Filtering wireless with Dansguardian (ruckus and dlink)

[Shorty]

Hi All,

 

I am looking for a solution that will allow me to filter our wireless internet connection using our dansguardian filter. I have all of our students browsers normally pointing to http://192.168.0.252:8080 which is the proxy server but at the moment anyone with a wirless enabled device that can access the wifi is pointed straight at our gateway bypassing the proxy.

 

I have 4 Ruckus APs controlled by Zone director 1000 with the latest firmware and 4 dlink aps unmanaged. If there is an easy solution to get the Ruckus lan working I can always move the Dlinks onto another ssid with a different pass and just use them for specific projects.Anyone any suggestions ?

 

Cheers

 

 

John

[Haptic]

Hi All,

 

I am looking for a solution that will allow me to filter our wireless internet connection using our dansguardian filter. I have all of our students browsers normally pointing to http://192.168.0.252:8080 which is the proxy server but at the moment anyone with a wirless enabled device that can access the wifi is pointed straight at our gateway bypassing the proxy.

 

I have 4 Ruckus APs controlled by Zone director 1000 with the latest firmware and 4 dlink aps unmanaged. If there is an easy solution to get the Ruckus lan working I can always move the Dlinks onto another ssid with a different pass and just use them for specific projects.Anyone any suggestions ?

 

Cheers

 

 

John

 

I have passed this to our technical team John,

[Shorty]

Cheers Simon

[Cools]

take your Linux box make it the gateway

 

copy the following to the file /etc/rc.d/rc.local/iptables-config

 

And this script on Debian based systems:

 

/etc/rc.local/iptables-config

------------------------------------------------------------------

 

#!/bin/bash

iptables -F

# set the default policy for each of the pre-defined chains

iptables -P INPUT ACCEPT

iptables -P OUTPUT ACCEPT

iptables -P FORWARD DROP

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# to allow incoming SSH and Proxy

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

iptables -A INPUT -m state --state NEW -p tcp -m tcp -s 127.0.0.1 --dport 3128 -j ACCEPT

iptables -A INPUT -m state --state NEW -p tcp -m tcp --dport 8080 -j ACCEPT

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

 

# drop everything else

iptables -A INPUT -i eth+ -p udp -j DROP

iptables -A INPUT -i eth+ -p tcp -m tcp --syn -j DROP

----------------------------------------------------------------------------------

chmod +x /etc/rc.d/rc.local/iptables-config - makes the iptables-config script executable

 

And this script on Debian based systems:

 

chmod +x /etc/rc.local/iptables-config - makes the iptables-config script executable

 

now every thing that goes to access the internet get all cleaned up.

 

and thats transparent proxying.

 

you might want to install antivirus as well..

 

google DG with AV if your using ubuntu apt-get install dansguardian-av make sure you set to install all dpes.

 

 

More help http://www.thedailyadmin.com/2009/04/how-to-install-virtual-machine-with.html

Edited August 27, 2009 by Cools

[White_Fi]

Hi Shorty,

 

You can get the wireless clients to go through your proxy by creating a Layer4 ACL on the ZoneDirector and applying that ACL to the SSID clients conect to.

 

Note you will need version 8 in order to complete.

 

Simply create an ACL allowing access to your proxy server on it is specific port.

Add other Allow / Deny Rules below it.

Then edit the WLAN and apply the Layer4 rule to it in advanced options.

 

Kind Regards

Stuart

[Shorty]

Cheers Guys all good stuff :-)

 

I will have a look at playing with both options when I get back to it

 

Thanks

 

John

[Shorty]

Hi Cools,

 

I am struggling to implement your suggestion I am falling at the first Hurdle the Linux version that DG is running on is CentOS Linux 4.4. I have found the file iptables in /etc/rc.d/init.d and the iptables-config file in /etc/sysconfig is it this that I need to edit ?

 

Cheers

 

John

[tom_newton]

I would venture to suggest that Stuart's solution is the better one - ideally you want your wireless users having the same or similar filtering to "regular" users - so perhaps hacking up a dg install for them might not be a great route, especially if you aren't fully comfortable with its operation.

[White_Fi]

Simplicity in this scenario will be bliss. Make use of the ZD's Layer3-4 ACL.

[Shorty]

Hi Stuart, not having a good day struggling with the Zone Director ACL as well, was going for Cools option first as it allowed me to integrate the old APs. But when I had a look at Zone Director I couldnt see the obvious route to forward everything to http://192.168.0.251:8080. Going to have another look now ;-)

[White_Fi]

Hi Stuart, not having a good day struggling with the Zone Director ACL as well, was going for Cools option first as it allowed me to integrate the old APs. But when I had a look at Zone Director I couldnt see the obvious route to forward everything to http://192.168.0.251:8080. Going to have another look now ;-)

 

What version of code are you running?

 

It will be under "Configure -> Access Control"

[White_Fi]

You will need to be running V8

[Shorty]

Yeah I am running V8.

 

I have configured the gateway to 192.168.0.252

 

and in the ACL settings I have setup the following as a start.

 

http://www.ghyllheadoec.co.uk/images/stories/dans.jpg

 

I have then edited the advanced options of the WLAN to set the L4 ACL as Dans.

 

 

Any suggestions ?

 

Cheers

 

john

[Shorty]

mm re-looking at this I can see that what I am doing must be incorrect as I am filtering anything that goes to 8080 and denying all others, but obvioulsy this isnt the aim

[mattpant]

Hi Guys,

 

I'm trying to do the exact same thing with our Wireless LAN (Ruckus, running the latest Firmware) and giving students that access the Guest SSID access to our Internet VIA a Proxy server, i can't get my head around how to do it, also, would the students using there own laptops need to go in and enter a proxy server under there Internet Options to get out onto the internet or can the Ruckus Kit push this setting out so when they connect to the Guest SSID with a Guest Pass the internet will just "Work"!

 

Thanks,

 

Matt

[Shorty]

Matt at the moment I am thinking that the only way to do this is as you say to get the students or guests to input the proxy settings. Which isnt ideal hence me having ago at the transparent proxy. Hopefully I am wrong and Stuart or one of the other Ruckus experts will just point out the error of my ways ;-).

 

I was expecting the Ruckus ACL to have some sort of Network Address Translation to it but it seems to just be filtering.

[mattpant]

Fingers crossed somebody will have an answer on how to do this... what I think is missing from the console, and hopefully can be included in a future update is a proxy forwarder.

 

Hopefully there is a way around it!

 

Cheers

 

Matt

[tom_newton]

Try using DHCP to push out a proxy.pac - might work for a good handful of users, the rest can type it in.

[Cools]

Iptables configuration

Next, I had added following rules to forward all http requests (coming to port 80) to the Squid server port 3128 :

 

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.1.1:3128
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j [b]REDIRECT --to-port 8080[/b]

 

Here is complete shell script. Script first configure Linux system as router and forwards all http request to port 3128 (Download the fw.proxy shell script):

 

#!/bin/sh
# squid server IP
SQUID_SERVER="192.168.1.1"
# Interface connected to Internet
INTERNET="eth0"
# Interface connected to LAN
LAN_IN="eth1"
# Squid port
SQUID_PORT=[b]"8080"[/b]
# DO NOT MODIFY BELOW
# Clean old firewall
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
# Load IPTABLES modules for NAT and IP conntrack support
modprobe ip_conntrack
modprobe ip_conntrack_ftp
# For win xp ftp client
#modprobe ip_nat_ftp
echo 1 > /proc/sys/net/ipv4/ip_forward
# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
# Unlimited access to loop back
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow UDP, DNS and Passive FTP
iptables -A INPUT -i $INTERNET -m state --state ESTABLISHED,RELATED -j ACCEPT
# set this system as a router for Rest of LAN
iptables --table nat --append POSTROUTING --out-interface $INTERNET -j MASQUERADE
iptables --append FORWARD --in-interface $LAN_IN -j ACCEPT
# unlimited access to LAN
iptables -A INPUT -i $LAN_IN -j ACCEPT
iptables -A OUTPUT -o $LAN_IN -j ACCEPT
# DNAT port 80 request comming from LAN systems to squid 3128 ($SQUID_PORT) aka transparent proxy
iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j DNAT --to $SQUID_SERVER:$SQUID_PORT
# if it is same system
iptables -t nat -A PREROUTING -i $INTERNET -p tcp --dport 80 -j REDIRECT --to-port $SQUID_PORT
# DROP everything and Log it
iptables -A INPUT -j LOG
iptables -A INPUT -j DROP

 

Save shell script. Execute script so that system will act as a router and forward the ports:

 

 chmod +x /etc/fw.proxy
/etc/fw.proxy
service iptables save
chkconfig iptables on

Start or Restart the squid:

 

 /etc/init.d/squid restart
chkconfig squid on

 

Desktop / Client computer configuration

Point all desktop clients to your eth1 IP address (192.168.2.1) as Router/Gateway (use DHCP to distribute this information). You do not have to setup up individual browsers to work with proxies.

[Shorty]

Thanks for the help Cools

 

Can I just clarify is the following added too the iptables or iptable-config file ?

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.1.1:3128
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

[Shorty]

Just found this How-To for the transparent proxy

 

Linux: Setup a transparent proxy with Squid in three easy steps

 

I think its the full ver of Cools paste. Still unsure though if I am editing IPtables or IPtables-config.

 

I had forgot the DG box only has one network cards so going to have to pop another in