CARP and Web Filters
-
Hi. I'm planning to run 2 pfsense boxes in production using CARP. To control access to the web and instant messaging, I'm planning to use Barracuda Networks' IM firewall and their Web Filter. Each device has a an ethernet passthrough port, because they are designed sit inline (bridging, as opposed to routing). My question is, the filters will need to be connected to the WAN end of each pfsense, which would mean that I could only filter traffic from one pfsense (since the devices only have one passthrough) Does anyone see any way around this, so that when failover occurs, filtering is intact? Or does anyone know of any more suitable content filters?
Greetings from Jamaica. One Love!
-
Best way if they have to sit inline would be like this:
LAN – Barracuda -- switch -- pfsense
with an additional switch between Barracuda and pfsense, since you'll be using CARP. Not sure if those Barracuda products are any good or not, depending on your IM and filtering needs, you may be able to get by with just using pfsense.
-
Yes, makes sense :) Thank you very much!
There's one other thing I forgot to mention though. We have a branch office, and instead of deploying lots of hardware there, I wanted to route all traffic to our main office, where we can monitor and set policies. Think I'll have to get an additional filter? Or is there a way around that?
I doubt that pfsense will be able to filter web and IM traffic the way I want, though. IM clients nowadays will search for any open port to use, and, failing that actually tunnel their traffic over HTTP, the cheeky bastards! The dedicated filters even integrate with Active Directory to set polices.
Thanks again for your response.
-
You may be able to block IM if you so desire using Snort, not sure if it detects IM or not, that's the common way to block P2P traffic. IMSpector is available in packages to monitor IM. There isn't a good content filter yet, but there is a commercial one that will be available as a package before too long.
Problem with routing branch office traffic back through your main office is it wouldn't go through Barracuda the way I showed it above. If you don't need to see the traffic before it gets NAT'ed, you could do this instead:
LAN – pfsense -- switch -- Barracuda -- modem/router
where modem/router is whatever device connects you to your ISP, whether a perimeter router, cable or DSL modem, etc.