Unofficial E2guardian package for pfSense

[reza3sw]

@pfsensation درود
Thanks for your follow up

In my area some site are blocked and fillter by goverment
That's why ..I have to use VPN for bypass filltering

I use 5 VPN conection on 1 WAN and create gateway group(loadbalncing) with 5 vpn conection
So I want pass traffic from squid or E2Guardian to loadbalancing vpn gateway and block some site like (windows update.. social network , etc...) with E2guardian or squidGuard
But E2guardian or squid sent traffic to default gateway... and I can't use VPN for bypass traffic............

---

I created Topic for this problem
But no answer
https://forum.netgate.com/topic/134796/squid-5-vpn-conection-on-one-wan

[pfsensation]

@reza3sw said in Unofficial E2guardian package for pfSense:

@pfsensation درود
Thanks for your follow up

In my area some site are blocked and fillter by goverment
That's why ..I have to use VPN for bypass filltering

I use 5 VPN conection on 1 WAN and create gateway group(loadbalncing) with 5 vpn conection
So I want pass traffic from squid or E2Guardian to loadbalancing vpn gateway and block some site like (windows update.. social network , etc...) with E2guardian or squidGuard
But E2guardian or squid sent traffic to default gateway... and I can't use VPN for bypass traffic............

---

I created Topic for this problem
But no answer
https://forum.netgate.com/topic/134796/squid-5-vpn-conection-on-one-wan

You are a clever man! I used separate VPN instances too and load balanced across them when I realised that they have speed caps.

I haven't been to Iran myself, but I assume they do the typical DNS level blocking? You can give Cloudflare DNS over TLS a go and see if those sites are unblocked. If it's DNS level blocking, that should circumvent it.

[reza3sw]

@pfsensation Thank's you are very good
I will check with cloudflare and I say the result.

But the main subject : ( If we have e.g : 3 WAN and use loadbalancing or failover ) and use E2guardian or Squid we can't set outgoing address to loadbalancing or failover.. because E2guardian and squid just use default WAN..

This means traffic port 80,443 just pass from WAN1 (default)

We can use floating rule for OUT Wan control.. But I checked with 1 Wan and 5 VPN connection ...but no answer

I hope the pfsense group provides a solution

[pfsensation]

@reza3sw If the DNS encryption method I mentioned before works. You can use that for the time being instead until E2 Guardian properly gets this feature of supporting multiple WANs natively.

Have you experimented with trying to get E2 Guardian to use a gateway group?

[reza3sw]

@pfsensation Yes I do
But E2Guardian uses default gateway

[reza3sw]

@pfsensation I checked with (DNS over TLS) step by step

https://www.netgate.com/blog/dns-over-tls-with-pfsense.html

This does not work

[pfsensation]

@reza3sw Those steps worked perfectly fine for me. You must have something else conflicting or blocking it.

[genesislubrigas]

How to use lightsquid for e2guardian ?

[ucribrahim]

I worked successfully Squid + E2guardian + Lightsquid. If it's works stabil, I'll write blog post about how to make them work together as soon as fast in my website. I can see HTTP and HTTPS domains in Lightsquid report and more.

[susamlicubuk]

ibrahim lightsquid kurulumundan sonra sadece aşağıdaki kodu çalıştırman ve pf i yeniden başlatman yeterli.
fetch -o /usr/local/pkg/lightsquid.inc http://e-sac.siteseguro.ws/lightsquid/inc.txt

[ucribrahim]

Hmm, ben onu sadece E2guardian tek başına çalıştığında, bu patch uygulanıyor sanıyorum 'ki öyle. Çünkü forumlarda öyle yazıyor. Yarın denerim sana yazarım geri.

[genesislubrigas]

@ucribrahim

Only e2guardian and lightsquid.

[ucribrahim]

@genesislubrigas After you used the following code. Lightsquid can be worked with Squid + E2guardian without problem. After you used command, please restart your pfsense.

fetch -o /usr/local/pkg/lightsquid.inc http://e-sac.siteseguro.ws/lightsquid/inc.txt

[genesislubrigas]

@ucribrahim

Yes but i dont use squid, I only use e2guardian. How do you use squid with e2guardian?

[pfsensation]

@genesislubrigas There's no need for you to use Squid with E2 Guardian. You can still get stats with Light squid.

I personally stopped using Squid because I've found it to slow down my Web traffic, instead of helping speed it up.

[ravegen]

@pfsensation said in Unofficial E2guardian package for pfSense:

@genesislubrigas There's no need for you to use Squid with E2 Guardian. You can still get stats with Light squid.

How do you get stats with Light squid ? Can you kindly assist. Thanks

[kenpachizaraki]

Hi everyone,
Hope some could assist.
Already got a working pfsense + e2guardian setup.
I would like to achieve time base blocking on some sites.

e.g.
block facebook from 8am-6pm daily
after 6pm it should be accessible.

This is my web config

Result was im stil unable to access facebook even after 6pm.

[pfsensation]

@kenpachizaraki Create a schedule on pfSense for the duration you'd like Facebook blocked for. Then go into E2 Guardian, ACL then create a new site list config.

Select the schedule you've created in the site list config, and then under banned sites box. Put in Facebook.com, then just assign the ACL to a group and it should work.

These should be the steps to get it correctly setup. If the blocking still goes on after your assigned schedule. You may have not created a separate ACL or properly created the schedule.

[kenpachizaraki]

@pfsensation thanks for the quick reply, appreciate it.

Below are the steps i followed.

1. create schedule in pfsense
   --- working_hours Mon - Sun / 9:00-17:59
2. create ACL in e2g
   --- schedule : working_hours
   --- enable : check
   --- Include : social_network domains
   --- save

e2g Groups
--- site : working_hours
--- save

e2g IPs
---- working_hours : 192.168.1.100
--- save
--- apply

e2g Realtime
** facebook.com 403 192.168.1.100 working_hours DENIED Blocked site: facebook.com

Result success!

Another problem is,
how does e2g read the groups?
top to bottom? bottom to top?

Scenario : I want to create another schedule "lunch_break" @ 12noon to 1pm
and allow facebook access during that time.
I created same steps as above and set IPs to "lunch_break", so one of the IPs belong in two IPs (one in working_hours and same ip in lunch_break)
e2g just sticks to "lunch_break" even after the hour ends (1PM)
it never go back to "working_hours" IPs and ACL groups.

Scenario above can be achieve in e2g?

[ucribrahim]

@kenpachizaraki From top to bottom. E2guardian ACLs process from top to bottom.