The pfSense Store

Author Topic: Dansguardian package for 2.0  (Read 108626 times)

0 Members and 1 Guest are viewing this topic.

Offline burton78

  • Newbie
  • *
  • Posts: 1
    • View Profile
Re: Dansguardian package for 2.0
« Reply #30 on: January 30, 2012, 10:29:03 am »
Thanks for all your hard work marcelloc!  This is a great addition to pfsense!  Was wondering if adding a "transparent proxy mode" could be an option as well?

Also I caught a typo for ya too under Daemon -> Parent proxy Settings -> Proxy Port: Sets port number "fro" proxy server.

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9930
    • View Profile
Re: Dansguardian package for 2.0
« Reply #31 on: January 30, 2012, 10:33:07 am »
Thanks for all your hard work marcelloc!  This is a great addition to pfsense!  Was wondering if adding a "transparent proxy mode" could be an option as well?



I'll include PAC configuration to dansguardian package first.

When you enable trasparente proxy, you are not able to authenticate or filter ssl.

I'ts not that good for security at all.

Search for WPAD, PAC proxy.js or proxy.pac to see how auto detecproxy works.


Quote
Also I caught a typo for ya too under Daemon -> Parent proxy Settings -> Proxy Port: Sets port number "fro" proxy server.

Thanks.

« Last Edit: January 30, 2012, 10:36:26 am by marcelloc »

Offline Cino

  • Hero Member
  • *****
  • Posts: 1048
    • View Profile
Re: Dansguardian package for 2.0
« Reply #32 on: January 30, 2012, 11:37:55 am »
here is example of mine that i've been using with squid.
Code: [Select]
function FindProxyForURL(url, host) {

// If IP address is internal or hostname resolves to internal IP, send direct.

if (
          isInNet(host, "10.0.0.0", "255.0.0.0") ||
          isInNet(host, "172.16.0.0", "255.240.0.0") ||
          isInNet(host, "192.168.0.0", "255.255.0.0") ||
  isInNet(host, "127.0.0.0", "255.255.255.0") ||
  isInNet(host, "192.168.0.100", "255.255.255.255") ||
  isPlainHostName(host) ||
  localHostOrDomainIs(host, "127.0.0.1") ||
  dnsDomainIs(host, ".xxxx.net")
)

return "DIRECT";

return "PROXY 192.168.0.1:3128; DIRECT";
}

this is probably more to do with squid then danguardian. i've enabled forwardfor and/or xforwardfor but it always seem to get the IP address of the squid interface in the squid logs... Any ideas? I read there was a patch for squid but this patch is pretty old and you would think it was already built into squid2 and squid3..... i am using squid3 so it could be that...

Any ideas?

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9930
    • View Profile
Re: Dansguardian package for 2.0
« Reply #33 on: January 30, 2012, 11:52:58 am »
return "PROXY 192.168.0.1:3128; DIRECT";


Change this to dansguardian port and enable Auth Plugin on dansguardian general tab, this will log users.

to log x-forwarded ips you need to inlcude this x-forwarder no squid.conf log directive.

I did not found what to change but as you are using version 3.x, this doc can help
http://www.squid-cache.org/Doc/config/follow_x_forwarded_for/
 

EDIT
Try ip address authentication mode on dansguardian general tab.
This may log ip as a user on your squid.

You can also disable squid log and change dansguardian style to squid.
« Last Edit: January 30, 2012, 03:09:43 pm by marcelloc »

Offline itoxygen

  • Newbie
  • *
  • Posts: 13
    • View Profile
Re: Dansguardian package for 2.0
« Reply #34 on: January 30, 2012, 02:14:37 pm »
PfSense 2.0.1 install Dansguardian v.0.1.2
error code
php: /pkg_edit.php: The command '/usr/local/etc/rc.d/dansguardian stop' returned exit code '1', the output was 'dansguardian not running? (check /var/run/dansguardian.pid).'
Jan 30 22:13:19    dansguardian[38774]: Error reading custom image file.

where is problem?

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9930
    • View Profile
Re: Dansguardian package for 2.0
« Reply #35 on: January 30, 2012, 02:33:30 pm »
PfSense 2.0.1 install Dansguardian v.0.1.2
error code
php: /pkg_edit.php: The command '/usr/local/etc/rc.d/dansguardian stop' returned exit code '1', the output was 'dansguardian not running? (check /var/run/dansguardian.pid).'
Jan 30 22:13:19    dansguardian[38774]: Error reading custom image file.

where is problem?

try to start on console:
/usr/local/etc/rc.d/dansguardian start

Offline itoxygen

  • Newbie
  • *
  • Posts: 13
    • View Profile
Re: Dansguardian package for 2.0
« Reply #36 on: January 30, 2012, 02:39:13 pm »
Dansguardian service status is running, but system logs error message

Jan 30 22:36:57    php: /pkg_edit.php: The command '/usr/local/etc/rc.d/dansguardian stop' returned exit code '1', the output was 'dansguardian not running? (check /var/run/dansguardian.pid).'
Jan 30 22:36:57    dansguardian[50366]: Error reading custom image file.

Content filter not working

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9930
    • View Profile
Re: Dansguardian package for 2.0
« Reply #37 on: January 30, 2012, 02:42:19 pm »
Are you configuring client browser to use squid port or dansguardian port?

Can you paste return from:
ps ax | grep -i dansguardian

Offline itoxygen

  • Newbie
  • *
  • Posts: 13
    • View Profile
Re: Dansguardian package for 2.0
« Reply #38 on: January 30, 2012, 02:49:20 pm »
Squid transparent proxy mode port number 3128, I add the adress to the black list of squid, it works without problem

$ ps ax | grep -i dansguardian
  130  ??  I      0:00.00 /usr/local/sbin/dansguardian
  366  ??  I      0:00.00 /usr/local/sbin/dansguardian
  527  ??  I      0:00.00 /usr/local/sbin/dansguardian
  557  ??  I      0:00.00 /usr/local/sbin/dansguardian
  895  ??  I      0:00.00 /usr/local/sbin/dansguardian
 1176  ??  I      0:00.00 /usr/local/sbin/dansguardian
 1288  ??  I      0:00.00 /usr/local/sbin/dansguardian
 1464  ??  I      0:00.00 /usr/local/sbin/dansguardian
 1530  ??  I      0:00.00 /usr/local/sbin/dansguardian
48666  ??  S      0:00.00 sh -c ps ax | grep -i dansguardian
48931  ??  S      0:00.00 grep -i dansguardian
63558  ??  Is     0:00.02 /usr/local/sbin/dansguardian
63861  ??  I      0:00.01 /usr/local/sbin/dansguardian

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9930
    • View Profile
Re: Dansguardian package for 2.0
« Reply #39 on: January 30, 2012, 02:51:44 pm »
Squid transparent proxy mode port number 3128, I add the adress to the black list of squid, it works without problem


Your dansguardian is running.

Instead of using squid on transparent mode, config your browser to use dansguardian ip and port.

If you want o improve your transparente setup, configure WPAD/PAC on your DHCP.


Offline itoxygen

  • Newbie
  • *
  • Posts: 13
    • View Profile
Re: Dansguardian package for 2.0
« Reply #40 on: January 30, 2012, 02:58:50 pm »
my system configurations was working without problem on the squidquard, I unistalled squidquard and i installed dansquardian but now filter function is not working

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9930
    • View Profile
Re: Dansguardian package for 2.0
« Reply #41 on: January 30, 2012, 03:01:57 pm »
my system configurations was working without problem on the squidquard, I unistalled squidquard and i installed dansquardian but now filter function is not working

Try a simple https://facebook.com with squid transparent + squidguard to see how transparent proxy is a ilusion of web filtering.


Dansguardian must stays in front of squid and a proxy configuration must exist to filter https and authenticate users.


If you really need transparent squid, you will need to setup a squid -> dansguardian -> squid.

Dansguardian does not works like squidguard, take a look on dansguardian website do understand better how it works.

« Last Edit: January 30, 2012, 03:04:16 pm by marcelloc »

Offline itoxygen

  • Newbie
  • *
  • Posts: 13
    • View Profile
Re: Dansguardian package for 2.0
« Reply #42 on: January 30, 2012, 03:18:07 pm »
Can you inform me with a more detailed explanation? If it is possible an explanation step by step for the settings of dans guardian will be better for me. I really appreciate your help. Thank you very much.

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9930
    • View Profile
Re: Dansguardian package for 2.0
« Reply #43 on: January 30, 2012, 03:25:21 pm »
Can you inform me with a more detailed explanation? If it is possible an explanation step by step for the settings of dans guardian will be better for me. I really appreciate your help. Thank you very much.

If you understand the transparent proxy limitation, follow these links to get how automatic proxy configuration works

WPAD/PAC info
http://www.davidpashley.com/articles/automatic-proxy.html

http://www.grape-info.com/doc/win2000srv/internet-gw/wpad/index.html

Offline Cino

  • Hero Member
  • *****
  • Posts: 1048
    • View Profile
Re: Dansguardian package for 2.0
« Reply #44 on: January 30, 2012, 04:57:54 pm »
i'm going to keep my auto proxy config pointing directly to squid's port but on certain computers, manually enter the port for dansguardian.

For client ip logging from dansguard to squid, what i'm finding is there are 2 IPs, the client IP and 127.0.0.1. Going to http://checker.samair.ru/ show's this request when I have either forwardfor and/or usexforwardfor within dansguard and Disable X-Forward in squid unchecked.

squid logs only shows 127.0.0.1.. I'll have to do some more research and do some packet sniffing to verify whats going on.... Its been awhile, but i remember this work prefect when I was using 'client - hvap - squid'.. Squid reported the real client IP in its logs...


EDIT: I did a quick tcpdump and dansguard seems to sending the client IP under X-Forward-For within HTTP traffic.
« Last Edit: January 30, 2012, 07:42:36 pm by Cino »