Web Filtering

[Sunderwood]

Hi All,

i was wondering if someone could give me a bit of advice?

Probably like yourselves our internet provider is our LA and they also provide our web filtering. But on the old occasion our students find out websites that we want immediataly blocking. Does anyone operate a web filtering system lan side of their internet connection?

[webman]

We use IPCop, with the Advproxy and URLFilter addons.

[My220x]

Wouldn't it be best to do all the filtering yourself?

[FN-GM]

Its not as simple as that. Some LA's will not allow it

[GrumbleDook]

Smoothwall sorts us out, but I would look into whether your LA /RBC allows you to directly administer your filtering that they provide you.

[Geoff]

Its not as simple as that. Some LA's will not allow it

Which is a stupid policy.

[tom_newton]

Most LA's will relent eventually, IME. Which one are you in?

[kevin_lane]

at the moment we have web sense and also we use impero to do some of our filtering and class room management

[Athlona]

Hi, I am trialling Smoothwall - School Guardian web filtering and it works a treat pricey but it does a great job...

[SpuffMonkey]

Smoothwall again here

[FN-GM]

Most LA's will relent eventually, IME. Which one are you in?

We are in Rochdale, they will do it we are just in the middle of a battle getting them to remove it.

[richard.thomas]

We use IPCop with URLFilter addon, works a treat. Broadband Sandwell use Netsweeper which isn't amazing. The students are quickly realising that if they use https:// rather than http:// most proxys that BB Sandwell have blocked work... Thats when IPCop comes into play.
Also if i see on securus or vision that they've found a new proxy that one gets blocked. Always good having a walk around the school at lunch, can get all the new proxy aviodance websites

We are in Rochdale, they will do it we are just in the middle of a battle getting them to remove it.

Ah! My home town
When i was at school they used to use IEs content filtering, and the password was the intials of the school... And the BIOS password was RM (the machines were RM machines)... Oh the joys :P

[Zoom7000]

Which is a stupid policy.

Isn't this the case with most of the LA policies?

[FN-GM]

Ah! My home town
When i was at school they used to use IEs content filtering, and the password was the intials of the school... And the BIOS password was RM (the machines were RM machines)... Oh the joys

What school was it?

[Modey]

We will shortly be using a combination of Netsweeper (as provided by EMBC) which we don't really rate that highly and also our own internal ISA server.

I have been playing around with ISA in the last few days and have managed to get it do do what I need now. One thing I did need to do was export all of our existing blacklisted sites (the ones we have specifically blocked ourselves) into a file that I could then use to add to the ISA servers filtering.

This isn't quite as easy as you would imagine (getting it into ISA I mean). I did manage to find a script that allows you to bulk import blocked domain names into the Domain Name Sets list, which you then link to a Firewall Policy Access rule.

Anyway, I found an up to date list of blacklisted urls & domain's online and combined it with the ones we had already, and I have set them up in a couple of text files.

p.s. The good thing about using ISA's Access Rule with the Domain Name Set's is that you can set it to block the domains no matter what port they are accessing them via. So no sneaky HTTPS workarounds etc...

Some of you may find them useful and be able to add them to your own filtering system.

http://www.hattonschool.org.uk/dm/domains.txt

http://www.hattonschool.org.uk/dm/urls.txt

They have both been formatted ready to import into ISA. The reason why there are no IP addresses in the domains list is because (as far as I know) they will be ignored in the Domain Name Sets. They should work ok as blocked URL's though.

If anyone would like the script to import into ISA, just PM me.

p.s. The good thing about using ISA with an Access rule/Domain Name Sets is that it's possible to set it so it applies to any network traffic on any port. So sneaky https tricks etc... won't work.