Extra Layer for Open wifi

[Alastairb25]

Hi All,

 

We have our Open Wifi segregated off and use Netsweeper.

 

However I am aware that Netsweeper is a bit weak and Students can still use VPN

 

I am looking for something along the lines of onsite dedicated filtering, but free, because budgets.

 

I recall years ago one called Asatro, later bought by Sophos.

 

Anyone out there have any suggestions?

 

TIA

 

 

Alastair

[Tom_M]

The two immediate choices that come to mind are:

 

*pfSense (Free, used widely)

*Smoothwall Express (Free, used (less?) widely) - Not too sure if the product is still being developed though. I remember you could add on 'some' filtering (w/ the likes of/'Dan's Guardian'); but to what extent is something I've forgotten over the years.

 

 

EDIT: Yes - Astro was bought out by Sophos and was merged into their 'UTM' lineup. I believe that's also been killed (or in the process of). Their newest Firewall is XG; but again - not free (unless for Home use).

[mavhc]

In general if anything can bypass the proxy they can get around it, so step 1: no route to the internet

 

Step 2: now everything must pass via your http/https proxy, but it's all encrypted, so either a) everyone needs to install your CA, or b) you rely on dns filtering

 

Assuming (b), you need a dns allowlist, or dns blocklist. Allowlist would work best but will it block too much? Here's a list of the top 1 million domains https://github.com/PeterDaveHello/top-1m-domains

[PaddyNewman]

I'm curious about how you believe Netsweeper to be weak, as long as you are inspecting traffic you should be able to block pretty much anything. Same as most filtering solutions to be honest.

You can add to that at the firewall by locking down most things and only allow absolute basic traffic to a specific DNS host to stop them going around that way.

[filteringtech]

Hi All,

 

We have our Open Wifi segregated off and use Netsweeper.

 

However I am aware that Netsweeper is a bit weak and Students can still use VPN

 

I am looking for something along the lines of onsite dedicated filtering, but free, because budgets.

 

I recall years ago one called Asatro, later bought by Sophos.

 

Anyone out there have any suggestions?

 

TIA

 

 

Alastair

Would that a TS/SBB with Netsweeper combo?

[Alastairb25]

Correct

[filteringtech]

I am generally finding that “Netsweeper” detects things well, but that the SBB configuration and SBB shared lists intervene and prevent it from doing its job.

 

As far as access to web proxies in my case is concerned, I think that it must be a policy decision by SBB as I have had a ticket open about one such occurrence since last month and have been encouraged to fix in our local lists. SBB have forced a decryption bypass and whitelisted the domain in their shared lists.

 

For now, I have done this by explicitly decrypting the domain and adding urls and have more to add before September, but as Netsweeper correctly detects the urls and would be blocking them automatically, I shouldn’t have to.

 

It also means SBB have knowingly left this open for other customers.