Blocking and Filtering using Squid and Squidguard
-
Hello guys
I need help,
- How do I allow certain users on my network to access social media sites?
- How do I allow all users to have access to social sites at specific time, like at lunch our?
Am using squid and squidguard
Thanks in advance
-
@eln said in BLOCKING AND FILTERING USING SQUID AND SQUIDGUARD:
Am using squid and squidguard
All that squid & guard sees, is the IP and probably the URL. That's it.
Big social networks have (tens of) thousands of IP's - and some get changed every day or less. And as you know, guys like youtube have dozens of URL also. Some are known, some or just invented this morning.
The actual traffic is stashed away under a thick layer of inaccessible TLS.
Wonder what usage squid and guard has these days .... (except being a reverse proxy).See what pfBlokcerNG can do for you.
Or "AS" the list together yourself using a script, and add the script into an alias, being used in a scheduled firewall drop rule
-
If you're running in transparent mode, as most people are, Squid will see the full URL for http and (for now) the FQDN for https traffic.
You can can configure Squidguard to filter different user groups but you need to select those. That's usually done by IP address so you might have all users on one wifi ssid/vlan filtered through oner set of ACLs and another vlan through another set.
Steve
-
@stephenw10 said in Blocking and Filtering using Squid and Squidguard:
Squid will see the full URL for http
Do you have access to numbers like : how much http compared to https are you seeing ? I guess I can say that there are days that nothing goes over by http anymore. Or is this just my experience ?
Mail and family was set up years ago to 465 / 993 / 995. FTP has been buried in 2007 .... -
Nope, but I agree it's almost all https, and should be. If you want to filter by the full URL or keyword etc you need to be doing full bump mode (MITM SSL intercept).
Steve
-
@stephenw10 Most of the users are on WIFI and as you know IP address changes all the time. I tried Group ACL, Common ACL, Set time range for access, but they are not working. Users are able to bypass.
If possible take me step by step on how to configure this. Its frustrating -
Are you able to filter for all users if you add it just to the common ACLs without custom groups?
If not there's no point trying to get different groups working until that part is.
You should watch the hangout we did on this if you have not already: https://youtu.be/xm_wEezrWf4
Steve
-
@stephenw10 Yes, I am able to filter all users, Also, I am able to exclude myself to have access to social sites
-
Ok then you just need a way to define different groups such as putting all the 'special access' users as static leases and all others dynamic. Or using separate subnets for each, different SSIDs.
Steve
-
@stephenw10 We are in one subnet, I tried filtering by IP Address and that way it seem to be working but remeber IP addresses changes all the time. I even tried blocking a range. However, the issues goes back to TIME the users can still by pass the firewall
-
How do you have it configured?
-
@stephenw10
Added Blacklist (Shallalist)
Created a target category (and added domain list)
Under Common ACL > Target Rule List ( My Target catergory is set to "DENY"
Saved
Under General Tab, Enable Checked then Apply -
Ok, but you said general filtering works just not with schedules right?
How do you have that configured? Please post screenshots so we can see exactly what is set.
Steve