How to configure HAVP



  • Hi all,

    i've searched all over the web for this answer, but actually i've not found this!
    Can anyone explain me how to configure HAVP to scan http traffic and block download of infected files?
    I've installed HAVP and SQUID, it's possible to work HAVP standalone or need a proxy server?

    Thansk a lot!!!



  • @LiquiD_85:

    Hi all,

    i've searched all over the web for this answer, but actually i've not found this!
    Can anyone explain me how to configure HAVP to scan http traffic and block download of infected files?
    I've installed HAVP and SQUID, it's possible to work HAVP standalone or need a proxy server?

    Thansk a lot!!!

    HAVP - http antivirus proxy. You must configure havp on LAN iface with proxy port different by squid-port (squid default 3128) And coinfigure client browser to the havp proxy port.
    Now havp not supported work via squid (squid > havp > inet) and not supported 'transparent proxy'. But i work with this.



  • Ok i will try, but what do you mean with "Now havp not supported work via squid"? Do you mean that HAVP will not block virus downloading or infected pages anyway?
    Squid is necessary for HAVP working?

    Thx for your time!

    LiquiD



  • @LiquiD_85:

    Ok i will try, but what do you mean with "Now havp not supported work via squid"? Do you mean that HAVP will not block virus downloading or infected pages anyway?
    Squid is necessary for HAVP working?

    Thx for your time!
    LiquiD

    Ahm  :)
    HAVP - this is a full proxy. You can use for your users without squid.
    Havp block infected content (scripts, downloads & etc ..)



  • Thanks a lot, i'm trying now i'll tell if successfull!

    Thnx for your time



  • It's working 100%, it's a very good tool. With transparent proxy will be perfect!

    Thanks a lot!

    bye.
    LiquiD



  • can havp(squid not installed) be used on several networks/vlans ?

    i seem only to be able to choose lan, is that doable?

    /F



  • @fredde:

    can havp(squid not installed) be used on several networks/vlans ?

    i seem only to be able to choose lan, is that doable?

    /F

    Thanks for good question. I must explore this.



  • Quick questions:

    1. How long is support for transparent proxy with squid?
    2. General question, why pfsense do not support or not fully some packages such as HAVP or Dansguardian while others distro such as endian or smoothwall haven't problems to implement theese?

    Thanks!



  • @LiquiD_85:

    1. General question, why pfsense do not support or not fully some packages such as HAVP or Dansguardian while others distro such as endian or smoothwall haven't problems to implement theese?

    Because they are completely different product with different goals? I think I understand the spirit of the question but it's like asking why orange juice comes from oranges and not apples.  It would make as much sense to go to the smoothwall forum and ask why they don't have a freeswitch package or carp support.

    Just guessing but I would imagine it is almost certainly down to a matter of priorities and time.  The bonus so far is that under pfSense it would seem that anything has been possible … given the time and priority.



  • @LiquiD_85:

    Quick questions:

    2) General question, why pfsense do not support or not fully some packages such as HAVP or Dansguardian while others distro such as endian or smoothwall haven't problems to implement theese?

    The question is who this will do? And why? If you need a package - you can do it himself or ask someone else.



  • Thanks to dvserg and adrianhensler, i've asked just to know, not for criticize! Dansguardian seems a very powerfull tool to block a lot of category of searches and urls (ex. violence hacking etc.)!

    Thank you very much!

    LiquiD



  • … If you need a package ...

    I'm not so expert :(



  • @adrianhensler:

    it's like asking why orange juice comes from oranges and not apples

    Hahaha … Very sympathetic, i understand perfectly, i'm a C++ and Deplhi programmer, not very expert, but i can understand this kind of situations!!

    Thanks a lot!



  • @LiquiD_85:

    Thanks to dvserg and adrianhensler, i've asked just to know, not for criticize! Dansguardian seems a very powerfull tool to block a lot of category of searches and urls (ex. violence hacking etc.)!

    Sorry.
    I just wanted to say that there are 2 ways - to do it himself or ask someone else.
    pfSense is not commercial project and the developers can not do everything at once.
    What you see in the packages do different people at different times for their own needs.
    And only then it is added to the packages.
    The support package is also being done by those who made their.
    Sorry my english  :-[



  • @dvserg:

    @LiquiD_85:

    Thanks to dvserg and adrianhensler, i've asked just to know, not for criticize! Dansguardian seems a very powerfull tool to block a lot of category of searches and urls (ex. violence hacking etc.)!

    Sorry.
    I just wanted to say that there are 2 ways - to do it himself or ask someone else.
    pfSense is not commercial project and the developers can not do everything at once.
    What you see in the packages do different people at different times for their own needs.
    And only then it is added to the packages.
    The support package is also being done by those who made their.
    Sorry my english  :-[
    [/quote]

    Yes, yes of course!!!
    No, sorry for MY english i'm italian i kown english from school and not very well :D:D:D

    thanks a lot!



  • Hello ,

    I installed 1.2.2 version and i want to use squid + squidguard + imspector+ havp ..squid and squidguard are working but havp i think is not running i am not sure . ( how to decide this dont know ) .I conf to squid port 8080 and havp port is the same squid port 8080.I read this form this port must diffrent.When i change the proxy port 3128 and havp port 8080 and set the client proxy port to 8080.this time client can't access web .What isthe mistake i did.

    Thank you very much.

    Ps: I am a new user .



  • @akintemel:

    Hello ,

    I installed 1.2.2 version and i want to use squid + squidguard + imspector+ havp ..squid and squidguard are working but havp i think is not running i am not sure . ( how to decide this dont know ) .I conf to squid port 8080 and havp port is the same squid port 8080.I read this form this port must diffrent.When i change the proxy port 3128 and havp port 8080 and set the client proxy port to 8080.this time client can't access web .What isthe mistake i did.

    Thank you very much.

    Ps: I am a new user .

    You can use HAVP independently - define Interface & free port (different by squid). Configure you  clients browser to this interface ip/port
    Also for use HAVP with squid (INET -> HAVP -> SQUID -> Client) you must configure HAVP with internal client and configure squid : http://doc.pfsense.org/index.php/Squid_Package_Tuning - 'Parent proxy' part.



  • Currently, I have a firewall that can use havp to AV scan things that squid is proxying.  It's configured in the way you describe: INET -> HAVP -> SQUID -> Client  And, I have squid set up to be a transparent proxy also.  Everything seems to be working.  Question is, squid can work as an FTP proxy also.  But, when I send the ftp request to squid, it gets the files, but it does not seem to be scanning the files.  Any ideas how I can make havp scan the files that squid gets through ftp?

    Also, is there a way to make squid and/or havp work as an ftp transparent proxy?  (I know the last question is a little off topic)

    Thanks



  • Squid & HAVP is a http proxy. Maybe ftp over http only will filtered (via browser)?



  • I've another problem, HAVP block me if i want to download a big file for example ubuntu that is 700MB and say:"Not enough free space on server" i've set "Scan max file size" to 100, but it's the same!
    Someone can help me to set HAVP block only files bigger then XX bytes?? Thanks a lot!!!



  • @LiquiD_85:

    I've another problem, HAVP block me if i want to download a big file for example ubuntu that is 700MB and say:"Not enough free space on server" i've set "Scan max file size" to 100, but it's the same!
    Someone can help me to set HAVP block only files bigger then XX bytes?? Thanks a lot!!!

    Look this option
    Max download size /*Enter value or leave empty. Value in bytes. Downloads larger than 'Max download size' will be blocked. Only if not Whitelisted! */



  • It's the same  :'( :'( :'(

    Strongly i've notice that my Memory usage is 54%  ??? ??? ???



  • Here my whole HAVP config. Thanks






  • According to the FAQ on HAVP's website…  HAVP can support ftp only if the parent proxy allows FTP.  Then, looking at the first line of the squid website, it says that squid is a "proxy for the Web supporting HTTP, HTTPS, FTP, and more.".  If my understanding of parent proxies is correct, then with this situation: squid -> HAVP -> inet, HAVP is the parent proxy for squid.  So, HAVP doesn't have a parent proxy.  Would there be any problem with switching the order of the proxies?  Specifically, if HAVP found a virus in something that squid already downloaded, would it be able to remove the file from the cache?



  • This is just a first look at trying to help:

    From what I can see of the config screens, the max download size is in bytes.  Can you set it to 1 000 000 000 (1Gb), and see what happens?



  • It's the same  ??? ??? ???



  • If max download size set empty ??



  • Max download size -> empty

    Selected only "Enable" and "Use external interface" (on LAN)

    Same problem :'(



  • HAVP give me same error also if i want to download a driver or a free anti-virus for example www.tgsoft.it, files of a little ammount of MB about 2-3MB!!! I can't think that pfsense don't have 2-3MB of free space!!!



  • I'm not sure if this will help or not, but some virus scanners have a max stream size.  Clamav is one of them.  I don't know if this applies to your situation, but you might want to look there just to be sure.



  • you need to fix the memory device used for havp, if i'm not wrong it is actually 1mb

    Just open havp.inc into /usr/local/pkg and look for mdconfig

    Remember that this value is used to create a in-memory fs so don't set it too high or you will get problems :) (if your FW have 128mb of memory, a value of 32mb would be good)



  • Ram grid:

    # RAM disk
    #  Mem -  RAM
    # 128M -  16M
    # 256M -  32M
    # 512M -  64M
    #   1G - 128M
    #
    function mountRAMdisk()
    {
        # ! not use RAM disk with VM !
        if (!VMWare_detect()) {
            # 2 Mb by default
            $mem = 2;
    
            # available system memory (Mb)
            $av_mem = get_memory();
            $av_mem = intval($a_mem[0]);
    
            # use mem
            if      ($av_mem >= 1024) $mem = 128;
            else if ($av_mem >=  512) $mem = 64;
            else if ($av_mem >=  256) $mem = 32;
            else if ($av_mem >=  128) $mem = 16;
            else if ($av_mem >=   64) $mem = 8;
    
            # detach and free all resources used by /dev/md10:
            mwexec("umount /var/tmp/havp");
            mwexec("mdconfig -d -u 10");
    
            # create and mount a swap backed file system on /var/tmp/havp by /dev/md10:
            mwexec("mdconfig -a -t swap -s {$mem}M -u 10");
            mwexec("newfs -U /dev/md10");
            mwexec("mount /dev/md10 /var/tmp/havp");
            mwexec("chmod 1777 /var/tmp/havp");
        }
    }
    
    function VMWare_detect()
    {
        global $g;
        $fc = '';
    
        if (file_exists("{$g['varlog_path']}/dmesg.boot") !== false)
            $fc = file_get_contents("{$g['varlog_path']}/dmesg.boot");
    
        return (strpos($fc, "<vmware virtual")="" !="=" false);<br="">}</vmware> 
    


  • Ok, i'm trying to change 1MB into 32MB …

    @dvserg: $av_mem and $mem are two variables or two built-in procedures? I understand a little bit of programmation (C C++ access Delphi Pascal) i'm not an expert programmer but i can understand a source code!

    Thanks a lot!



  • I've changed 1MB into 32MB, but if i save and try without restart pfsense same problem, if i restart pfsense havp.inc came back to the original with 1MB!!!  ??? ??? ??? ??? ??? ??? ??? ??? ???



  • Ok, setting mdconfig to 16 or 32MB i can download files from internet such as virIT from www.tgsoft.it waiting about 20-30 seconds before download it but for bigger download such as ubuntu iso image also waiting 4-5 minutes the download not start at all!!

    If any idea please tell me, i've finished my tests!



  • I will test you problem too  ???



  • Thanks a lot i wait for your response dvserg, if you wanti can give you my msn contact!



  • @LiquiD_85:

    Thanks a lot i wait for your response dvserg, if you wanti can give you my msn contact!

    Possible test option ?
    KEEPBACKBUFFER 600

    I download 30-50 mbyte files success.



  • What's your mdconfig?I need to restart HAVP?


Log in to reply