Filtering wireless with Dansguardian (ruckus and dlink)

Shorty · August 27, 2009

Hi All,

I am looking for a solution that will allow me to filter our wireless internet connection using our dansguardian filter. I have all of our students browsers normally pointing to http://192.168.0.252:8080 which is the proxy server but at the moment anyone with a wirless enabled device that can access the wifi is pointed straight at our gateway bypassing the proxy.

I have 4 Ruckus APs controlled by Zone director 1000 with the latest firmware and 4 dlink aps unmanaged. If there is an easy solution to get the Ruckus lan working I can always move the Dlinks onto another ssid with a different pass and just use them for specific projects.Anyone any suggestions ?

Cheers

John

Haptic · August 27, 2009

Hi All,

I am looking for a solution that will allow me to filter our wireless internet connection using our dansguardian filter. I have all of our students browsers normally pointing to http://192.168.0.252:8080 which is the proxy server but at the moment anyone with a wirless enabled device that can access the wifi is pointed straight at our gateway bypassing the proxy.

I have 4 Ruckus APs controlled by Zone director 1000 with the latest firmware and 4 dlink aps unmanaged. If there is an easy solution to get the Ruckus lan working I can always move the Dlinks onto another ssid with a different pass and just use them for specific projects.Anyone any suggestions ?

Cheers

John

I have passed this to our technical team John,

Shorty · August 27, 2009

Cheers Simon

Cools · August 27, 2009

take your Linux box make it the gateway

copy the following to the file /etc/rc.d/rc.local/iptables-config

And this script on Debian based systems:

/etc/rc.local/iptables-config

------------------------------------------------------------------

#!/bin/bash

iptables -F

# set the default policy for each of the pre-defined chains

iptables -P INPUT ACCEPT

iptables -P OUTPUT ACCEPT

iptables -P FORWARD DROP

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# to allow incoming SSH and Proxy

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

iptables -A INPUT -m state --state NEW -p tcp -m tcp -s 127.0.0.1 --dport 3128 -j ACCEPT

iptables -A INPUT -m state --state NEW -p tcp -m tcp --dport 8080 -j ACCEPT

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

# drop everything else

iptables -A INPUT -i eth+ -p udp -j DROP

iptables -A INPUT -i eth+ -p tcp -m tcp --syn -j DROP

----------------------------------------------------------------------------------

chmod +x /etc/rc.d/rc.local/iptables-config - makes the iptables-config script executable

And this script on Debian based systems:

chmod +x /etc/rc.local/iptables-config - makes the iptables-config script executable

now every thing that goes to access the internet get all cleaned up.

and thats transparent proxying.

you might want to install antivirus as well..

google DG with AV if your using ubuntu apt-get install dansguardian-av make sure you set to install all dpes.

More help http://www.thedailyadmin.com/2009/04/how-to-install-virtual-machine-with.html

Edited August 27, 2009 by Cools

White_Fi · August 27, 2009

Hi Shorty,

You can get the wireless clients to go through your proxy by creating a Layer4 ACL on the ZoneDirector and applying that ACL to the SSID clients conect to.

Note you will need version 8 in order to complete.

Simply create an ACL allowing access to your proxy server on it is specific port.

Add other Allow / Deny Rules below it.

Then edit the WLAN and apply the Layer4 rule to it in advanced options.

Kind Regards

Stuart

Shorty · August 27, 2009

Cheers Guys all good stuff :-)

I will have a look at playing with both options when I get back to it

Thanks

John

Shorty · August 28, 2009

Hi Cools,

I am struggling to implement your suggestion I am falling at the first Hurdle the Linux version that DG is running on is CentOS Linux 4.4. I have found the file iptables in /etc/rc.d/init.d and the iptables-config file in /etc/sysconfig is it this that I need to edit ?

Cheers

John

tom_newton · August 28, 2009

I would venture to suggest that Stuart's solution is the better one - ideally you want your wireless users having the same or similar filtering to "regular" users - so perhaps hacking up a dg install for them might not be a great route, especially if you aren't fully comfortable with its operation.

White_Fi · August 28, 2009

Simplicity in this scenario will be bliss. Make use of the ZD's Layer3-4 ACL.

Shorty · August 28, 2009

Hi Stuart, not having a good day struggling with the Zone Director ACL as well, was going for Cools option first as it allowed me to integrate the old APs. But when I had a look at Zone Director I couldnt see the obvious route to forward everything to http://192.168.0.251:8080. Going to have another look now ;-)

White_Fi · August 28, 2009

Hi Stuart, not having a good day struggling with the Zone Director ACL as well, was going for Cools option first as it allowed me to integrate the old APs. But when I had a look at Zone Director I couldnt see the obvious route to forward everything to http://192.168.0.251:8080. Going to have another look now ;-)

What version of code are you running?

It will be under "Configure -> Access Control"

White_Fi · August 28, 2009

You will need to be running V8

Shorty · August 28, 2009

Yeah I am running V8.

I have configured the gateway to 192.168.0.252

and in the ACL settings I have setup the following as a start.

http://www.ghyllheadoec.co.uk/images/stories/dans.jpg

I have then edited the advanced options of the WLAN to set the L4 ACL as Dans.

Any suggestions ?

Cheers

john

Shorty · August 28, 2009

mm re-looking at this I can see that what I am doing must be incorrect as I am filtering anything that goes to 8080 and denying all others, but obvioulsy this isnt the aim

mattpant · August 28, 2009

Hi Guys,

I'm trying to do the exact same thing with our Wireless LAN (Ruckus, running the latest Firmware) and giving students that access the Guest SSID access to our Internet VIA a Proxy server, i can't get my head around how to do it, also, would the students using there own laptops need to go in and enter a proxy server under there Internet Options to get out onto the internet or can the Ruckus Kit push this setting out so when they connect to the Guest SSID with a Guest Pass the internet will just "Work"!

Thanks,

Matt

Shorty · August 28, 2009

Matt at the moment I am thinking that the only way to do this is as you say to get the students or guests to input the proxy settings. Which isnt ideal hence me having ago at the transparent proxy. Hopefully I am wrong and Stuart or one of the other Ruckus experts will just point out the error of my ways ;-).

I was expecting the Ruckus ACL to have some sort of Network Address Translation to it but it seems to just be filtering.

mattpant · August 28, 2009

Fingers crossed somebody will have an answer on how to do this... what I think is missing from the console, and hopefully can be included in a future update is a proxy forwarder.

Hopefully there is a way around it!

Cheers

Matt

tom_newton · August 28, 2009

Try using DHCP to push out a proxy.pac - might work for a good handful of users, the rest can type it in.

Cools · August 29, 2009

Iptables configuration

Next, I had added following rules to forward all http requests (coming to port 80) to the Squid server port 3128 :

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.1.1:3128
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j [b]REDIRECT --to-port 8080[/b]

Here is complete shell script. Script first configure Linux system as router and forwards all http request to port 3128 (Download the fw.proxy shell script):

#!/bin/sh
# squid server IP
SQUID_SERVER="192.168.1.1"
# Interface connected to Internet
INTERNET="eth0"
# Interface connected to LAN
LAN_IN="eth1"
# Squid port
SQUID_PORT=[b]"8080"[/b]
# DO NOT MODIFY BELOW
# Clean old firewall
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
# Load IPTABLES modules for NAT and IP conntrack support
modprobe ip_conntrack
modprobe ip_conntrack_ftp
# For win xp ftp client
#modprobe ip_nat_ftp
echo 1 > /proc/sys/net/ipv4/ip_forward
# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
# Unlimited access to loop back
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow UDP, DNS and Passive FTP
iptables -A INPUT -i $INTERNET -m state --state ESTABLISHED,RELATED -j ACCEPT
# set this system as a router for Rest of LAN
iptables --table nat --append POSTROUTING --out-interface $INTERNET -j MASQUERADE
iptables --append FORWARD --in-interface $LAN_IN -j ACCEPT
# unlimited access to LAN
iptables -A INPUT -i $LAN_IN -j ACCEPT
iptables -A OUTPUT -o $LAN_IN -j ACCEPT
# DNAT port 80 request comming from LAN systems to squid 3128 ($SQUID_PORT) aka transparent proxy
iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j DNAT --to $SQUID_SERVER:$SQUID_PORT
# if it is same system
iptables -t nat -A PREROUTING -i $INTERNET -p tcp --dport 80 -j REDIRECT --to-port $SQUID_PORT
# DROP everything and Log it
iptables -A INPUT -j LOG
iptables -A INPUT -j DROP

Save shell script. Execute script so that system will act as a router and forward the ports:

 chmod +x /etc/fw.proxy
/etc/fw.proxy
service iptables save
chkconfig iptables on

Start or Restart the squid:

 /etc/init.d/squid restart
chkconfig squid on

Desktop / Client computer configuration

Point all desktop clients to your eth1 IP address (192.168.2.1) as Router/Gateway (use DHCP to distribute this information). You do not have to setup up individual browsers to work with proxies.

Shorty · August 29, 2009

Thanks for the help Cools

Can I just clarify is the following added too the iptables or iptable-config file ?

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.1.1:3128
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

Shorty · August 30, 2009

Just found this How-To for the transparent proxy

Linux: Setup a transparent proxy with Squid in three easy steps

I think its the full ver of Cools paste. Still unsure though if I am editing IPtables or IPtables-config.

I had forgot the DG box only has one network cards so going to have to pop another in

Filtering wireless with Dansguardian (ruckus and dlink)

Recommended Posts

Shorty

Haptic

Shorty

Cools

White_Fi

Shorty

Shorty

tom_newton

White_Fi

Shorty

White_Fi

White_Fi

Shorty

Shorty

mattpant

Shorty

mattpant

tom_newton

Cools

Shorty

Shorty

Create an account or sign in to comment

Create an account

Sign in

Recent Threads

Confirm acknowledgement of parental consent requirement for the Additional Google services

Lenovo Tablet Firmware

Outloook 365 - Classic

Home

Forums

What's New