Setting up linux box to forward requests

[BassTech]

We use RM for our internet, using SmartCache2 as a proxy.

 

I have recently set up a new VLAN for our wireless devices on a new ip range (172.10.0.0/21) and want these to bypass the SmartCache2 proxy and connect directly to the internet. We have been trying to use a linux box to do this, but now we're a little stuck.

We have Ubuntu installed with 2 NICS (one on VLAN1, one on VLAN2) - our main HP L2 switch does the routing between these and our DHCP server.

 

We also have a CISCO firewall that acts as a default gateway to the internet.

 

I've set up a new firewall rule to allow traffic to pass through 172.10.0.0/21 ip range, and can see that it's working ok, with packets being allowed through.

 

The problem is that we keep getting "cannot connect to DNS" errors on the client end. We want to use OpenDNS for our BYOD, but even setting the DNS server settings manually on the clients doesn't work. I have set up forwarders on our local DNS server to forward requests from 192.168.3.108 (linux box ip) to OpenDNSs servers but still no luck.

 

I believe we need to use iptables on the linux box to forward 172.10.0.0/21 traffic to our CISO firewall internet gateway, but not entirely sure.

[cpjitservices]

Have you tried setting the gateways on your VLANS to use the Cisco rather than the RM ?

[featured_spectre]

blast, beat me too it. Why route through something when you can go direct?

[cpjitservices]

blast, beat me too it. Why route through something when you can go direct?

 

Great minds think a like Neph...

[BassTech]

Yes, but it seems to be that RM will only allow internet traffic through their SmartCache2 box. This is what's confusing me.

SmartCache2 is just a squid server, with RMs software on it, which uses this upstream proxy: unfiltered.adslcache.rmplc.co.uk. This then passes through the CISCO, out to the internet.

 

On both VLANs, the default gateway is already set as the CISCO firewall. In theory, I thought if I took out the proxy settings from the clients, it would just bypass the filtering and get unfiltered internet, but that's not the case.

[featured_spectre]

Your best bet then in that case is to speak to RM. They should be able to give you a viable way to do what you are asking.

[BassTech]

Your best bet then in that case is to speak to RM. They should be able to give you a viable way to do what you are asking.

 

I did, they suggested buying their SafetyNet+ with transparent filtering. I did back in November, only to find out that I had to contact RM to enable the transparent part.

Contacted RM to do this, costs extra of course.. So I thought I'd bite the bullet and pay.

Then it turns out that RM haven't released transparent filtering in the West Midlands area yet and that "It's on their roadmap" (I assume its the same roadmap that IE10 is on, as that hasn't been re-released by RM yet.)

[featured_spectre]

In that case, demand a refund, you purchased something with the express intention (and was told) that it could do something you require, as it cannot, it is not fit for purpose.

[BassTech]

** Forgot to mention I did get a refund, only got it yesterday though after much dispute.

Now we're left with a cr*p old smartcache box that doesn't do what we want. Solutions like SmoothWall are too costly for us

 

Just trying to find the easiest and most affordable solution for transparent BYOD filtering.

[featured_spectre]

You wouldnt need a UTM device with smoothwall. I think they have software which you can put onto a machine (I think). @tom_newton can you clarify in case I am going crazy please?

[BassTech]

You wouldnt need a UTM device with smoothwall. I think they have software which you can put onto a machine (I think). @tom_newton can you clarify in case I am going crazy please?

 

Oh ok, I didn't know that - have requested a free trial from them, see what they can offer.

[cpjitservices]

OR get rid of the SmartCache 2 and use the linux server and install Dansguardian/Squid anyway!! therefore alleviating you of the stresses of a smartcahe!

 

Plenty of guides to do so,

 

All you do then is allow your IP Range for BYOD in the exceptions rule and they wont get filtered.

[BassTech]

OR get rid of the SmartCache 2 and use the linux server and install Dansguardian/Squid anyway!! therefore alleviating you of the stresses of a smartcahe!

 

Plenty of guides to do so,

 

All you do then is allow your IP Range for BYOD in the exceptions rule and they wont get filtered.

 

I am trying to do this, but Linux isn't my forte - I follow the guides word for word and Linux does something completely different every time :/

[featured_spectre]

No chance. Linux is quite straight forward if you follow the guides. It could be that you are using a different flavour of linux than listed in the guide which is where it could be causing issues. Otherwise it is solid as a rock.

[BassTech]

No chance. Linux is quite straight forward if you follow the guides. It could be that you are using a different flavour of linux than listed in the guide which is where it could be causing issues. Otherwise it is solid as a rock.

 

Must be the guide then. I'm using the exact same version and some of the commands listed won't even run.

[featured_spectre]

Have you gone into Sudo or root?

[BassTech]

I'm using sudo, as per the guides I've been following. I think the problem is with squid though really, not linux. Although like I say linux doens't like some of the commands I've tried.

[featured_spectre]

What guide are you using? I will set up a virtual machine see if I can get it done.

[ReBoot]

Here are a few things I would check. First make sure your new subnet is reachable from the Cisco router. Use "show ip route" and make sure your new subnet is in the routing table. If its not there you may need to add a static route.

 

I don't know where and if there is NAT in your network but if the Cisco is doing it you may need to change the rules on which subnets get NATed to include your new subnet.

 

As you have an upstream proxy server you will need to verify with RM that this will accept direct requests from your local subnets as it may be restricted to the downstream proxy server.

 

If you are working on Linux as a routing box I would use shorewall as it makes rule generation and management much easier.

[BassTech]

Here are a few things I would check. First make sure your new subnet is reachable from the Cisco router. Use "show ip route" and make sure your new subnet is in the routing table. If its not there you may need to add a static route.

 

I don't know where and if there is NAT in your network but if the Cisco is doing it you may need to change the rules on which subnets get NATed to include your new subnet.

 

As you have an upstream proxy server you will need to verify with RM that this will accept direct requests from your local subnets as it may be restricted to the downstream proxy server.

 

If you are working on Linux as a routing box I would use shorewall as it makes rule generation and management much easier.

 

I have configured our CISCO to NAT our new 172.0.0.0/21 range.

The really strange thing is that we used windows + an older version of squid initially, and that worked fine through the parent proxy, using the same IP settings as linux, so it must already be configured to accept requests from our local subnets, as it's worked before.

 

I'm following this guide: Installing squid 3.3.8 and squidGuard on Ubuntu 13.10 with transparent HTTP and HTTPS · Cyborg Workshop (We're ignoring the squidguard/https bits for now - just trying to get HTTP working)

 

Willing to post config files if anyone wants to take a look! Will also check out shorewall, looks much simpler.

Edited February 11, 2014 by BassTech

[BassTech]

Uploaded config/log files:

 

Squid.conf

 

Cache.log

 

Access.log

[mats]

**

Now we're left with a cr*p old smartcache box that doesn't do what we want. Solutions like SmoothWall are too costly for us

 

Just trying to find the easiest and most affordable solution for transparent BYOD filtering.

 

I have 2 schools that use RM smartcache but it's going out of support soon. They don't have £10k for smoothwall either. I could set up on a linux box but it's filter lists that are a) essential and b) only available as part of a commercial product. I don't want to spend my life adding and blocking random sites - cheap / free filter list or web filter suggestions gratefully received.