Unofficial E2guardian package for pfSense

fabricioguzzy · Jan 23, 2019, 3:44 PM

@susamlicubuk
Sure. Here it goes.

Keep in mind that I have it like: USER --> E2Guardian --> SQUID --> INTERNET
I have SAMBA in the background (for NTLM)

Here E2Guardian Config:

login-to-view login-to-view login-to-view

Here SQUID Config:

login-to-view

fabricioguzzy · Jan 23, 2019, 3:48 PM

@pfsensation -
I will contact him for sure. I thought he was writing here to the forum only.
Thanks for the heads up!!

susamlicubuk · Jan 23, 2019, 4:34 PM

@fabricioguzzy said in Unofficial E2guardian package for pfSense:

@susamlicubuk
Sure. Here it goes.

Keep in mind that I have it like: USER --> E2Guardian --> SQUID --> INTERNET
I have SAMBA in the background (for NTLM)

Here E2Guardian Config:

login-to-view login-to-view login-to-view

Here SQUID Config:

login-to-view

How are your groups section and your users partition settings?
Please display the screenshot
Can you share the samba settings?

fabricioguzzy · Jan 23, 2019, 5:10 PM

@susamlicubuk

there you go:

USERS:
login-to-view

login-to-view

SAMBA smb.conf file (replace DOMAIN and DOMAIN.CORP by your actual DOMAIN name)
login-to-view
GROUPS: (in the "masked" LDAP line, you add your Active Directory Server hostname)
login-to-view
login-to-view
login-to-view

plusbil · Feb 8, 2019, 6:43 PM

PfSense 2.4.4p2+E2Guardian5 system. Wifi network, whatsapp voice call or video call not working. Realtime log, Tcp_dump/403 https://127.0.0.1

But E5Guardian SSL support disable; smoothly working.

Why?

pfsensation · Feb 8, 2019, 6:55 PM

@plusbil said in Unofficial E2guardian package for pfSense:

PfSense 2.4.4p2+E2Guardian5 system. Wifi network, whatsapp voice call or video call not working. Realtime log, Tcp_dump/403 https://127.0.0.1

But E5Guardian SSL support disable; smoothly working.

Why?

Age old issue of SSL pinning, apps reject any certs other than the one baked in by the app dev when they built the app. This is to try mitigate the MITM attacks, which is what E2 Guardian does.

Just make an alias to let Whatsapp bypass E2 Guardian altogether.

plusbil · Feb 9, 2019, 12:48 AM

@pfsensation said in Unofficial E2guardian package for pfSense:

Just make an alias to let Whatsapp bypass E2 Guardian altogether.

Hmmm, thank you.

https://github.com/ukanth/afwall/wiki/HOWTO-blocking-WhatsApp

Is the list up to date?

pfsensation · Feb 9, 2019, 12:49 AM

@plusbil said in Unofficial E2guardian package for pfSense:

@pfsensation said in Unofficial E2guardian package for pfSense:

Just make an alias to let Whatsapp bypass E2 Guardian altogether.

Hmmm, thank you.

https://github.com/ukanth/afwall/wiki/HOWTO-blocking-WhatsApp

Is the list up to date?

It's from 2015 so no, just do a packet capture and find the domains it uses. That's what I did to get it working, I tried to post a few of them for you here but it got detected as spam.

plusbil · Feb 9, 2019, 12:57 AM

@pfsensation said in Unofficial E2guardian package for pfSense:

It's from 2015 so no, just do a packet capture and find the domains it uses. That's what I did to get it working, I tried to post a few of them for you here but it got detected as spam.

I did. Just one address, 54.93.x.x. I opened it for now, it works. I'm gonna have to try, occasionally. :) Thanks...

User43617 · Feb 16, 2019, 5:17 PM

I just spun up a new pfSense machine using E2guardian. I was using squid/squidguard in the old firewall. There are quite a few nuances that I don't understand. It was pretty simple to block or allow sites as needed. I think I've figured out how to add new sites to block but am not having success getting them to bypass the filter. I have a camera system that keeps getting blocked with NETERROR as the reason. I've tried adding the source IP to the exceptions in the IP config and the site to ACL/site lists but no change. How does one enter a site to be bypassed?

*edit: It looks like it tries to connect then I see a log entry like this:
192.168.1.x https://127.0.0.1 403 Default NETERROR -

kenrutt · Feb 17, 2019, 2:35 AM

If you are using transparent proxy and you want any addresses to completely bypass e2guardian, there are places under the Daemon tab in the transparent section to enter bypass ip's.

pfsensation · Feb 17, 2019, 2:51 AM

@user43617 said in Unofficial E2guardian package for pfSense:

I just spun up a new pfSense machine using E2guardian. I was using squid/squidguard in the old firewall. There are quite a few nuances that I don't understand. It was pretty simple to block or allow sites as needed. I think I've figured out how to add new sites to block but am not having success getting them to bypass the filter. I have a camera system that keeps getting blocked with NETERROR as the reason. I've tried adding the source IP to the exceptions in the IP config and the site to ACL/site lists but no change. How does one enter a site to be bypassed?

*edit: It looks like it tries to connect then I see a log entry like this:
192.168.1.x https://127.0.0.1 403 Default NETERROR -

As @kenrutt mentioned, add the camera IP to the source bypass box under the daemon tab. Then it'll bypass e2guardian completely. Not quite sure why you're getting a NETERROR though.

User43617 · Feb 17, 2019, 6:34 PM

I tried the source bypass and that didn't seem to work. Turning the E2guardian off for a while allowed it to do whatever and worked for that particular problem. There are other sites that are behaving the same (gocomics.com).

I used the instructions at this link to set up E2guardian:
https://lifeoverlinux.com/how-to-block-http-and-https-websites-with-e2guardian/

It does not mention using WPAD for setup. I noticed that the instructions on the E2guardian github has a section on using it for ssl filtering. I had WPAd setup for squid/squidguard. Is that the part I'm missing here?

Anyone have a better set of instructions for configuring E2guardian on pfSense that's up to date?

pfsensation · Feb 17, 2019, 8:55 PM

@user43617 said in Unofficial E2guardian package for pfSense:

I tried the source bypass and that didn't seem to work. Turning the E2guardian off for a while allowed it to do whatever and worked for that particular problem. There are other sites that are behaving the same (gocomics.com).

I used the instructions at this link to set up E2guardian:
https://lifeoverlinux.com/how-to-block-http-and-https-websites-with-e2guardian/

It does not mention using WPAD for setup. I noticed that the instructions on the E2guardian github has a section on using it for ssl filtering. I had WPAd setup for squid/squidguard. Is that the part I'm missing here?

Anyone have a better set of instructions for configuring E2guardian on pfSense that's up to date?

Source bypass will only work if you're using the transparent filtering option. I've personally stopped using WPAD, transparent filtering can force the traffic through E2 Guardian quite seamlessly.

User43617 · Feb 18, 2019, 3:35 AM

@pfsensation

So, does grey and exception listing work in transparent mode?

pfsensation · Feb 18, 2019, 5:26 AM

@user43617 said in Unofficial E2guardian package for pfSense:

@pfsensation

So, does grey and exception listing work in transparent mode?

Yes, no problem at all. I'm running pretty much everything through transparent proxy. This also allows me to completely bypass the proxy for certain things like Windows updates, or WhatsApp to save resources and keep things efficient.

User43617 · Feb 24, 2019, 3:44 PM

Which list are you using. Shallalalist seems to be missing some things. It is unclear if it, or the french one, is still maintained.

Squidblacklist is interesting. Can anyone attest to its efficacy? Or, in other words, is it worth the price of the subscription?

arch113 · Feb 27, 2019, 3:57 PM

I'm running pfsense 2.4.4-RELEASE-p2, after running the command on page 1, I am still not able to see E2guardian package as an option for install, even after a reboot, what am i missing?

pfsensation · Feb 27, 2019, 3:58 PM

@arch113 said in Unofficial E2guardian package for pfSense:

I'm running pfsense 2.4.4-RELEASE-p2, after running the command on page 1, I am still not able to see E2guardian package as an option for install, even after a reboot, what am i missing?

You're missing the patch that enables packages from unofficial sources to be shown.

pfsensation · Feb 27, 2019, 4:00 PM

@user43617 said in Unofficial E2guardian package for pfSense:

Which list are you using. Shallalalist seems to be missing some things. It is unclear if it, or the french one, is still maintained.

Squidblacklist is interesting. Can anyone attest to its efficacy? Or, in other words, is it worth the price of the subscription?

I'm currently using https://dsi.ut-capitole.fr/blacklists/ it's French. However works well for English domains too and I've found it to be much better than Shallalist.