+ Post New Thread
Results 1 to 9 of 9
Internet Related/Filtering/Firewall Thread, Another squid/byod thread in Technical; We have BYOD wireless being put in soon (Ruckus) - We have set up our network so that all the ...
  1. #1
    BassTech's Avatar
    Join Date
    Nov 2008
    Location
    England
    Posts
    496
    Thank Post
    54
    Thanked 32 Times in 25 Posts
    Rep Power
    23

    Red face Another squid/byod thread

    We have BYOD wireless being put in soon (Ruckus) - We have set up our network so that all the wireless devices are in their own VLAN, separate from our CC4 network.

    We currently use RM SmartCache 2 for filtering, with a CISCO firewall. I need to set it up so that the wireless devices connect through a transparent proxy to the internet. What would be the best way to approach this?

    We need to keep costs down so I have been setting up a small squid server to do this by passing traffic from squid, through our SmartCache2 to get filtering, through the firewall and out to the internet. We have a squid box set-up with Kubuntu and 2 NICs but don't really know where to start in terms of configuring it all. Advice welcome

  2. #2

    FN-GM's Avatar
    Join Date
    Jun 2007
    Location
    UK
    Posts
    16,215
    Thank Post
    893
    Thanked 1,773 Times in 1,529 Posts
    Blog Entries
    12
    Rep Power
    461
    What switches do you have?

    You can create a new VLAN and the ruckus can do the access control settings.

  3. #3
    BassTech's Avatar
    Join Date
    Nov 2008
    Location
    England
    Posts
    496
    Thank Post
    54
    Thanked 32 Times in 25 Posts
    Rep Power
    23
    Mainly HP ProCurve switches - So Ruckus can do transparent proxy?
    Need to get to the point where the clients don't need to put any proxy/IP settings in to get to the internet.

  4. #4

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    18,131
    Thank Post
    522
    Thanked 2,540 Times in 1,975 Posts
    Blog Entries
    24
    Rep Power
    875
    Ruckus can't do proxying itself, but you'd be able to set up DHCP and the like to point at a proxy (by using a WPAD.dat file or by using a proxy which you route via).

    You then have Ruckus isolate the devices so they can't access anything else on your network via ACLs.

  5. #5
    BassTech's Avatar
    Join Date
    Nov 2008
    Location
    England
    Posts
    496
    Thank Post
    54
    Thanked 32 Times in 25 Posts
    Rep Power
    23
    I've heard the WPAD.dat files aren't a great solution, as it doesn't work with all devices.
    I thought we would need to configure a transparent proxy server. SmartCache2 can't do transparent, which is why we're currently looking at squid, but not really sure where to start with it all.

  6. #6
    Boredguy's Avatar
    Join Date
    Jun 2011
    Location
    Swindon
    Posts
    634
    Thank Post
    4
    Thanked 139 Times in 130 Posts
    Rep Power
    51
    You can set squid up to do transparent proxying, but without a man in the middle certificate you will find only traffic on port 80 can be routed happily.
    We found that getting our ISP to enable their transparent proxy was an easier option.

    We setup a dual NIC Linux box on our BYoD vLan to take the wireless clients from the 172.x.x.x range that they get via the Linux DHCP and then forward the port 80 and 443 traffic through to the router's secondary 10.x.x.x range. This has the added bonus of ensuring our ADSL backup connection will not get swapped with remote devices in the case of a fault on our main fibre connection.

    If we decide to install Ruckus as our new WiFi provider then the same setup should still work.

  7. #7

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    18,131
    Thank Post
    522
    Thanked 2,540 Times in 1,975 Posts
    Blog Entries
    24
    Rep Power
    875
    You're correct, WPAD.dat doesn't work with all devices - some apps on some devices just ignore it entirely.

    The thing is 'transparent proxy' is used for various technologies, having a proxy specified via DHCP (the WPAD.dat) option is transparent, just not as universal.

    In your case, you'd want to set up an appliance with a cache on it, and you'd then need a routing device (can be the same appliance) which routes traffic to the right place. Squid and iptables on a Linux install could do all this. Or, you could buy into a solution like Smoothwall which can handle it.

  8. #8
    BassTech's Avatar
    Join Date
    Nov 2008
    Location
    England
    Posts
    496
    Thank Post
    54
    Thanked 32 Times in 25 Posts
    Rep Power
    23
    At the moment we have Squid on a Windows 7 machine and use SoftPerfect Bandwidth Manager to route all 172.10.x.x traffic to our SmartCache2 (192.168.3.202). We followed this guide: SoftPerfect Bandwidth Manager - Online user manual, Adding proxy server but it doesn't seem to work at all. Squid works fine if we enter the proxy settings manually into the test client, just the transparent part doesn't work.

    I'm thinking of installing linux instead and configuring squid with ip-tables like @localzuk suggests.

  9. #9

    Join Date
    Mar 2011
    Location
    Ipswich
    Posts
    14
    Thank Post
    1
    Thanked 2 Times in 2 Posts
    Rep Power
    8
    I found this a good starting point for building a Linux proxy and web filter if you need it.

    Ubuntu 12.04 Precise Pangolin and DansGuardian - Quick and Dirty

    I'm testing it for use in my primary.

SHARE:
+ Post New Thread

Similar Threads

  1. Yet another GIS Safesearch thread
    By mikes in forum Internet Related/Filtering/Firewall
    Replies: 1
    Last Post: 29th November 2013, 11:27 AM
  2. Yet another Ruckus->Smoothwall thread!
    By truebluesteve in forum Wireless Networks
    Replies: 6
    Last Post: 18th April 2013, 06:09 PM
  3. Yet another 'What Printer' thread...
    By Reaper in forum Hardware
    Replies: 2
    Last Post: 5th December 2011, 01:14 PM
  4. Another folder redirection thread
    By pooley in forum Windows 7
    Replies: 1
    Last Post: 7th July 2011, 04:18 PM
  5. (Another) SIMS LG thread
    By Easy_506 in forum MIS Systems
    Replies: 24
    Last Post: 25th February 2009, 02:18 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •