pfSense Gold Subscription

Author Topic: Unofficial E2guardian package for pfSense  (Read 27644 times)

0 Members and 1 Guest are viewing this topic.

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 13398
  • Karma: +589/-7
    • View Profile
Unofficial E2guardian package for pfSense
« on: March 29, 2017, 02:01:36 pm »
Here are install instructions for UNOFFICIAL e2guardian package for pfSense(R) software 2.3.x

Install
You can enable Unoffical repo creating or downloading the file below using diagnostics -> command  prompt -> Execute Shell Command prompt menu:

2.3 AMD64
Code: [Select]
fetch -q -o /usr/local/etc/pkg/repos/Unofficial.conf https://raw.githubusercontent.com/marcelloc/Unofficial-pfSense-packages/master/Unofficial.conf

2.3 I386
Code: [Select]
fetch -q -o /usr/local/etc/pkg/repos/Unofficial.conf https://raw.githubusercontent.com/marcelloc/Unofficial-pfSense-packages/master/Unofficiali386.conf

2.4
Code: [Select]
fetch -q -o /usr/local/etc/pkg/repos/Unofficial.conf https://raw.githubusercontent.com/marcelloc/Unofficial-pfSense-packages/master/Unofficial.24.conf

After fetching the repo file, you can see these packages under System -> Package Manager

Without enabling Unofficial repo, you can add it using console/ssh with

Code: [Select]
cd /root
fetch https://raw.githubusercontent.com/marcelloc/Unofficial-pfSense-packages/master/pkg-e2guardian/files/install_e2guardian_23.sh
sh ./install_e2guardian_23.sh

E2guardian requires a cache/upstream server , so if you do not want to use squid together with e2guardian, point e2guardian proxy configuration to 127.0.0.1 port 8888 to use tinyproxy cache server instead.

http://www.shallalist.de/Downloads/shallalist.tar.gz is one of compatible blacklists for e2guardian. Configure it under blacklist tab.

Once it finishes, all must be in place. If you do not see the menu after it finishes, try to install any pfSense package from GUI, like cron for example.


*WARNING*

Use it at your own risk.

This script install packages from freebsd and change your config file.
« Last Edit: May 31, 2017, 11:56:21 am by marcelloc »

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 13398
  • Karma: +589/-7
    • View Profile
Re: Unofficial E2guardian package for pfSense
« Reply #1 on: March 29, 2017, 05:48:18 pm »
I've updated the install code to use version 3.5.1 and ssl interception.


Offline Pistolero

  • Jr. Member
  • **
  • Posts: 96
  • Karma: +0/-0
    • View Profile
Re: Unofficial E2guardian package for pfSense
« Reply #2 on: March 30, 2017, 11:11:55 am »
Hola Marcelloc!

Will this package's configuration be kept in the system config.conf file? So if I restore that file, my E2Guardian config will be restored as well?

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 13398
  • Karma: +589/-7
    • View Profile
Re: Unofficial E2guardian package for pfSense
« Reply #3 on: March 30, 2017, 11:37:45 am »
Hola Marcelloc!

Will this package's configuration be kept in the system config.conf file? So if I restore that file, my E2Guardian config will be restored as well?

Yes it will !  :)

Offline Pistolero

  • Jr. Member
  • **
  • Posts: 96
  • Karma: +0/-0
    • View Profile
Re: Unofficial E2guardian package for pfSense
« Reply #4 on: March 30, 2017, 12:53:31 pm »
Thank you, sir. Could I make a humble suggestion? Is there a way to implement a config backup/restore/reset function in the package itself? This would be more efficient to restore a config than restoring the system conf file. Also, could be used to replicate the configuration of just this package to other firewalls.

Also, a question... will the package automatically find Squid and configure its integration? Or is that a manual process?

Thanks!

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 13398
  • Karma: +589/-7
    • View Profile
Re: Unofficial E2guardian package for pfSense
« Reply #5 on: March 30, 2017, 01:00:09 pm »
The sync config between boxes is already there. The squid integration is a manual process.

The restore function I'll think about later.

Offline Pistolero

  • Jr. Member
  • **
  • Posts: 96
  • Karma: +0/-0
    • View Profile
Re: Unofficial E2guardian package for pfSense
« Reply #6 on: March 31, 2017, 12:09:54 pm »
Thank you, sir. Could you please post instructions on how to integrate E2 with Squid?

Thanks a bunch, muito obrigado!

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 13398
  • Karma: +589/-7
    • View Profile
Re: Unofficial E2guardian package for pfSense
« Reply #7 on: March 31, 2017, 12:52:49 pm »
Basically, define the ip and squid port on squid config on first tab. The second tab shows the authentication e2guardian support to pass through squid.

All other tabs flow the configure from left-to-right, viewing each tab and saving config.

Offline Stewart

  • Full Member
  • ***
  • Posts: 255
  • Karma: +16/-2
    • View Profile
Re: Unofficial E2guardian package for pfSense
« Reply #8 on: April 03, 2017, 11:14:32 am »
Looks nice.  I'll have to give it a try.  A couple of questions:

1.  Why a custom script and not get it officially into the Package Manager?
2.  Is there documentation to get up and running?  It looks like you create separate entries under the various ACLs and then create a Group and assign the ACLs to it.  There's a lot of options on a lot of screens and they aren't all clear to me.
3.  Aside from AD, how do we assign users to different groups?  With squidGuard I needed to use the persons MAC to assign an IP through DHCP and then I could use that IP under a different ACL.  I don't see a way to tie an IP or MAC into a group in here.

Thanks for the work.  This would be a big improvement over squidGuard if I can figure it out.

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 13398
  • Karma: +589/-7
    • View Profile
Re: Unofficial E2guardian package for pfSense
« Reply #9 on: April 03, 2017, 01:10:29 pm »
Looks nice.  I'll have to give it a try.  A couple of questions:

2.  Is there documentation to get up and running?  It looks like you create separate entries under the various ACLs and then create a Group and assign the ACLs to it.  There's a lot of options on a lot of screens and they aren't all clear to me.
The e2guardian configuration is really complex but extremely powerfull. Some options you get on general configuration but most is applied per group.

A basic setup:
  • Apply the shalist under blacklist tab
  • Configure the default group under acl
  • save config

At this point, E2guardian users are required only when you have more then one group. All unauthenticated users or unlisted users will match first filter group.

So if you want to test a user based configuration, create a second group

  • Configure squid as your parent proxy under daemon tab
  • Select the Auth Plugin you want to interact with your squid configured user authentication
  • save and apply config

Offline Stewart

  • Full Member
  • ***
  • Posts: 255
  • Karma: +16/-2
    • View Profile
Re: Unofficial E2guardian package for pfSense
« Reply #10 on: April 03, 2017, 03:30:19 pm »
Is there any difference in the AV of E2guardian vs Squid?  They both appear to be Clam but Squid seems to give more options for custom databases.

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 13398
  • Karma: +589/-7
    • View Profile
Re: Unofficial E2guardian package for pfSense
« Reply #11 on: April 03, 2017, 03:55:03 pm »
Is there any difference in the AV of E2guardian vs Squid?  They both appear to be Clam but Squid seems to give more options for custom databases.

IIRC e2guardian has per group scan options but I agree clamd on squid has more options.

Maybe you need to test both bu for now, you can keep on squid.

we need a lot of tests to archive the best config for e2guardian on pfSense.

I'm planning an captive portal integration just the same way I did on squid.

Offline Stewart

  • Full Member
  • ***
  • Posts: 255
  • Karma: +16/-2
    • View Profile
Re: Unofficial E2guardian package for pfSense
« Reply #12 on: April 03, 2017, 04:16:17 pm »
I'm going to try to get some testing done tomorrow to see what I can come up with.  Looking through the config options is a bit daunting, especially the Pics area since the value ranges keep changing.  And where do I add in phrases to block?  Can we create our own phrase lists?

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 13398
  • Karma: +589/-7
    • View Profile
Re: Unofficial E2guardian package for pfSense
« Reply #13 on: April 03, 2017, 04:19:57 pm »
Can we create our own phrase lists?

sure.

This is a wiki of Dansguardian. Most options works the same way on e2guardian.

http://contentfilter.futuragts.com/wiki/doku.php

https://github.com/e2guardian/e2guardian/wiki/Configuration

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 13398
  • Karma: +589/-7
    • View Profile
Re: Unofficial E2guardian package for pfSense
« Reply #14 on: April 03, 2017, 06:26:39 pm »
I've changed the submenu display style. I think it's better to see and undertand where you are.

What do you think?

images style1 are current pkg framework

images style2 has new style view.

What do you think?