Unofficial E2guardian package for pfSense

kenpachizaraki

@pfsensation yes outgoing ports can be block but most of them are using 443. So your legitimate 443 connections will also be blocked. They are really snicky little bastard to block using that method. Hopefully in the future e2g can find a way to block those traffic.

pfsensation

@kenpachizaraki Really? I did some testing a while back, when I blocked the VPN providers domain. It would mess up the vpn client to server negotiation and just fail to connect.

But I do understand your frustrations, it's difficult to properly block these VPN's on 443. I'll bring this up to the E2guardian devs and see if there's anything that can be done to mitigate the risks. I do know some firewall solutions such as Smoothwall actually work pretty well, so it can be done but I'm pretty certain you'll probably get some false positives for sure.

kenpachizaraki

@pfsensation if you know the vpn provider domain yes it can be easily block even using firewall.
Can you try this one in your chrome browser
https://chrome.google.com/webstore/detail/vpn-grab-a-proxy-free/epiohmjifijenpabfpggbphmjinbhgnn?hl=en

Hard part of this is you need to check logs on what domain that proxy is connecting.

kenpachizaraki

@pfsensation @marcelloc @ucribrahim is it possible for e2g maybe regex to get the wan ip address?
if wan = to interface wan (whatismyipaddress) = Pass
if wan != to interface wan (whatismyipaddress) = Block/Reject

Since if someone uses proxy wan ip changes to the proxy being used.
If this is possible then we can block those annoying proxy to bypass e2g or squid.

pfsensation

@kenpachizaraki I'll do some testing on this when I have some free time and can setup a virtual lab. At the moment I'm quite bogged down with work and life on general. But I have requested a a feature in E2guardian to detect and block VPN's.

pfsensation

@kenpachizaraki Although this can probably be done, passing or blocking due to the WAN IP hasn't been implemented into E2 Guardian. Not sure if this will be added or if its a good method even to block Internet access for those trying to bypass the firewall.

ravegen

OMG no one replies. I guess my question is really hard.
Or perhaps, no one would like to help.

ucribrahim

@ravegen What is your question? Maybe I can answer your question or someone will.

kenpachizaraki

@pfsensation @marcelloc
filed bugs on e2guardian already
https://github.com/e2guardian/e2guardian/issues/444

maybe someone can verify this one.

http and https://youtube is already blacked in e2guardian but when accessing using google chrome i can still access the site. But when using incognito mode, https://youtube is blocked.
Is this caching? or any settings i need to enable?

alt text

ucribrahim

@kenpachizaraki It is just cache, google chrome has strong caching. Just clear cache of your browser and try again.

If you still goes restricted domain, try to kill your client states on pfsense and also clear cache again of your browser. ( command : pfctl -k 192.168.1.1 )

Also It is not a bug at all.

kenpachizaraki

@ucribrahim ok if its cache how long will it retain?
Ive tested for several hours and still youtube is accessible even clicking on different videos

ucribrahim

@kenpachizaraki I don't know, search on google how google cache works.

ravegen

@ravegen said in Unofficial E2guardian package for pfSense:

@pfsensation said in Unofficial E2guardian package for pfSense:

@genesislubrigas There's no need for you to use Squid with E2 Guardian. You can still get stats with Light squid.

How do you get stats with Light squid ? Can you kindly assist. Thanks

this was my question

ucribrahim

This post is deleted!

ucribrahim

@ravegen

Hi,

I did some test on how to work Lightsquid with E2guadian. First, Install Lightsquid package and then use the following command.

fetch -o /usr/local/pkg/lightsquid.inc http://e-sac.siteseguro.ws/lightsquid/inc.txt

After that reboot your pfsense.

Go to Services > E2guardian > Report and Log, and under this menu, there is an option which is "Log File Format". Choose "Squid Log Format" and then save the settings.

After you do that go to Status > Squid Proxy Reports and then click "Refresh Full" button, after that, you'll need to see logs on the Lightsquid page which by clicking the "Open Lightsquid" button.

I was able to work the lightsquid service by changing "Log File Format > Squid Log Format" but it is gonna work with default option which of e2g log file format.

It is also so strange for example if you go to Daemon menu and at the bottom if you click Save button and then Save Changes button. E2g will be broken and only it is gonna work if you restart your pfsense. So guys do not do that so many times :)

ravegen

@ucribrahim said in Unofficial E2guardian package for pfSense:

@ravegen

Hi,

I did some test on how to work Lightsquid with E2guadian. First, Install Lightsquid package and then use the following command.
fetch -o /usr/local/pkg/lightsquid.inc http://e-sac.siteseguro.ws/lightsquid/inc.txt
After that reboot your pfsense.

Go to Services > E2guardian > Report and Log, and under this menu, there is an option which is "Log File Format". Choose "Squid Log Format" and then save the settings.

After you do that go to Status > Squid Proxy Reports and then click "Refresh Full" button, after that, you'll need to see logs on the Lightsquid page which by clicking the "Open Lightsquid" button.

I was able to work the lightsquid service by changing "Log File Format > Squid Log Format" but it is gonna work with default option which of e2g log file format.

It is also so strange for example if you go to Daemon menu and at the bottom if you click Save button and then Save Changes button. E2g will be broken and only it is gonna work if you restart your pfsense. So guys do not do that so many times :)

So it means it gets broken

pfsensation

@ucribrahim What gets broken? I've had this up and running for a while now with no issues, and didn't even need a restart.

Set E2 Guardian reporting to Squid format, install light squid, run the command. And just wait for the logs to come through. I didn't have to do anything else.

kenpachizaraki

@ravegen said in Unofficial E2guardian package for pfSense:

E2g will be broken and only it is gonna work if you restart your pfsense.

@pfsensation i think because you said this one.

ravegen

I made lightsquid working with e2guardian now. the problem now is the realtime does not show any feeds anymore.

ucribrahim

@ravegen I'm not saying that if you use Lightsquid with E2guardian it gets broken. Nooo! I'm saying that if you go to Daemon menu and click Save settings so many times at the same time. It will get broken and it is gonna work until you restart pfsense. I don't know it just me or someone knows that.

Maybe I'm wrong but this is my experience about e2guardian.

NOTE: There is no problem, using Lightsquid with E2guardian. @pfsensation said go to do that "Set E2 Guardian reporting to Squid format, install light squid, run the command. And just wait for the logs to come through. I didn't have to do anything else."

Of course use the following command and then restart pfsense after that go to do necessary settings.

fetch -o /usr/local/pkg/lightsquid.inc http://e-sac.siteseguro.ws/lightsquid/inc.txt