BYOD Linux Server for Squid, DNS & DHCP

[HCC]

Hi,

I'm trying to setup a BYOD network which is separate from the main system but passes through our lightspeed rocket for filtering.

I would like to keep all DHCP and DNS separate, so need to have a server within the guest vlan for this purpose. It will also need to make the upstream proxy transparent as the SEGfL are determined to force us to keep it.

 

So I'm looking for a simple to install and use linux build that can do Squid for transparent proxy, DNS & DHCP on a basic PC; or a hardware device that does these things.

 

Any suggestions?

[cpjitservices]

PfSense will be perfect for this, you can even bang on captive portal so that users have to authenticate first (or not). Pfsense can server DHCP / DNS on its interfaces and also runs proxying IDS/IPS. We have pfsense at many sites running squid transparent proxying. We just plug out access points into a switch which connects to the guest interface trunked with the guest vlan for wifi.

[cpjitservices]

pfSense Open Source Firewall Distribution - Home

[cpjitservices]

PfSense is also web based, abit like a router. Check out some of the videos on youtube. I've implemented what your on about in some coffee shops and bars using pfsense. It's free all you need is a system (virtual if needs be) to run it on.

[AJWhite1970]

Another vote for PFSense 2.02. My BYOD student wifi network is built round it using some very cheap Buffalo access points, DD-WRT and some even cheaper hubs linked using spare fibre cabling dotted round the school (the BYOD network is only visible in open access IT labs, SFCR's and the Dining Hall). The captive portal works great and it hooks into active directory fairly easily using RADIUS and the web front end is easy to manage. There are several good video guides linked from their website.

 

Andrew

 

The price of 0.00p fits in nicely with the strategic planning budgets

[morganw]

If you did want to make your own device, take a look at dnsmasq as an easy way to provide DNS and DHCP. You cannot use a transparent proxy with SSL traffic, so depending on what devices you are using, you might be better off hosting a WPAD file for automatic proxy configuration.

[HCC]

Thanks for the suggestions.

 

You cannot use a transparent proxy with SSL traffic

Didn't realise this. I'll try WPAD to start with. Just want it to be simple for student devices, so I don't need to configure them. I'm aware some older android devices and things like siri etc don't understand proxies.

[Duke5A]

Thanks for the suggestions.

 

 

Didn't realise this. I'll try WPAD to start with. Just want it to be simple for student devices, so I don't need to configure them. I'm aware some older android devices and things like siri etc don't understand proxies.

 

You can, but it comes with pitfalls. Squid supports this via a function called SSL Bumping. It has to be enabled when Squid is compiled from source, and none of the packages you find in repositories has it turned on, so you'll have to install Squid from source to do this. SSL Bumping involves decrypting transparently intercepted encrypted traffic to rewrite headers. This is basically a MITM attack. You'll have to install a cert on the proxy that comes from a trusted certificate authority to keep the user's browser from complaining. The last pitfall I encountered was I got halfway done with the install and discovered a known bug in Squid 3.1.x when using SSL Bump with an upstream proxy (cache peer). After decrypting the traffic it will then send it back up to the cache peer unencrypted. This was obviously a deal breaker for me and I gave up. Supposedly this is to be fixed in 3.3. Here is a guide if you're feeling adventurous:

 

SQUID transparent SSL interception | Dvas0004's Blog

 

And info on the SSL bumping with cache peer bug:

Using parent proxy with SSL Bump enabled Squid 3.2 | MyDLP | Data Leak Prevention & Protection Solution

 

In the end I settled for setting up Squid transparently with a captive portal page. Whenever someone connects to the guest wifi they get redirected to a terms and conditions page. Once they click the accept button Squid will allow them through. This page also comes with instructions on how to setup the proxy in most browsers so SSL will work. It's not elegant, but it's free and it works.

 

I went with the WPAD route at first, but it is only good for Internet Explorer (using the DHCP option) and Firefox/Chrome (using the DNS option). iOS and Android devices don't work with WPAD.

Edited February 28, 2013 by Duke5A

[morganw]

You can, but it comes with pitfalls.

 

You don't want to be in position where your server is responsible for someone's online banking transaction. I'm sure there are legal ramifications to attempting this as well.

 

iOS and Android devices don't work with WPAD.

 

iOS is fine (use DNS method), Android seems the more problematic.

[MordyT]

Another vote for PFSense, we use it exclusively now for all internet traffic at my job.

[cpjitservices]

Another vote for PFSense, we use it exclusively now for all internet traffic at my job.

 

We use it mainly for everything also, the latest version has seen some long awaited improvements.

[markwilfan]

For those on SWGfL (and poss other GfLs) you can request a transparent proxy upstream so you can hook your BYODs onto this http://www.edugeek.net/forums/south-west-grid-learning-swgfl/101026-swgfl-new-transparent-proxy.html

[HCC]

Looks like the best I'm going to get is an additional IP range. They say it is not possible to remove the proxy on a SEGfL connection, so I'm going to have to rely on WPAD or squid.

 

Am I right in thinking that I need the gateway router (which I'm not in control of) config changing to add an extra gateway address within the new ip range for it to work? If not could I use pfsense as the gateway or will I need to install my own router?

[HCC]

I'm trying to setup WPAD on PFSense but can't get it to work.

I don't know how to put a file onto the box remotely, so I'm using the editor in the web interface to create the files as per WPAD Autoconfigure for Squid - PFSenseDocs

I can download the file via the browser so I know it's there and the dns is correct.

 

If I put the setting in manually it works so I know the settings are right

 

Any suggestions?

[HCC]

I've got PFSense setup and it works with NAT on. I need it to work as a router (with NAT off) because it passes though lightspeed router and I need it to see to source ip not the pfsense WAN address. I have tried turning off the block private networks option, cleared all firewall rules but still can't get it to work. I can ping though it but no http works

 

Has anyone else got pfsense just to work as a simple router?

[DMcCoy]

In the NAT section "To completely disable outbound NAT, switch to Manual Outbound NAT then delete any NAT rules that appear in the list."

 

Remember you may need additional routes on the next gateway back to the pf box for the ip ranges behind it.

[cpjitservices]

Go into Advanced options and under firewalling turn off the firewall, this will make pfsense "Just a router".

"

[HCC]

Hi, Thanks for your reply.

Yes I have it set to manual and deleted the rules, this is what I mean by NAT off. I would like it to be a firewall too.

 

I've managed to get the pfbox to see the internet (add proxy to advanced, misc) and upgrade to the latest release, but still internet requests on clients just timeout.

 

Remember you may need additional routes on the next gateway back to the pf box for the ip ranges behind it.

I am using our normal network gateway because I don't have a gateway address for the guest range because our internet passes through a county council router I don't control. I'm now thinking this is the problem, and I'm waiting for them to get back to me.

[browolf]

i've done it with squid 2.7 on a self built proxy (squid, dns, dhcp) which although doesn't support ssl-bump, can use https_port transparent if recompile squid with the --enable-ssl directive.

 

However the self-signed certificate is causing some problems so that needs looking into.