Unofficial E2guardian package for pfSense

pfsensation

@la6er said in Unofficial E2guardian package for pfSense:

Hi all, anyone faicing issues with the realtime tab after update to 5.3.1_1? only 1 gruop is been displayed on the tab, while using e2g format, if I change to squid format everything shows up, all my groups and traffic reported normally on the real time tab

I use Squid Format and had issues too. Had to switch to E2guardian format temporarily, uninstall E2 Guardian, install again and then switch back to Squid format and then it started to work.

Give this a go the other way around for E2 Guardian format, it is a weird bug but those are the steps that fixed it for me.

pfsensation

@arch113 Follow these steps to enable unofficial repos and get E2Guardian to show up:

Install "patch" package from package manager.

System > Patches > click "Add New Patch" button.
Description: e2guardian patch
URL/Commit ID: Leave empty
Patch Contents: Copy/Paste all codes from here
Path Strip Count: 1
Base Directory: /
Ignore Whitespace: Clicked
Auto Apply: Clicked

Save and then click "Apply" button.

That's all for now. Now go to shell and add repo of e2guardian by following command.
fetch -q -o /usr/local/etc/pkg/repos/Unofficial.conf https://raw.githubusercontent.com/marcelloc/Unofficial-pfSense-packages/master/Unofficial.24.conf
Go to Package Manager and try to search e2guardian. If you don't see any package reboot system.

wingman

Can you get the regular http block page for https sites as well?
Without getting the ‘Unable to connect’ browser error

pfsensation

@wingman said in Unofficial E2guardian package for pfSense:

Can you get the regular http block page for https sites as well?
Without getting the ‘Unable to connect’ browser error

Yes you can, however it will require you to enable MITM and install the CA cert on your client devices. This will also allow the phrase detection filters on https sites and allow the proxy to see the full URL.

wingman

@pfsensation Thank you. I'll give it a shot.

arch113

@pfsensation
Thank you, finally have it installed.

wingman

@pfsensation Thanks mate. It worked. I had to select sslmitm and automitm in my group. Thanks again.

La6er

Hi all, another question... is it possible to send the e2guardian logs to a syslog server?

wingman

Is there a way to forward some website requests to a upstream proxy server?
Say if a user requests google.com that request will go through a proxy.

kenpachizaraki

@pfsensation is there a way to use old e2g release?
my pfsense box is still on 2.4.1 i cant upgrade it on the latest pfsense release due to ipsec being broken.

Rico

@kenpachizaraki said in Unofficial E2guardian package for pfSense:

i cant upgrade it on the latest pfsense release due to ipsec being broken

?!
Check https://forum.netgate.com/category/17/ipsec
There is like no one complaining about IPSEC being broken in 2.4.4-p2

-Rico

kenpachizaraki

@Rico we have IPSEC connecting to AWS VPN. We tried the latest release using clean install.
IPSec cant connect.
We tried 2.4.1 then upgrade to 2.4.4, still can not connect to AWS VPN.
I'll try to boot the backup pfsense and upgrade it to get the logs.
Maybe someone could help if i posted the logs..
Will update the thread.

arch113

I have a weird to me problem. Got the filtering all setup, blocking adult site works, going to playboydotcom, I get the denied page saying its block by category:adult. But if I remove the Enable checkbox from all ACL's (Site, URL, etc), the site is still blocked. If I remove the adult domains from all ACL's, the site is also still blocked by category:adult. Only way I can get to playboydotcom (for example) is to disable the E2guardian service.

The reason this came about is, I am trying to get Software update to work on ipads on the network, i see in the real time log that a really long url starting with updates-http.cdn-apple.com is be denied. When I to the jsut that site, it works, but when I input the actual long url, I get denied by category:/Regular Expression URLs, and for the life of me, can't seem to get around it/unblock it.

It seems whatever config change I put in the pfsense is .ot making to the actual e2guardian config.

pfsensation

@arch113 said in Unofficial E2guardian package for pfSense:

I have a weird to me problem. Got the filtering all setup, blocking adult site works, going to playboydotcom, I get the denied page saying its block by category:adult. But if I remove the Enable checkbox from all ACL's (Site, URL, etc), the site is still blocked. If I remove the adult domains from all ACL's, the site is also still blocked by category:adult. Only way I can get to playboydotcom (for example) is to disable the E2guardian service.

The reason this came about is, I am trying to get Software update to work on ipads on the network, i see in the real time log that a really long url starting with updates-http.cdn-apple.com is be denied. When I to the jsut that site, it works, but when I input the actual long url, I get denied by category:/Regular Expression URLs, and for the life of me, can't seem to get around it/unblock it.

It seems whatever config change I put in the pfsense is .ot making to the actual e2guardian config.

Sounds like you have things misconfigured. E2 Guardian has a lot of blocking methods, it's up to you to modify the configs and adapt to your needs and enable it.

My guess is you have something enabled even when you disable the site list. E2G now has a few main blocking methods, Site URL, Phrase weights, Regex and Pics (although not in use much). If you make sure they're all disabled, your blocked site will work.

arch113

@pfsensation
They all appear to be off

User43617

@arch113

@arch113 said in Unofficial E2guardian package for pfSense:

I have a weird to me problem. Got the filtering all setup, blocking adult site works, going to playboydotcom, I get the denied page saying its block by category:adult. But if I remove the Enable checkbox from all ACL's (Site, URL, etc), the site is still blocked. If I remove the adult domains from all ACL's, the site is also still blocked by category:adult. Only way I can get to playboydotcom (for example) is to disable the E2guardian service.

The reason this came about is, I am trying to get Software update to work on ipads on the network, i see in the real time log that a really long url starting with updates-http.cdn-apple.com is be denied. When I to the jsut that site, it works, but when I input the actual long url, I get denied by category:/Regular Expression URLs, and for the life of me, can't seem to get around it/unblock it.

It seems whatever config change I put in the pfsense is .ot making to the actual e2guardian config.

I solved it by putting "updates-http.cdn-apple.com" (without quotes) in the Exception Config box in the URL lists ACL.

arch113

@User43617
I did that too
Its like the config the GUI is 'changing' is not the same config E2guardian is using, although I can turn the daemon off, that part works.

pfsensation

@arch113 said in Unofficial E2guardian package for pfSense:

@User43617
I did that too
Its like the config the GUI is 'changing' is not the same config E2guardian is using, although I can turn the daemon off, that part works.

Try a reinstall, see if that corrects the issue. I've been using it for a long time now and it seems to be working perfectly.

La6er

Hi anyone facing issues with ip ranges? I have tried to configure 10.16.0.10-10.16.0.15 but it does not take it :(

amorimpermissus

Hello everyone, this is my first post at the Netgate forums, so please forgive any and all ignorance! I was hoping I could get some assistance with this awesome plugin.

First of all, I'd like to give my sincerest thanks to @marcelloc for all his work in making this available to pfsense. I followed the videos on YouTube best I could-- even turned on subtitles to auto-translate into English, which helped.

I believe I have the majority of my E2G setup configured correctly. After creating a new set of ACLs separate from the defaults, I'm definitely able to block both "sites" and "URL" based on categories and blacklists. Moreover, I can look in the real-time logging and see the ACL getting applied accordingly when I attempt to navigate to various addresses which I know should be getting blocked.

My issues are related to the phrase filtering options, which I cannot seem to get working no matter what I do. For troubleshooting, here's what I've done:
-Completely disabled all of the Site and URL filtering
-Under "General," I ensured:
--"Filter Mode" is set to "Filtered (default)"
--"Weighted phrase mode" is set to "Singular...(default)"
--"Phrase filter mode" is set to "use both (default)"
-The Phrase List ACL I created:
--Is enabled at all times
--Has Banned Lists enabled for all categories
--Has Weighted Lists enabled for all categories
--Has Exception Lists disabled / unchecked

When I apply these ACLs to the correct subnet, I can immediately browse to porn sites, and nothing seems to be happening in the real-time logs. If I then modify the ACL to re-enable Site and URL lists & re-apply it, porn sites are blocked, and I can see this happening in the real-time logs. As such, I'm fairly certain I at least have the filter group and IP settings configured correctly.

Am I just mistaken about what the Phrase filtering can do? I thought it was able to read webpage content and block any page with naughty words on it, but maybe I'm wrong?

If it helps, I am not using Squid -- E2G Daemon is set to "Direct Connect," and I also have https interception enabled with a self-signed certificate.

If anyone could be of assistance, I would be extremely grateful. I'm happy to provide any information that might help-- I would even be willing to pay you for help if you were able to fix it for me, after which I would post the findings here so others could use it.

My thanks in advance to any and all who might reply to this!