Opinions on a web filtering solution?

[Alexw]

Hello,

 

What are peoples thoughts/preferences on a web filtering / firewall solution?

 

Good/Bad feedback please.

 

 

 

Thanks in advance,

 

Alex

[jmcdermott]

I spent a lot of time looking into this and tried and got quotes from various companies.

 

The one I liked the least was smoothwall which appears to be the simplest from the end point, but they were extremely pushy and seem to imply that there product is the only option available and reflect this in the high cost, licence per machine with a support licence per machine as well and a £700 remote installation fee, (yes £700 for someone not to get out of there chair.)

 

Censor net seems to be a good product with a fair price and very friendly support team with a choice of cloud or local based install, the only draw back I found was a few limitations with the product, speaking to there development team they were willing to help adjust there product to the needs of the school, price was a little cheaper than smoothwall without the support cost per licence or installation fee.

 

The final product I went with was a mix of PFsense for firewall and a little know product called Diladele Web Filter, I wouldn't recommend this for any school unless you have someone who has a good knowledge of setting up and configuring linux servers, but with the cost of a minor £400 per 1000 users per year, and a easy to use web interface, it works for me.

[mtillbrook]

I've been using Sophos Web Appliances for several years now. You can either get the physical box or an ESXi VMWare version. Its a very good product that will do everything you need in a school and more however, with people google changing everything to being HTTPS it can be a bit annoying.

Sophos also now have Sophos Cloud products so you can do quite a lot of the same functionality with just a small agent installed on every client. The benefit of this is that you can have staff laptops being used at home that are still filtered!

Price wise, its not so great. If you have a large school or can club together a few schools then very good however, for individual, smaller schools, its quite pricey!

[deano3693]

We use Lightspeed Web Filter. We have the dual bottle rocket and it filters both our internal network and our BYOD transparent network. They are due to release V3 anytime now which will include the ability to Man in the Middle SSL decrypt transparently so you can filter google searches etc. It costs about £5000 for 1500 users here but we find it well worth the money and the reporting is excellent. It sends out a report each day of suspicious searches which can then be followed up on by the Deputy Head etc.

[pubset]

Barracuda has some nice filtering products.

 

- - - Updated - - -

 

I'd start with using OpenDNS, though.

[ColinP]

We have the Sophos ws500 Filter works great, very easy to get up and running

[manc_techie]

I've used Sophos UTM before and really liked the functionality, we are using an iBoss here as a filter and it's great, especially the App Rules you can apply to certain groups.

[mats]

The final product I went with was a mix of PFsense for firewall and a little know product called Diladele Web Filter, I wouldn't recommend this for any school unless you have someone who has a good knowledge of setting up and configuring linux servers, but with the cost of a minor £400 per 1000 users per year, and a easy to use web interface, it works for me.

 

Did you have any problems getting squid to talk to upstream proxies? I can't get diladele to play nicely with RM's proxys. Any config file snippets appreciated.

[jmcdermott]

Sorry didn't try it via RM proxy , I used a BT business fiber to the premises. Still working well.

[ITGURU]

Our connection is still with KCOM but moved away from county filter (netsweeper) to censornet. Support is great and had a few minor issues but they are still working on a solution, otherwise a good all round product with just a few minor features it could benefit with having.

[Opendium_Steve]

The one I liked the least was smoothwall which appears to be the simplest from the end point, but they were extremely pushy and seem to imply that there product is the only option available and reflect this in the high cost, licence per machine with a support licence per machine as well and a £700 remote installation fee, (yes £700 for someone not to get out of there chair.)

 

Ouch - the pricings I've previously seen for Smoothwall put the remote installation fee at £450 (which still makes the £500 we charge for sending someone on-site for a day to do a web filter installation seem pretty reasonable

 

There seem to be a lot of complaints about the quality of Smoothwall's support at the moment - there seems to be something of a price war going on in the filtering market at the moment and I wonder if they have cut the quality of their support to compete on price a bit more? (Lightspeed and Smoothwall seem to be about the same price at the moment, from what I've seen).

Edited June 3, 2016 by Opendium_Steve

[Opendium_Steve]

Did you have any problems getting squid to talk to upstream proxies? I can't get diladele to play nicely with RM's proxys. Any config file snippets appreciated.

 

Squid doesn't play nice with upstream proxies if it is doing transparent HTTPS proxying or HTTPS interception. Its happy to blindly pass CONNECT requests from the client straight onto the next proxy, but it doesn't know how to make CONNECT requests itself.

 

It *usually* isn't a big deal though since pretty much all of the RBCs offer transparent proxying these days, so you can just let Squid send HTTPS traffic via the upstream transparent proxy instead.