Another squid/byod thread

[BassTech]

We have BYOD wireless being put in soon (Ruckus) - We have set up our network so that all the wireless devices are in their own VLAN, separate from our CC4 network.

 

We currently use RM SmartCache 2 for filtering, with a CISCO firewall. I need to set it up so that the wireless devices connect through a transparent proxy to the internet. What would be the best way to approach this?

 

We need to keep costs down so I have been setting up a small squid server to do this by passing traffic from squid, through our SmartCache2 to get filtering, through the firewall and out to the internet. We have a squid box set-up with Kubuntu and 2 NICs but don't really know where to start in terms of configuring it all. Advice welcome

[FN-GM]

What switches do you have?

 

You can create a new VLAN and the ruckus can do the access control settings.

[BassTech]

Mainly HP ProCurve switches - So Ruckus can do transparent proxy?

Need to get to the point where the clients don't need to put any proxy/IP settings in to get to the internet.

[localzuk]

Ruckus can't do proxying itself, but you'd be able to set up DHCP and the like to point at a proxy (by using a WPAD.dat file or by using a proxy which you route via).

 

You then have Ruckus isolate the devices so they can't access anything else on your network via ACLs.

[BassTech]

I've heard the WPAD.dat files aren't a great solution, as it doesn't work with all devices.

I thought we would need to configure a transparent proxy server. SmartCache2 can't do transparent, which is why we're currently looking at squid, but not really sure where to start with it all.

[Boredguy]

You can set squid up to do transparent proxying, but without a man in the middle certificate you will find only traffic on port 80 can be routed happily.

We found that getting our ISP to enable their transparent proxy was an easier option.

 

We setup a dual NIC Linux box on our BYoD vLan to take the wireless clients from the 172.x.x.x range that they get via the Linux DHCP and then forward the port 80 and 443 traffic through to the router's secondary 10.x.x.x range. This has the added bonus of ensuring our ADSL backup connection will not get swapped with remote devices in the case of a fault on our main fibre connection.

 

If we decide to install Ruckus as our new WiFi provider then the same setup should still work.

[localzuk]

You're correct, WPAD.dat doesn't work with all devices - some apps on some devices just ignore it entirely.

 

The thing is 'transparent proxy' is used for various technologies, having a proxy specified via DHCP (the WPAD.dat) option is transparent, just not as universal.

 

In your case, you'd want to set up an appliance with a cache on it, and you'd then need a routing device (can be the same appliance) which routes traffic to the right place. Squid and iptables on a Linux install could do all this. Or, you could buy into a solution like Smoothwall which can handle it.

[BassTech]

At the moment we have Squid on a Windows 7 machine and use SoftPerfect Bandwidth Manager to route all 172.10.x.x traffic to our SmartCache2 (192.168.3.202). We followed this guide: SoftPerfect Bandwidth Manager - Online user manual, Adding proxy server but it doesn't seem to work at all. Squid works fine if we enter the proxy settings manually into the test client, just the transparent part doesn't work.

 

I'm thinking of installing linux instead and configuring squid with ip-tables like @localzuk suggests.

[ReBoot]

I found this a good starting point for building a Linux proxy and web filter if you need it.

 

Ubuntu 12.04 Precise Pangolin and DansGuardian - Quick and Dirty

 

I'm testing it for use in my primary.