BatchFile Posted January 17, 2011 Posted January 17, 2011 Arising from this thread: http://www.edugeek.net/forums/internet-related-filtering-firewall/68825-amazon-kindle.html , in which I've been working on a way of getting devices that can't accept a proxy server setting (and that will only accept wireless connections with DHCP (Android 2.1 on an E-Pad)) working in school, I've set up a Smoothwall Express box as a transparent proxy. This is in a feasibility study / proof of concept / evaluating devices type of scenario rather than wanting anything large scale for now. It seems to work OK, but as I've never used SW before, I'd be grateful of confirmation from those that have that I'm not doing anything silly. It's configured as follows: Red - given a static IP in our normal school range as assigned by our RBC (10.105.xxx.xxx) Green - assigned 192.168.0.1 and (Physically) connected straight to an unmanaged wireless access point I had lying around 192.168.0.2 (independant of the main Ruckus wireless in school, on channel 2, different SSID, and setup to only allow MAC addresses I specify). DHCP is ON, giving out 192.168.0.3 to 192.168.0.254 Web Proxy is ON, in transparent mode, upstreaming to the RBC proxy. I'm nervous about the DHCP bit - can someone reassure me that it's not going to start sending out duff addresses to the school network is it? 1
bladedanny Posted January 17, 2011 Posted January 17, 2011 I've never used DHCP on SW before so I can only offer my best guess (which comes with no warranty). I believe it only dishes DHCP out of the green interface so in theory you should be ok. Maybe one of the smoothwall guys could shed a bit more light. 1
plexer Posted January 17, 2011 Posted January 17, 2011 How you've done it it will only give out an ip via dhcp to a device connecting via that wireless access point so you are fine. Ben 2
tom_newton Posted January 17, 2011 Posted January 17, 2011 Sounds to me like you have it right already. 1
CyberNerd Posted January 17, 2011 Posted January 17, 2011 Could I set transparent proxying on a schoolguardian on just one network card and have proxy auth on the others?
tom_newton Posted January 17, 2011 Posted January 17, 2011 Could I set transparent proxying on a schoolguardian on just one network card and have proxy auth on the others? Probably.... with the g3 update coming RSN, definitely.
camel Posted March 29, 2011 Posted March 29, 2011 Just got Smoothwall Express 3.0 configured in-house for a set of kindles that the English dept bought for improving boys reading. Smoothwall is on a iron box, not virtualised and connected directly to a spare wireless access point, private ip range for kindles going to RBC ip range and default gateway. Works great. Also works with my Android as it doesn't have proxy settings by default. Thanks BatchFile. 1
camel Posted March 30, 2011 Posted March 30, 2011 My initial delight was quickly scuppared by no transparent proxy for https! What would anyone suggest as an alternative to taking home the kindles and using the home wifi to download books? Yes, I know they should have got 3g ones...
Arthur Posted March 30, 2011 Posted March 30, 2011 My initial delight was quickly scuppered by no transparent proxy for https! Apache can be configured as a transparent proxy and should support SSL too. 2
camel Posted March 30, 2011 Posted March 30, 2011 Thanks for the pointer, just working on it now. Loaded modules mod_proxy and mod_proxy_http as the first is required and the second is for handling the http, https and ftp requests, wrapping them up in a http connect method. I've setup a new virtualhost with an IP in the RBC assigned range, connected my wireless access point to use that host as a gateay and set the upstreaming proxy to that of our RBC proxy. Am I right in thinking that the new virtualhost is a gateway for the kindle clients. I've set up each kindle with static ip, which is fine but there isn't a route out as such. Am I missing some routing or something?
BatchFile Posted March 30, 2011 Author Posted March 30, 2011 I'm not at all convinced that it's possible to put SSL through a transparent proxy at all simply due to the fact that the packets don't have enough information about their destination visible... System administrators are often asked to also transparently proxy FTP and SSL, but these can't be transparently proxied. FTP is a more complex protocol than HTTP, and provides fewer hints as to the original destination of the request. SSL is encrypted and contains no useful data about destinations. Attempts to decode SSL are precisely what it's designed to prevent: decoding SSL to transparent proxy -- it would be indistinguishable from a "true" man-in-the-middle attack. Source: Transparent Proxying with Squid - O'Reilly Media ...is it worth setting up apache or is the above correct?
tom_newton Posted March 30, 2011 Posted March 30, 2011 The above is (largely) correct. It is possible to transparently proxy SSL without MITM, but I only know of one product that supports it, and its not released yet Squid3 will MITM, but I doubt it would work in transparent or for kindles. 1
Ben_Alton Posted April 7, 2011 Posted April 7, 2011 I've setup a new virtualhost with an IP in the RBC assigned range, connected my wireless access point to use that host as a gateay and set the upstreaming proxy to that of our RBC proxy. Am I right in thinking that the new virtualhost is a gateway for the kindle clients. I've set up each kindle with static ip, which is fine but there isn't a route out as such. Am I missing some routing or something? Did you have any sucess with this ? I'm trying exactly the same thing for my kindles at my school ...
camel Posted April 7, 2011 Posted April 7, 2011 Did you have any sucess with this ? I'm trying exactly the same thing for my kindles at my school ... yes and no. got the browsing working, i.e. i could get a wifi connection, browse the web in ecperimental, but no access to kindle store or retrieve archived items as its https! going to use amazon account in school and take the few kindles home and archive. should have got 3g ones! 1
BatchFile Posted April 7, 2011 Author Posted April 7, 2011 yes and no. got the browsing working, i.e. i could get a wifi connection, browse the web in ecperimental, but no access to kindle store or retrieve archived items as its https! going to use amazon account in school and take the few kindles home and archive. should have got 3g ones! That's what our librarian ended up doing - no 3G signal here
Arthur Posted April 7, 2011 Posted April 7, 2011 but no access to kindle store or retrieve archived items as its https! Would SSLStrip be an option? http://www.youtube.com/watch?v=XKizVsRVdAk As a last resort I suppose you could get a 3g wireless router and dongle or a cheap Android smartphone and set it up to be a portable WiFi hotspot.
Ben_Alton Posted April 8, 2011 Posted April 8, 2011 Yeah I was wandering if setting up a virtual workstation with foxserv and routing the traffic through that way would allow https traffic ?
Ben_Alton Posted April 8, 2011 Posted April 8, 2011 Would SSLStrip be an option? Sorry I hadn't read your post before I posted the previous
Guest Posted December 6, 2013 Posted December 6, 2013 Can i ask for some advice. i work in a school and the LEA has set a proxy in our area too, i want to run smoothwall for our wireless devices, if i went and used it for the whole school including wired, could you confirm that what i have in my head is right My windows server machine dishes out DHCP addresses. so for my smoothwall to work around school would i have to set the gateway in DHCP of my server to an address of the Smoothwall computer and then the smoothwall would be set to the gateway of the main switch leading out of the building to the internet! does that sound right?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now