Is possible to log user access on http, https?

dimsum

Hi There,

I have med a captive portal for free wifi in the office but the office needs to keep a log of who has access to the internet. I need to know who, when, and the destination. A captive portal has only logs of who has a login but doesn't know the destination. Also, I looked in the DNS resolver log it has the IP and domain name resolved but no user login.

I have looked at squid proxy with transparent but it doesn't work on https. and I don't want a user to do anything when using the free wifi e.g. setting the proxy in their mobile, tablet, and laptop.

How can I combine or custom cative portal and DNS resolver log?

Any idea please advise.

Thanks.

Gertjan

@dimsum said in Is possible to log user access on http, https?:

I don't want a user to do anything when using the free wifi

Then don't let him connect in the first place

Status > System Logs > Authentication > Captive Portal Auth shows the user's IP and MAC,
Take note : the IP will be an IP in your own local network, and the MAC is probably randomized.

https traffic, as any other TLS traffic : unbreakable.

You could install pfBlockerng - block all known "DNS over HTTPS/TLS/QUIC Blocking" on Firewall > pfBlockerNG > DNSBL SafeSearch
Add this Redirecting Client DNS Requests so clients are forced to use pfSEnse as there DNS.

... now you'll have :

so you can see where they go.

dimsum

@Gertjan said in Is possible to log user access on http, https?:

You could install pfBlockerng - block all known "DNS over HTTPS/TLS/QUIC Blocking" on Firewall > pfBlockerNG > DNSBL SafeSearch
Add this Redirecting Client DNS Requests so clients are forced to use pfSEnse as there DNS.

Can you explain these steps to process? I have to install pfBlocker and create a DNS redirect rule. but I cannot get any log just like you.

Here is my setting:

Thanks.

Gertjan

@dimsum

Don't enable SafeSerach Redirection and Youtube Restrictuions as you have to study the side effects first.

Use these settings :

and add also, while you're there, add one or two 'small' DNSBL :

Note somewhere on a post-it : "the host names present in these two lists will get blocked".

dimsum

Thank you for your help.