Bekijk de volledige versie : WL500g as restrictive proxy
Hi.
First of all thanx to all of contributors, this is marvelous peace of HW when a community like this is supporting.
I have a task I have to solve.
I am building a home network for my brother and he would like to set a proxy server for his kids. But instead of list of forbidden pages, he would like to have a file with list of allowed sites and update it from time to time.
I found out, that some people already installed Junkbuster on the box, but it's approach is to restrict few pages and allow the rest.
Can anyone give me some advice, what proxy could be used for this type of connection?
Did anyone solve a problem like this already?
Thanx in advance.
Sancho
Well, it seems like we all have our good and bad moments :o
Just yesterday I have been looking for something similar.
There is a program called privoxy, and it may well be capable of
doing what you want. There is a mipsel-port (http://www.xs4all.nl/~rop/openwrt/) of this, targeted at
the OpenWRT-platform, perhaps you can use that.
An other possibility is squid, which is available as ipkg.
You may find some info on its related software page (http://www.squid-cache.org/related-software.html) but keep in mind
that not all the mentioned software is ported to the mipsel-platform.
squid itself is capable of what your brother wants, but needs a restart
when you change the list of allowed sites. If that is not a problem,
then I personally would use squid. It is capable of authenticating
users, use time as a parameter for allowing or denying access, among
lots of other things. Very powerful, but setting the rules can be complex.
Regards, Jaap.
Well, it seems like we all have our good and bad moments :o
Just yesterday I have been looking for something similar.
There is a program called privoxy, and it may well be capable of
doing what you want. There is a mipsel-port (http://www.xs4all.nl/~rop/openwrt/) of this, targeted at
the OpenWRT-platform, perhaps you can use that.
An other possibility is squid, which is available as ipkg.
You may find some info on its related software page (http://www.squid-cache.org/related-software.html) but keep in mind
that not all the mentioned software is ported to the mipsel-platform.
squid itself is capable of what your brother wants, but needs a restart
when you change the list of allowed sites. If that is not a problem,
then I personally would use squid. It is capable of authenticating
users, use time as a parameter for allowing or denying access, among
lots of other things. Very powerful, but setting the rules can be complex.
Regards, Jaap.
I found it even more simple.
There is a discussion thread about the junkbuster here, on The Forum.
And I found out, that using the * as the basic rule and then allowing few sites using ~site_address works like a charm. I even managed to save the excutable to the flashfs including the config file, so no USB Flashdisk is required for the operation (and I am not risking that kids will simply disconnect it :cool: ).
Anyhow, thanx for the answer.
If anyone need help with this one, drop me a mail on sancho@sancho.sk.
Maybe I will add some wiki page later...
Some users asked me to help them with the filtering, so I will try to do my best...
First of all, you need Oleg's latest firmware.
I am using version 1.9.2.7-6b.
Next, download the file I attached to this post.
Upload it to the router and log in using telnet or ssh.
Untar the file using tar -zxvf junkbuster.tar.gz.
Next, you will need to create a flashfs startup config to have the files loaded after router restart:
If you don't have it already, make a directory /tmp/local/sbin.
Next, create a directory /tmp/local/sbin/junkbuster.
Move the extracted files to this directory.
To make this quick, short and easy to start, I will obbey all the configuration possibilities of JunkBuster (but I found them very usable later, especially logging).
The sblock.ini file contains the main blocking section.
To have a restrictive proxy, you should start with *.
This will ban all the URLs for clients.
Next, using the ~character, input the sites you want to allow.
So, some small example:
*
~google.com
~disney.com
~barbie.com
In this setup, any other page than google, disney and barbie will lead only to small info page, that Internet Junkbuster disallow access to this site.
Works extremly well.
Next, I wanted the proxy to start automatically and work even without the USB memory key attached.
That's why I putted it into the /tmp/local/sbin directory.
As a next step, check the /tmp/local/sbin/post-firewall script.
If there is no file, make one using vi /tmp/local/sbin/post-firewall command.
Mine one is very short:
#!/bin/sh
/tmp/local/sbin/junkbuster/junkbuster /tmp/local/sbin/junkbuster/junkbuster.ini
Save the file and run following commands:
flashfs save
Make sure the file is smaller than 64kB. If it is smaller, you can commit using
flashfs commit
And finnaly, to make sure the script will be executed after restart, run
flashfs enable
After this, the script will be executed after each reboot of the router.
You can start the junkbuster without restarting using command
/tmp/local/sbin/junkbuster/junkbuster /tmp/local/sbin/junkbuster/junkbuster.ini &
Next, you have to setup the client browser to use the proxy server.
Set your proxy IP as address and 3128 as port (the port can be changed in the ini file).
Problem is, that IPtables will still forward all the requests, so using of alternative browser without the proxy settings will obbey the JunkBuster and allow client to see pages we don't want to.
Because of this, I have to stop forwarding using iptables.
But I did not find some way at this time.
I found some hints using the redirect command of iptables, but it is not working the way I want to.
Also, I would like to filter the web access only for few clients, for some with correct IP address I would like not to filter anything.
Any help is appreciated...
Thanks Sancho for this tip.
For people who leave the junkbuster tool on an usb-key (like me) the script need to be in /usr/local/sbin/post-firewall
The /.../junkbuster /.../junkbuster.ini must also be the last one because it's not a deamon and the script will not continue.
Or you could add an "&" at the end to have the script running in the backgroun.
Sancho, do you know how to change the junkbuster default page when your not authorized?
PS: do you know if http://www.privoxy.org/ could fit on the Wl500 ?
informix
19-09-2005, 16:05
do you know if http://www.privoxy.org/ could fit on the Wl500 ?
Hi. I've tried privoxy from OpenWRT packages distribution on my Oleg's 6b firmware. It is operatible, but as I see WL500g DELUXE processor is not so fast. When I try to connect to any website through proxy running on my router there is a large connection lag. And if I run 'top' command on my router I see that privoxy uses almost 100% of CPU while serving my request.
Problem is, that IPtables will still forward all the requests, so using of alternative browser without the proxy settings will obbey the JunkBuster and allow client to see pages we don't want to.
Because of this, I have to stop forwarding using iptables.
The forwarding is all controlled by (surprise...) the FORWARD-chain.
You can list the rules in this chain by executing
iptables -L FORWARD -v -n
The -v switch forces that the packet- and byte-counters will be displayed before each rule.
The -n disables the ip-address_to_name-translation (as in many linux-commands).
This will make the command execute faster.
It will look something like this:
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- br0 br0 0.0.0.0/0 0.0.0.0/0
0 0 logdrop all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
6920 1115K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- eth1 * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x16/0x02 limit: avg 1/sec burst 5
0 0 ACCEPT tcp -- eth1 * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x04 limit: avg 1/sec burst 5
0 0 ACCEPT icmp -- eth1 * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 icmp type 8
105 4960 logdrop all -- br0 eth1 0.0.0.0/0 0.0.0.0/0
0 0 logdrop all -- eth1 br0 0.0.0.0/0 0.0.0.0/0
These rules are probably the result of the settings in the web-interface.
You can extend these rules, by executing iptables-commands in the
/usr/local/sbin/post-firewall. With iptables it is possible to insert and delete
rules on a chain, so if you choose your commands carefully you will be able
to use the web-interface to do the basic settings, and your custom
commands to fulfill your specific needs.
Other possibility is to flush all the filter-chains completely, and build a
complete new set yourself in a file, and load that set with the command
iptables-restore. But remember that in this way you in fact overwrite the
rules generated by the web-interface, so if you later try to change some
rules using the web-interface, those changes will not become active
because you replace them with your own set.
Now, if iptables is your middle name you probably don't need the
web-interface to create the rules for you, but lots of people have
other middle names (if one at all) and they probably don't want to give up
on the web-interface. Choose for yourself how you want to cope with that.
Anyway, the rules you need are something like follow.
In these examples I presume that br0 is your LAN-interface,
and eth1 is your WAN-interface (as they are on my WL500g):
(This next rule will prevent your child's PC to have a direct HTTP-connection
to some webserver on the internet, make one such a rule for every child)
FORWARD -i br0 -o eth1 -s ip-of-childPC -m tcp -p tcp --sport 1024: --dport 80 -j DROP
(This next rule will allow your own PC to have a direct HTTP-connection to
some webserver on the internet, make one such a rule for every non-child-PC)
FORWARD -i br0 -o eth1 -s ip-of-adultPC -m tcp -p tcp --sport 1024: --dport 80 -j ACCEPT
The exact syntax depends on wether you use iptables or iptables-restore,
but you get the idea. Be sure to insert them before the last rule, which
is a general drop.
Since your child-PC's are now not able anymore to surf directly on the net
they have no other option than to use the junkbuster-proxy. But again,
as with forwarding, iptables should allow them to. This is controlled by
the INPUT-chain.
(This next rule will allow your child's PC to have a connection with
the junkbuster-proxy, make one such a rule for every child)
INPUT -i br0 -s ip-of-childPC -m tcp -p tcp --sport 1024: --dport 3128 -j ACCEPT
jaaput, that was a hell of an explanation :-)
I will use the iptables-restore command at the end of post-firewall script.
Have been thinking to disable kids communication outside on all ports but the junkbuster's one.
This could help me to get rid of trojans, viruses etc.
The only problem will be email communication, that I should filter against spam and viruses, but I will probably handle this one on the provider's side on request (they offer a service like this already).
And I will force the kids to use webmail instead of some email progra. I know that the confort of webmail is far from the Thunderbird's one, but this is the compromise I have to make because of their safety.
Later, when they became aware of the danger from internet, I will simply add a rule allowing the SMTP port from their machines.
And, next step will be the ICQ etc :-)
Thanks again for your explanation of iptables problematic and for your helpfull examples.
Once again, great forum :-)
Hello Sancho,
Well, I do have to make up for some jumping to conclusions.
But thanks for the compliment.
I must confess, it wasn't even finished. I pressed "Submit Reply" way to
early, and was adding text by editing the topic. And after a few cycles of
thinking and typing I've fallen asleep... :o
So you may have wondered: does this guy not need an OUTPUT-rule to
enable the proxy to contact the internet? And the answer is: yes, I do.
My guess is that you fixed that yourself. But better safe than sorry.
Hence, for the sake of completeness (also towards the other readers):
OUTPUT -o eth1 -s ip-of-AsusWAN -m tcp -p tcp --sport 1024: --dport 80 -j ACCEPT
Now you do not need the "-s ip-of-AsusWAN", and if that ip-address is
handed to you by DHCP, you probably better leave it out.
Regarding the security of the client-PC's, it may well be worth the effort
to try and assign them no default gateway. I do share your fear of
backdoors and trojans, and if you cut their way out to the internet by
2 ways (no forwarding in the Asus firewall-part, and no way out of
the client-PC in the first place, simply because there is no route),
then such programs can only use the web-proxy.
If they are able to find that (meaning they need to have the code to
recognize the proxy-settings of the clients default? browser)
then they still have to get passed junkbuster.
I think it will effectively eliminate their risk. The PC's may get infected,
but the backdoors will simply not be able to operate as designed.
Lateron, you can add routes to ICQ-servers and the like, but if your
clients start peer-to-peer processes (perhaps ICQ does that also?),
than you have almost no choice but to add the gateway again.
Or (hopefully) be able to install a proxy-server on the Asus for those
client-processes. Maybe socks can help you out by that time.
Do you know if junkbuster comes with maintained blacklist of sites that
are used by backdoors? I believe squidGuard does, but I have not found
an ipkg for that yet (though I didn't search thoroughly).
I know that with the whitelist-method you don't need that, but I do
administer some clients for which the whitelist will always be to short,
and for them I am looking for a blacklist-solution.
And I agree, this is a great forum.
I think forums are one of the great advantages of the Internet, really
contributing to a "smaller world" (despite some forums that have a bad reputation).
And this forum certainly is a good one!
Kind regards, Jaap Putman.
10'18/~360