Unofficial E2guardian package for pfSense

marcelloc

Awesome, thanks! Now that it seems to be working, any advice on getting it to work with Squid transparently?

Dansguardian as two work modes.

The sandwich mode, where there is a squid -> e2guardian -> tinyproxy or any other cache

Or the starndard mode where it stays in front of squid or any other cache and try to forward client authentication requests

What mode are you using?

E2guardian transparent mode while in front of squid is setup manually, creating a nat rule pointing to its listening port.

marcelloc

I've moved the download and apply blacklist options from combo values to buttons on xml

Cino

It might be just my setup but there isn't any defaults for the 4 options under Anti-Virus. The boxes have no text. Also, under Search Engine there are no options only an Add/Save button. Click on Add, no options; only save. I downloaded the latest xml files this morning.

running on
2.3.4-DEVELOPMENT (amd64)
built on Tue Apr 04 16:31:17 CDT 2017
FreeBSD 10.3-RELEASE-p17

marcelloc

I'll test it today.

I'm also including the ssl group options introduced on e2guardian since 3.1 version

Stewart

@marcelloc:

@Stewart:

Awesome, thanks! Now that it seems to be working, any advice on getting it to work with Squid transparently?

Dansguardian as two work modes.

The sandwich mode, where there is a squid -> e2guardian -> tinyproxy or any other cache

Or the starndard mode where it stays in front of squid or any other cache and try to forward client authentication requests

What mode are you using?

E2guardian transparent mode while in front of squid is setup manually, creating a nat rule pointing to its listening port.

It would be transparent. SquidGuard doesn't need any NAT rules and just integrates with Squid. Does e2Guardian not behave the same way? I want it transparent with Squid so do I need a NAT rule that points LAN 80 to LAN 8080 and then e2G will automatically forward to Squid?

marcelloc

E2guardian is a daemon, not a squid helper. You need to configure ip, port , forward rules as a normal proxy daemon.

Stewart

Ah, it's completely independent of Squid, then. Where does it sit in-line? I'll check the manuals tomorrow but does it sit between Squid and the user or between Squid and the WAN? I'm sure the forwards needed are in the documentation so I'll see if I can find the ports needed in the morning. Thanks for all your help!

marcelloc

@Stewart:

Ah, it's completely independent of Squid, then. Where does it sit in-line? I'll check the manuals tomorrow but does it sit between Squid and the user or between Squid and the WAN? I'm sure the forwards needed are in the documentation so I'll see if I can find the ports needed in the morning. Thanks for all your help!

E2guardian replaces squidguard and in some cases can do all squid job too but it needs a cache peer to fetch urls.

The idea of this package is to have a full-feature replacement for squidguard and depending on you user authentication needs, dansguardian package itsel will do the job as it include tynyproxy for url fetch.

marcelloc

I've updated the binaries and GUI to include dnsauth and icap antivirus integration. The idea is to call clamv exactly the same way squid does to avoid package conflict.

marcelloc

Latest TODO as far as I can see

add gui group ssl options introduced since E2guardian 3.1
fix search acl tab and configuration
increase tiny proxy config values to March E2guardian start process configuration
Configure clamav icap

danjeman

A method of configuring it to listen on a CARP address via the GUI would be great too - Squid you can do this from the 'Advanced Features - Custom Options'… or is this not possible with e2g, looks like multi interface listen causes problems at the moment?

marcelloc

@danjeman:

It looks like multi interface listen causes problems at the moment?

Not anymore. I've hard coded a config option util multi auth psr port is better implemented on gui.

Stewart

How do we update? Rerun the script? That's what I've done and I've got some changes.

marcelloc

@Stewart:

How do we update? Rerun the script? That's what I've done and I've got some changes.

Yes, rerun. Few days ago I've updated the e2guardian binaries to include icap and dnsauth.

Stewart

I reran the script and suddenly e2Guardian wouldn't load. The error was:

/usr/local/etc/rc.d/e2guardian.sh: WARNING: failed to start e2guardian
Error parsing the e2guardian.conf file or other e2guardian configuration files
Error loading auth plugins
auth_plugin_load() returned NULL pointer with config file: /usr/local/etc/e2guardian/authplugins/proxy-header.conf 
Unable read plugin config plugname variable /usr/local/etc/e2guardian/authplugins/proxy-header.conf

I was able to get it to start by uncommenting the last 3 lines in /usr/local/etc/e2guardian/authplugins/proxy-header.conf:


low case
header = ''

plugname = 'proxy-header'

Not sure what uncommenting them does but it allows it to load.

Stewart

Well, it loads but it doesn't do anything. Whether I try to create a NAT rule or just set the browser to 8080, no pages load. They all just time out. I'm watching /var/log/system.log but it isn't showing anything.

marcelloc

I'll what's different from my working e2guardian. Did you selected any authentication method?

Stewart

I've tried Proxy-Basic and none. Now, some pages load. Others are blocked but show a category of NA. I also can't get to the pfSense GUI from the local network. Is there a way to reset to defaults in case I've done something?

Edit: i am getting a bunch of:

Apr 10 17:25:20 	e2guardian 	53019 	stats reset to freechildren 16 busychildren 2 numchildren 18
Apr 10 17:25:20 	e2guardian 	53019 	freechildren 15 + busychildren 2 != numchildren 18
Apr 10 17:25:20 	e2guardian 	53019 	stats reset to freechildren 16 busychildren 2 numchildren 18
Apr 10 17:25:20 	e2guardian 	53019 	freechildren 16 + busychildren 1 != numchildren 18
Apr 10 17:25:20 	e2guardian 	53019 	stats reset to freechildren 17 busychildren 1 numchildren 18
Apr 10 17:25:21 	e2guardian 	53019 	freechildren 16 + busychildren 1 != numchildren 18
Apr 10 17:25:21 	e2guardian 	53019 	stats reset to freechildren 17 busychildren 1 numchildren 18
Apr 10 17:25:21 	e2guardian 	53019 	freechildren 15 + busychildren 2 != numchildren 18
Apr 10 17:25:21 	e2guardian 	53019 	stats reset to freechildren 16 busychildren 2 numchildren 18
Apr 10 17:25:21 	e2guardian 	53019 	freechildren 14 + busychildren 3 != numchildren 18
Apr 10 17:25:21 	e2guardian 	53019 	stats reset to freechildren 15 busychildren 3 numchildren 18
Apr 10 17:25:21 	e2guardian 	53019 	freechildren 14 + busychildren 3 != numchildren 18
Apr 10 17:25:21 	e2guardian 	53019 	stats reset to freechildren 15 busychildren 3 numchildren 18
Apr 10 17:26:36 	e2guardian 	53019 	freechildren 16 + busychildren 1 != numchildren 18
Apr 10 17:26:36 	e2guardian 	53019 	stats reset to freechildren 17 busychildren 1 numchildren 18
Apr 10 17:26:36 	e2guardian 	53019 	freechildren 16 + busychildren 1 != numchildren 18
Apr 10 17:26:36 	e2guardian 	53019 	stats reset to freechildren 17 busychildren 1 numchildren 18
Apr 10 17:26:36 	e2guardian 	53019 	freechildren 17 + busychildren 0 != numchildren 18
Apr 10 17:26:36 	e2guardian 	53019 	stats reset to freechildren 18 busychildren 0 numchildren 18
Apr 10 17:26:37 	e2guardian 	53019 	freechildren 17 + busychildren 0 != numchildren 18
Apr 10 17:26:37 	e2guardian 	53019 	stats reset to freechildren 18 busychildren 0 numchildren 18
Apr 10 17:26:39 	e2guardian 	53019 	freechildren 17 + busychildren 0 != numchildren 18
Apr 10 17:26:39 	e2guardian 	53019 	stats reset to freechildren 18 busychildren 0 numchildren 18

in the log now.

marcelloc

Unselect any autentication, save and apply(and maybe restart the service). The small documentation on proxy-header says that you must select a http header field to identify as users, and then add them on groups


# Proxy-header auth plugin
# FredB August 2016
# Identifies users with header;
# relies upon the upstream proxy.
# Eg: in groups file
# Mozilla/5.0 (Windows NT 6.1; rv:47.0) Gecko/20100101 Firefox/47.0=filter3
# here:
# header = 'user-agent'

danjeman

Have updated looks ok so far except on the menus if you go to IPs then ACLs changes to Access Lists - will clear cache etc. and check again…

Don't believe sync has ever worked with the default 'Sync to configured system backup server' either - this is the log entry..

Apr 11 11:57:52 php-fpm 69222 /pkg_edit.php: [E2guardian] xmlrpc sync is enabled but there is no system backup hosts to push squid config.
Apr 11 11:57:52 php-fpm 69222 /pkg_edit.php: Reloading E2guardian

Every other package syncs fine with this setting.

Stewart

@marcelloc:

Unselect any autentication, save and apply(and maybe restart the service). The small documentation on proxy-header says that you must select a http header field to identify as users, and then add them on groups
# Proxy-header auth plugin
# FredB August 2016
# Identifies users with header;
# relies upon the upstream proxy.
# Eg: in groups file
# Mozilla/5.0 (Windows NT 6.1; rv:47.0) Gecko/20100101 Firefox/47.0=filter3
# here:
# header = 'user-agent'

Is there a difference between "None" and not having any selected?

Stewart

With no authentication set I now get an Access Denied page from Squid.

When I access a page the Squid logs show:

1491926079.428      3 127.0.0.1 TCP_MISS/403 4185 GET http://forum.pfsense.com/ - HIER_NONE/- text/html
1491926079.455    248 127.0.0.1 TCP_MISS/403 4287 GET http://forum.pfsense.com/ - ORIGINAL_DST/127.0.0.1 text/html
1491926079.499      2 127.0.0.1 TCP_MEM_HIT/200 13066 GET http://localhost:3128/squid-internal-static/icons/SN.png - HIER_NONE/- image/png
1491926079.599      1 127.0.0.1 TAG_NONE/409 4118 CONNECT urs.microsoft.com:443 - HIER_NONE/- text/html
1491926079.601      1 127.0.0.1 TAG_NONE/409 4118 CONNECT urs.microsoft.com:443 - HIER_NONE/- text/html

/var/log/e2guardian/access.log shows:

2017.4.11 13:29:04 - 192.168.1.100 http://forum.pfsense.com/  GET 3849 0  1 403 text/html  Default   - -
2017.4.11 13:29:04 - 192.168.1.100 https://urs.microsoft.com:443  CONNECT 4118 0  1 200 -  Default   - -
2017.4.11 13:29:04 - 192.168.1.100 https://urs.microsoft.com:443  CONNECT 4118 0  1 200 -  Default   - -

No matter what page I go to, I get those same 5 lines. The first 2 vary depending on where I go but the last 3 are exactly the same. If I point directly to the Squid proxy port then pages load. If I pass through transparently then it works. If I point to the port 8080 for e2guardian it fails. I've gone back and undone the changes I made to proxy-header.conf and everything loads properly now. I've deselected all auth plugins on the General page.

EDIT: Well, not every time. I also get

1491928118.800 86400440 192.168.1.157 TAG_NONE/200 0 CONNECT 216.58.218.2:443 - HIER_NONE/- -
1491928118.800 86400301 192.168.1.157 TAG_NONE_TIMEDOUT/409 0 CONNECT pagead2.googlesyndication.com:443 - HIER_NONE/- text/html;charset=utf-8

EDIT 2: Here's my config:

forcequicksearch = off
reverseaddresslookups = off
reverseclientiplookups = off
logclienthostnames = off
createlistcachefiles = on
prefercachedlists = off
maxcontentfiltersize = 256
maxcontentramcachescansize = 1000
maxcontentfilecachescansize = 2000
filecachedir = '/tmp'
deletedownloadedtempfiles = on
initialtrickledelay = 20
trickledelay = 20
downloadmanager = '/usr/local/etc/e2guardian/downloadmanagers/fancy.conf'
downloadmanager = '/usr/local/etc/e2guardian/downloadmanagers/trickle.conf'
downloadmanager = '/usr/local/etc/e2guardian/downloadmanagers/default.conf'
contentscannertimeout = 60
contentscanexceptions = off
mapauthtoports = off
recheckreplacedurls = off
forwardedfor = off
usexforwardedfor = off
logconnectionhandlingerrors = on
logsslerrors = off
logchildprocesshandling = off
maxchildren = 120
minchildren = 8
minsparechildren = 8
preforkchildren = 10
maxsparechildren = 64
maxagechildren = 500
maxips = 0
ipcfilename = '/tmp/.dguardianipc'
urlipcfilename = '/tmp/.dguardianurlipc'
ipipcfilename = '/tmp/.dguardianipipc'
nodaemon = off
nologger = off
logadblocks = off
loguseragent =
daemonuser = 'clamav'
daemongroup = 'nobody'
softrestart = on
cacertificatepath = '/etc/ssl/demoCA/cacert.pem'
caprivatekeypath = '/etc/ssl/demoCA/private/cakey.pem'
certprivatekeypath = '/etc/ssl/demoCA/private/serverkey.pem'
generatedcertpath = '/usr/local/etc/e2guardian/ssl/generatedcerts'

pfsensation

Wanted to say, thanks for bringing this project back alive. Been waiting an extremely long time for E2 Guardian, as it seems to tick all my boxes in being able to scan HTTPS traffic properly, without having to rely on a black list or DNS based blocking. Most people don't seem to understand the importance of HTTPS scanning, even knowing that there's always new proxies, and websites coming along to bypass blocks.

How is the status of the package now? I see Stewart is saying that it isn't working, is it working for everyone else?

marcelloc

I've tested normal proxy and SSL interception. Did not started testing authentication and antivirus integration

Stewart

@pfsensation:

Wanted to say, thanks for bringing this project back alive. Been waiting an extremely long time for E2 Guardian, as it seems to tick all my boxes in being able to scan HTTPS traffic properly, without having to rely on a black list or DNS based blocking. Most people don't seem to understand the importance of HTTPS scanning, even knowing that there's always new proxies, and websites coming along to bypass blocks.

How is the status of the package now? I see Stewart is saying that it isn't working, is it working for everyone else?

I've wiped the box I was having problems with and will go back to testing once my other projects simmer down since I couldn't ever get it to work properly. I'll report back here once I get back on it.

pfsensation

So I got this setup at basic level, and have got a phrase list up. However, how do I get it to scan HTTPS sites? I have a phrase list up for pornography, and it seems to be working for http sites but not HTTPS. And now it seems more and more websites are moving to HTTPS.

I am purely trying to test the phrase matching system, and make sure that this system is able to block those sites.

marcelloc

Create the CA on pfSense
apply it on e2guardian config
Install ca certificate on browser

Stewart

@marcelloc:

Create the CA on pfSense
apply it on e2guardian config
Install ca certificate on browser

I thought it could be done transparently in e2Guardian. Is that not so?

pfsensation

@marcelloc:

Create the CA on pfSense
apply it on e2guardian config
Install ca certificate on browser

Got it working by setting "Filter SSL sites forging SSL certificates" on group settings. However I am getting a error saying common name invalid on chrome, its working on Edge and Internet Explorer. Also, is there anyway to modify the block page? The standard DansGuardian one looks pretty terrible.

marcelloc

@Stewart:

I thought it could be done transparently in e2Guardian. Is that not so?

I don't think so. To anylize the page content, it needs to be in the middle. The splice all feature on squid, if I'm not worng, extracts sites included on remote ip certificate and check against acls, no interception at all is done this way.

marcelloc

@pfsensation:

is there anyway to modify the block page? The standard DansGuardian one looks pretty terrible.

Sure, just need to edit template file on gui. Try to not include any javascript on it. At least on previous package version, pfSense GUI was including some extra code from active session.

pfsensation

What browser is everyone else using for HTTPS inspection? Chrome just doesn't seem to want to accept the self signed certificate. Even though I have it installed on my system as a trusted root CA.

marcelloc

I use chrome. What chrome complains about the site? Is the generated certificate different from the site your are trying to access?

pfsensation

@marcelloc:

I use chrome. What chrome complains about the site? Is the generated certificate different from the site your are trying to access?

Chrome complains about a missing alternative name, seems like it could be an issue relating to the way Squid forges certificates.

Here's a link to what I found regarding this issue, seems it's related to browsers upping security. I know you can get around this for sure since they do it at my school using smoothwall.

http://stackoverflow.com/questions/43665243/chrome-invalid-self-signed-ssl-cert-subject-alternative-name-missing

pfsensation

Found a small issue, when you block a category of domains using black list. When you try to visit any domain in that category it shows categories as : N/A, instead of showing the actual category.

marcelloc

@pfsensation:

Found a small issue, when you block a category of domains using black list. When you try to visit any domain in that category it shows categories as : N/A, instead of showing the actual category.

Saw this while using Dansguardian in the past. Do you think it's an old bug or something with report template file?

pfsensation

@marcelloc:

@pfsensation:

Found a small issue, when you block a category of domains using black list. When you try to visit any domain in that category it shows categories as : N/A, instead of showing the actual category.

Saw this while using Dansguardian in the past. Do you think it's an old bug or something with report template file?

Maybe an old bug, because it does seem to show the category if you use phrase lists.

marcelloc

e2guardian v 4.1 is stable now. I'll start updating the package for this new version.

Looks like it will not need anymore changes on SO to allow more then 1024 clients. On current compiled version I've set it to 4096 IIRC.

https://github.com/e2guardian/e2guardian/releases

exograpix

Thanks marcelloc for your effort, if possible, please provide us exact steps to install and configure for e2guardian. guide will be highly appreciated.

pfsensation

@exograpix:

Thanks marcelloc for your effort, if possible, please provide us exact steps to install and configure for e2guardian. guide will be highly appreciated.

Basic setup is explained in OP and on Github.

@Marcelloc, the search engine tab is still broken in the GUI D: However, wanted to say hats off to you man! Just got this setup in my home environment, no longer in VM. I've only got it setup basically with domain blocking now. I know phrase lists work since I tested in a virtual environment, I will set that up too when I understand how it properly works. As the algorithm of how the system decides a website is good or bad + the options available is slightly overwhelming.