module for pfsense is junk

                      Is it e2guardian needs more work or the package?

                      1 Reply Last reply Reply Quote 0
                      • marcellocM
                        marcelloc
                        last edited by

                        @lavd:

                        Is it e2guardian needs more work or the package?

                        Yes, config files and acls has changed a lot between version 4 and 5. I did a working around for many files to release first v5 package.

                        Treinamentos de Elite: http://sys-squad.com

                        Help a community developer! ;D

                        1 Reply Last reply Reply Quote 0
                        • P
                          pfsensation
                          last edited by

                          @lavd:

                          E2guardian works, thank you

                          How come we can't make SSL bump to work with Squid+SquidGuard, making it cripple SSL on google etc., but here it works fine?

                          Can this be made an official module already?

                          SquidGuard is a broken piece of garbage. It's not even in the same league as E2guardian therefore it shouldn't be compared. Last time I used SquidGuard, it couldn't even generate the fake certs correctly therefore leading to browsers not trusting it correctly. And causing more pain than its worth. I did see that a few community members tried to update it somewhat but the code was so bad they ended up giving up.

                          I'm really just waiting for the pfSense team to deprecate it and remove it from their official repo. E2guardian is a much better, modern and now more stable filtering tool. And it has the proper ability to actually "look" inside a Web page to deem if it's safe or not. Basic URL blocking as you get with SquidGuard is no longer effective as new sites emerge everyday.

                          If you're looking for a modern and great filtering tool. I wholeheartedly recommend E2 Guardian. With tweaking and updated phraselists it has the ability to knock everything else out the water. This package is still a work in progress and Marcello has done a great job bringing it to pfSense. Certain kinks will need to be worked out over time, such as AV and whatnot and then hopefully one day we can see this on the official repo.

                          1 Reply Last reply Reply Quote 0
                          • P
                            pfsensation
                            last edited by

                            @marcelloc:

                            @lavd:

                            Is it e2guardian needs more work or the package?

                            Yes, config files and acls has changed a lot between version 4 and 5. I did a working around for many files to release first v5 package.

                            How is the progress coming along with those config files? I'm eagerly waiting to get my regex working again to enforce restricted mode for certain groups.

                            I am also planning on releasing some configs to speed up the setup process of E2guardian. Just waiting for you to get the package all up to date with v5 changes and my work to give me some more free time.

                            1 Reply Last reply Reply Quote 0
                            • marcellocM
                              marcelloc
                              last edited by

                              @pfsensation:

                              @Marcelloc, I'm having problems with Regex for enforcing Youtube Restricted. Do you use this on your network? Anyone else here using it? It seemed to be working fine on 4.1, but on v5, that's stopped working. I've yet to pin down if its a change Youtube made on their end or if its E2G for sure.

                              The below is what I'm using for YouTube:

                              # Enforce restricted mode in YouTube
                              #
                              "(^https://www.youtube.com)"->"https://restrict.youtube.com"
                              "(^https://m.youtube.com)"->"https://restrict.youtube.com"
                              "(^https://youtubei.googleapis.com)"->"https://restrict.youtube.com"
                              "(^https://youtube.googleapis.com)"->"https://restrict.youtube.com"
                              "(^https://www.youtube-nocookie.com)"->"https://restrict.youtube.com"
                              #
                              

                              I did the test right now and it worked fine. I've setup this under acl -> site lists -> SSL Regex

                              the resulting file is unde /usr/local/etc/e2guardian/lists/sslsiteregexplist.g_your_group

                              Tested without transparent mode with ssl filter and ssl interception as well.

                              Safe search under Modify URL List is working too

                              Treinamentos de Elite: http://sys-squad.com

                              Help a community developer! ;D

                              1 Reply Last reply Reply Quote 0
                              • P
                                pfsensation
                                last edited by

                                @marcelloc:

                                @pfsensation:

                                @Marcelloc, I'm having problems with Regex for enforcing Youtube Restricted. Do you use this on your network? Anyone else here using it? It seemed to be working fine on 4.1, but on v5, that's stopped working. I've yet to pin down if its a change Youtube made on their end or if its E2G for sure.

                                The below is what I'm using for YouTube:

                                # Enforce restricted mode in YouTube
                                #
                                "(^https://www.youtube.com)"->"https://restrict.youtube.com"
                                "(^https://m.youtube.com)"->"https://restrict.youtube.com"
                                "(^https://youtubei.googleapis.com)"->"https://restrict.youtube.com"
                                "(^https://youtube.googleapis.com)"->"https://restrict.youtube.com"
                                "(^https://www.youtube-nocookie.com)"->"https://restrict.youtube.com"
                                #
                                

                                I did the test right now and it worked fine. I've setup this under acl -> site lists -> SSL Regex

                                the resulting file is unde /usr/local/etc/e2guardian/lists/sslsiteregexplist.g_your_group

                                Tested without transparent mode with ssl filter and ssl interception as well.

                                Safe search under Modify URL List is working too

                                Strange, I've verified that the file exists and has the correct contents but it didn't seem to work for me. I've just tried to explicitly set the browser to use the proxy again. E2 Guardian is definitely intercepting the traffic as it is giving out the fake cert to YouTube. However, at least on the desktop version of YouTube, restricted mode isn't working. I'm only using the ssl regex, no modify URL. Also, if it helps, I've got YouTube restricted in a separate group for ease of use.

                                1 Reply Last reply Reply Quote 0
                                • marcellocM
                                  marcelloc
                                  last edited by

                                  I'll test at home too with virtual machines.

                                  Treinamentos de Elite: http://sys-squad.com

                                  Help a community developer! ;D

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    pfsensation
                                    last edited by

                                    @marcelloc:

                                    I'll test at home too with virtual machines.

                                    Awesome, let me know how it goes. I'm quite confident that I do have everything correctly configured networking wise,  the VM I'm testing from is directly connected to my pfSense LAN switch. I've even tried testing from a few physical PC's but it shouldn't make a difference. I run my home virtualised now for ease of use.

                                    While typing this, I've just tried to apply the policy to my mobile and it worked!! Strange, it seems that its not working with the desktop page anymore. I have even confirmed that the URLs I'm rewriting via E2 Guardian is up to date. We're definitely making slow but steady progress on getting to the bottom of this. I'd say that the problem is not E2guardian but it definitely was working on 4.1 although I tested  while back.

                                    1 Reply Last reply Reply Quote 0
                                    • marcellocM
                                      marcelloc
                                      last edited by

                                      @pfsensation:

                                      Awesome, let me know how it goes.

                                      It's working at home too. I have IP authentication enabled, site SSL REGEX and URL MODIFY for all search engines enabled.

                                      Tested with ssl filter and with interception only.

                                      Treinamentos de Elite: http://sys-squad.com

                                      Help a community developer! ;D

                                      1 Reply Last reply Reply Quote 0
                                      • marcellocM
                                        marcelloc
                                        last edited by

                                        Package version 5.0.1_4 includes main changes needed to v5 config changes but it still need more work until full config update.

                                        There is new combo box under group definition to select group type.
                                        Ldap integration for group alcs is fixed too.

                                        ![group type.PNG](/public/imported_attachments/1/group type.PNG)
                                        ![group type.PNG_thumb](/public/imported_attachments/1/group type.PNG_thumb)

                                        Treinamentos de Elite: http://sys-squad.com

                                        Help a community developer! ;D

                                        1 Reply Last reply Reply Quote 0
                                        • L
                                          landforces
                                          last edited by

                                          Dear friends I have read 42 page feedback, would not it be better if more people test it if you have a quick start guide on this topic? If you make a short video, everyone does not have as much information as you

                                          1 Reply Last reply Reply Quote 0
                                          • marcellocM
                                            marcelloc
                                            last edited by

                                            I have this screencast cast showing e2guardian options. It's in Portuguese but I think it will help you.

                                            http://sys-squad.com/licao/259

                                            Treinamentos de Elite: http://sys-squad.com

                                            Help a community developer! ;D

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.