Unofficial E2guardian package for pfSense
-
@kenrutt said in Unofficial E2guardian package for pfSense:
@pfsensation My experience has been the same. With e2guardian in direct mode things work fairly well. Only a few things I needed to bypass.
Yeah, I gave up trying to use Squid. The current implementation wasn't worth my time anyways, since HTTPS content that E2 Guardian decrypts and sees wasn't being added to Squid cache. Furthermore, I noticed a speed improvement when bypassing squid in the setup, the Squid in pfsense is an older version (although I think Marcelloc has a newer one in his repo).
I also had other issues with Squid, such as not generating fake certs properly (when using the SSL intercept feature). The certs didn't have a Subject alternative name which caused a tonne of sites and stuff to fail.
On top of that, nowadays browsers do a really good job of caching things locally. The benefits have become quite minimal, unless your bandwidth is completely trash and you have users visiting the same content over and over.
If @marcelloc has a newer version of Squid, that doesn't have the certs issue and slow down issue. I may give it a shot when I have time. But so far I'm pretty content with E2 Guardian, I'm using it at home with no issues. Only thing missing is an updated word list and a good blacklist that's maintained well.
-
There is one more issue when how to configure e2g for ad authentication??
i am configure squid for that but when we allow in e2g transparent proxy there is error occurs Proxy authentication error...... -
Good day Marcelloc,
E2Guardian has antivirus feature. I just want to ask, how do you know or check that the antivirus is running and if the antivirus is up to date ?
In E2Guardian, you can setup the frequency on updating blacklist url.
Can you possibly add feature to check if the antivirus service is running and can be started or restarted and updated. I don't know if it make sense because I dont know how you program how it works.
I just really want to know if the antivirus service is running and if it is up to date.
-
I found out that clamd is not starting when e2guardian is stopped and restarted.
What can be done about this ? Can we do our own adjustment somewhere ?
-
after implantation https filter I want to filter search keyword filter but Google search keyword filter not working
Add keyword in phases but client not block by keyword -
hello,
i cant block youtube mobile (android or ios applications). e2guardian blocks youtube at pc but on the phones it cant block. any ideas?
-
@ugurk Hi. In squidguard I made a category that I called videos, there I put all these domains that contain videos, so I block almost everything and every day I add other domains:
dailymotion.com googlevideo.com i.ytimg.com m.youtube.com metacafe.com netflix.com nflxvideo.net screen.yahoo.com skype.com vimeo.com vine.co 3r2---sn-j5caxupj5-nwvl.googlevideo.com r1---sn-5hoxuj5cax-wv6.googlevideo.com r1---sn-hp57kn6l.googlevideo.com r1---sn-hp57knsl.googlevideo.com r1---sn-hp57yn7y.googlevideo.com r1---sn-hp57yne7.googlevideo.com r1---sn-hp57ynes.googlevideo.com r1---sn-j5caxupj5-nwve.googlevideo.com r1---sn-j5caxupj5-nwvl.googlevideo.com r2---sn-5hoxuj5cax-nwv6.googlevideo.com r2---sn-hp57kn7z.googlevideo.com r2---sn-hp57knlr.googlevideo.com r2---sn-hp57knzz.googlevideo.com r2---sn-hp57yne6.googlevideo.com r2---sn-hp57ynee.googlevideo.com r2---sn-hp57ynez.googlevideo.com r2---sn-j5caxupj5-nwve.googlevideo.com r2---sn-q4f7sn7k.googlevideo.com r3---sn-5hoxuj5cax-nwv6.googlevideo.com r3---sn-hp57kn7s.googlevideo.com r3---sn-j5caxupj5-nwve.googlevideo.com r3---sn-j5caxupj5-nwvl.googlevideo.com r4---sn-5hoxuj5cax-nwv6.googlevideo.com r4---sn-j5caxupj5-nwve.googlevideo.com r4---sn-j5caxupj5-nwvl.googlevideo.com r5---sn-hp57knls.googlevideo.com r5---sn-hp57ynez.googlevideo.com r5---sn-j5caxupj5-nwve.googlevideo.com r5---sn-j5caxupj5-nwvl.googlevideo.com r6---sn-hp57kn7l.googlevideo.com r6---sn-hp57knz6.googlevideo.com
Buena suerte -
@cova16 ty for response. ill try it asap
-
@ugurk Hello, I think mobile youtube app uses different port number. Not sure which port. Use packet capture and then export to wire shark to find out.
-
good morning marcello
i have execute fetch in pfsense 2.4.4 actual ver
but now i dont view any program for install ( many info in attach image)
how can i do ?
Thanks
Alberto -
@pfsensation @marcelloc
does anyone had a success in setting up e2g in multiwan environment?
currently having latest pfsense + latest e2g...when i enable e2g all traffic are routed to "default" wan... -
Hi to everybody, my name is Marco and i'm a new in this forum.
I used pfsense from many years as simple router, firewall, openvpn server and load balancing server.Now i'm trying to proxy and filter contents with Squid and e2guardian.
First of all i want to thanks @marcelloc for his great work with the porting of e2guardian. Marcello i hope that you and other users can help me, i'm trying to obtain my goal from many days, with no results.I have a pfsense box with Squid and e2guardian installed. In the same lan there is a samba4 LDAP.
My goal is to have from 2 to 4 users0s groups in LDAP that can browse the web with LDAP authentication on proxy with different e2guardian ACL based on content list (like Shalla's Blacklist).
The situation now is that i can autenthicate with the LDAP users but e2guardian seems not to recognize the correct LDAP group and so the applied filter list is wrong. Can you help me?
If is not possible is ok to have just 2 list: the first, for unauthenticated users, with filtered navigation, and the second, for some autenticathed ldap users, with unfiltered navigation.
Hope @marcelloc o someone can help me.
Good work, and byeee ;-)
-
@Albertopfsense
Same problem here.@Albertopfsense I found how to revert to show official packages again.
Just execute the command below with SSH access or by Diagnostic | Command Prompt.
rm /usr/local/etc/pkg/repos/Unofficial.conf -
@Albertopfsense Before Patch, after fetch apply. Later pfsense pc restart.
-
@kenpachizaraki E2guardian not work multiwan, unfortunately. Only failover working.
-
Hello all,
Hope all are safe and healthy
Can anyone provide a binary release of e2g 5.3.4? @marcelloc ?
Thanks.
-
@marcelloc Hi,
I am getting below error when I am opening the social media websites in my network.
Once I switch to my home network I can easily access social media website
PFA of an error message .
-
@yogeesh said in Unofficial E2guardian package for pfSense:
@marcelloc Hi,
I am getting below error when I am opening the social media websites in my network.
Once I switch to my home network I can easily access social media website
PFA of an error message .If you have MITM enabled, you need to install the CA certificate on the client machine. As E2 Guardian essentially breaks the HTTPS encryption.
-
Is there a way to download the E2Guardian package and install it offline ?
-
Hi everyone, I am having an issue maybe some of you guys have faced this same behavior,
my e2g just randomy stopped listening to the config, if I change an IP on a group the change does not take effect, If I add a new site to an ACL it does not take effect, anyone with this kind of issue? -
@la6er said in Unofficial E2guardian package for pfSense:
Hi everyone, I am having an issue maybe some of you guys have faced this same behavior,
my e2g just randomy stopped listening to the config, if I change an IP on a group the change does not take effect, If I add a new site to an ACL it does not take effect, anyone with this kind of issue?Enable the soft restart option, press apply and see if that helps.
-
@la6er
It seems when making changes to an IP in a group. I need to stop E2G and restart under Status\Services. I have very little trouble with E2G stopping on me. In fact I do not even enable the watchdog feature. It just runs. It does take some tweeking when first setting up E2G. Make sure to go through the various lists and turn off or delete entries that reference any file that does not exist. I found it very helpful to SSH into router with WinSCP and modify some config files directly. -
Hi all,
I'm using E2Guardian 5 from Unofficial Repository, not as transparent proxy and I'm getting some "The site requested does not exist" for simple local websites.
All filters were disabled, for tests.
Log error shows "2021.07.05 08:21:04 192.168.0.2 http://portal.mydomain.local 403 192.168.0.2 Default NETERROR Exceção do sítio confere. (Site on Exception list)"The local site is working when accessed by Squid, or directly, does someone here have some idea of how to fix it? I was wondering if the problem is something DNS related but I can't find a way of how to force DNS servers on E2Guardian and taking a look at DNS logs, everything appears to be Ok.
Can someone help?
Thanks in advance.
-
@drmwndr said in Unofficial E2guardian package for pfSense:
Hi all,
I'm using E2Guardian 5 from Unofficial Repository, not as transparent proxy and I'm getting some "The site requested does not exist" for simple local websites.
All filters were disabled, for tests.
Log error shows "2021.07.05 08:21:04 192.168.0.2 http://portal.mydomain.local 403 192.168.0.2 Default NETERROR Exceção do sítio confere. (Site on Exception list)"The local site is working when accessed by Squid, or directly, does someone here have some idea of how to fix it? I was wondering if the problem is something DNS related but I can't find a way of how to force DNS servers on E2Guardian and taking a look at DNS logs, everything appears to be Ok.
Can someone help?
Thanks in advance.
Definitely something to do with your DNS setup, are you using DNS resolver? I've got internal sites too and haven't run into any issues although I'm no longer using squid.
-
@pfsensation said in Unofficial E2guardian package for pfSense:
Definitely something to do with your DNS setup, are you using DNS resolver? I've got internal sites too and haven't run into any issues although I'm no longer using squid.
Hi @pfsensation. I have Bind installed on my pfsense box as DNS Server. I also have a NAT and a Firewall Rule redirecting all LAN1 Interface Traffic to port 53 to my pfSense box.
Is it necessary to enable and set pfSense DNS Resolver? Looks like e2guardian is bypassing this rule and looking directly on outside DNSs. -
@drmwndr said in Unofficial E2guardian package for pfSense:
@pfsensation said in Unofficial E2guardian package for pfSense:
Definitely something to do with your DNS setup, are you using DNS resolver? I've got internal sites too and haven't run into any issues although I'm no longer using squid.
Hi @pfsensation. I have Bind installed on my pfsense box as DNS Server. I also have a NAT and a Firewall Rule redirecting all LAN1 Interface Traffic to port 53 to my pfSense box.
Is it necessary to enable and set pfSense DNS Resolver? Looks like e2guardian is bypassing this rule and looking directly on outside DNSs.Unfortunately I don't use BIND either, but when you run nslookup on the client device, can it resolve your internal domains? Another gotcha is DNS over HTTPS/TLS, make sure that's disabled in the browser and lock down port 853 from LAN1.
-
@pfsensation said in Unofficial E2guardian package for pfSense:
@drmwndr said in Unofficial E2guardian package for pfSense:
@pfsensation said in Unofficial E2guardian package for pfSense:
Definitely something to do with your DNS setup, are you using DNS resolver? I've got internal sites too and haven't run into any issues although I'm no longer using squid.
Hi @pfsensation. I have Bind installed on my pfsense box as DNS Server. I also have a NAT and a Firewall Rule redirecting all LAN1 Interface Traffic to port 53 to my pfSense box.
Is it necessary to enable and set pfSense DNS Resolver? Looks like e2guardian is bypassing this rule and looking directly on outside DNSs.Unfortunately I don't use BIND either, but when you run nslookup on the client device, can it resolve your internal domains? Another gotcha is DNS over HTTPS/TLS, make sure that's disabled in the browser and lock down port 853 from LAN1.
Yep, at client device it look up locally, but on pfSense box, it goes directly to External DNS.
Will take a better look at DNS Setup.Thank you so much!
-
With 2.5.2-RELEASE the 25_unofficial_packages_list.patch has issues
See
https://github.com/marcelloc/Unofficial-pfSense-packages/issues/94 -
Update, even though the System Patches test shows a warning you can still apply it.
-
cant install on 2.5.2 ce. repo file wont load new packages with patch applied.
-
Hello.
This is new for me, does e2guardian can work alone or need squid to work?
I had read that is a excellent replacement for SG.
But what is the advantage or disadvantage alone or with in conjunction with squid?
Thanks for your help.
-
Yes it can work alone. Does not need squid.
-
@marcelloc thanks
-
Anyone else having issue with E2guardian and Rocket League? I am having difficulties trying to bypass the proxy for the Rocket League servers (as the servers do not connect by going through the proxy).
I have tried bypassing the following source address with out any luck
account-public-service-prod03.ol.epicgames.com
datarouter.ol.epicgames.com
global.koala.epicgames.comI also get the following when I try and connect.
https://127.0.0.1I have been using the E2guardian Monitor to see which servers it is trying to connect to however even though I have allowed all servers I still cannot connect and get a lot of https://127.0.0.1
Anyone else have this issue?
-
@ageekhere said in Unofficial E2guardian package for pfSense:
Anyone else having issue with E2guardian and Rocket League? I am having difficulties trying to bypass the proxy for the Rocket League servers (as the servers do not connect by going through the proxy).
I have tried bypassing the following source address with out any luck
account-public-service-prod03.ol.epicgames.com
datarouter.ol.epicgames.com
global.koala.epicgames.comI also get the following when I try and connect.
https://127.0.0.1I have been using the E2guardian Monitor to see which servers it is trying to connect to however even though I have allowed all servers I still cannot connect and get a lot of https://127.0.0.1
Anyone else have this issue?
Have you had a look at the logs? What I'd personally do is create an alias called E2G_DST_Bypass, put all those domains in there then in E2 Guardian configure that alias to bypass the transparent rule. This will bypass E2G completely for those domains.
-
@pfsensation Yes this is what I do as well, however even bypassing the domains that show in E2guardian Monitor I am still not able to connect.
The logs show a lot of
https://127.0.0.1 0 - Default -
When starting Rocket League. -
@ageekhere said in Unofficial E2guardian package for pfSense:
@pfsensation Yes this is what I do as well, however even bypassing the domains that show in E2guardian Monitor I am still not able to connect.
The logs show a lot of
https://127.0.0.1 0 - Default -
When starting Rocket League.If you've done the bypass as I mentioned in the previous post, those domains won't even show up in E2 Guardian logs. Just to be clear, I'm talking about the bypass in transparent proxy located here: e2guardian > daemon > 'bypass proxy for these destination IPs'. Put your alias in there and it should bypass the proxy altogether.
-
@pfsensation Yes this is correct, the bypass domains no longer show in E2 Guardian logs, however I still get the connection issue and a lot of https://127.0.0.1 0 - Default -
This is the first game I have come across where the normal bypass does not seems to be working correctly.
I guess the best way to see the issue is to install Rocket League and see if you have the same issue.
This game must be very picky about going through a proxy (if I fully bypass the proxy for the pc then I am able to connect).
-
Hello marcelloc or other e2guardian users, does e2guardian is already support for pfsense 2.5.2?
Regards!!! -
@periko said in Unofficial E2guardian package for pfSense:
Hello marcelloc or other e2guardian users, does e2guardian is already support for pfsense 2.5.2?
Regards!!!I've been using it on 2.5.2 for months now, no issues.
