RabbieBurns Posted June 6, 2011 Posted June 6, 2011 We have a whole bunch of students going to a remote campus for a term, and I need to set up some filtering and a caching proxy for them. I have the full MS Schools agreemeent, would I be better off using MS solution ISA (is it called somehting else now?) or setting up squid and dg.
bart21 Posted June 6, 2011 Posted June 6, 2011 MS ISA is now called MS Forefront TMG (threat Management Gateway) nick 1
jamesreedersmith Posted June 6, 2011 Posted June 6, 2011 Do you currently have a smoothie at all - they may let you run a second appliance for a while FOC?
lordasb Posted June 7, 2011 Posted June 7, 2011 we have isa 2006 but do not use it for filtering web content or blocking users from internet. too much overhead swapped to bloxx internet filter
ricki Posted June 7, 2011 Posted June 7, 2011 Hi We use squid and dansguardian with identd on the clients so the dansguardian box knows who someone is and which filter group to put them in. It scans files for viruses and when its in the cache and does not get affected by viruses and its linux. I would go for this option its not perfect but once created it will run and run. You can also do reports on what someone or what computer has accessed on the web its great but would take some setting up. If you have enough money a comercial version is available http://www.smoothwall.net/live/index.php Richard 1
RabbieBurns Posted June 7, 2011 Author Posted June 7, 2011 I'm not going to waste money on a commercial product as this is just for a 1 off term for only about 40 students. I want something quick and easy I can just set up and dump there just to filter their web. The laptops all have AV on them. Squid and Dansguardian sounds like a faff to setup unless there is a really comprehensive how-to especially designed for school filtering? I will have a play with TMG today and see what it can do.
KK20 Posted June 8, 2011 Posted June 8, 2011 (edited) Squid and DG is not "easy" if you have no linux knowledge. If I am honest I got a debian, squid and DG "working" within a few days and I was a linux virgin but it took a few months to get it finely tuned - mainly due to my lack of time and knowledge in linux. Now I have 4 groups - junior school, senior school, staff, unfiltered all using seamless NTLM with a script scraping my OUs every hour putting the logon names in the correct filterlist. My advice is to use debian and compile squid3 and DG using NTLM options. That is the most stable for me and has worked flawlessly since I did it. This was my guide to get NTLM squid. Adding DG was easy enough after this: squid with ldap_auth and squid_ldap_group... help needed [Archive] - Ubuntu Forums I customised mine (in the end) to use a network bridge - that way the client gateways do not need to be changed. bridge-utils and brtables were used to force traffic along. You will also need a blocklist from somewhere. I use http://urlblacklist.com/ on a "1 per week" pricing. It has worked well enough for a "raw blocklist" but over time I have tuned the page scanning in DG to be more than adequate. Edited June 8, 2011 by KK20
RabbieBurns Posted June 9, 2011 Author Posted June 9, 2011 IVe got linux knowledge but time is the factor I dont have much spare of. Ive found an old one of these in a cupboard: watchguard firebox x5500e Does anyone know if this will do anything without it being on any sort of contract?
RabbieBurns Posted June 13, 2011 Author Posted June 13, 2011 ok so the watchguard thing was over 3 grand for a year. Does anyone know what the cost for smoothwall is for just 40 users? @tom_newton do they do licenses on term by term basis rather than year by year?
RabbieBurns Posted June 13, 2011 Author Posted June 13, 2011 D-Link NetDefend Network Security UTM Firewall, 1 WAN, 1 DMZ, 4 LAN, 2-Year IPS/AV/WCF Subscription does anyone have experience of these?
tom_newton Posted June 13, 2011 Posted June 13, 2011 (edited) @RabbieBurns - sure if you need an odd-term licence we'll be able to help. We also do licences for any number of users 10+ Edited June 13, 2011 by tom_newton 1
RabbieBurns Posted June 13, 2011 Author Posted June 13, 2011 thanks Tom. Do I need to go through customtech? I need to have a solution in place for close of business wednesday, so will speak to my boss tomorrow see what he says and then get a price from them asap. Cheers
DrCheese Posted June 13, 2011 Posted June 13, 2011 unfiltered all using seamless NTLM with a script scraping my OUs every hour putting the logon names in the correct filterlist. Out of interest, what script do you use for this? At the moment I do a manual dump of our OUs at the start of the year and concatenate the correct =filtergroup on the end of the usernames. Then during the year if we create new accounts we add them manually. Have been meaning to see if I can script this for a while as it's a bit of a pain My system works fairly well but I'd replace it with full on smoothwall if we could afford it, but we're so poor nowadays
tom_newton Posted June 13, 2011 Posted June 13, 2011 Yes, go through Custom... i'll let Gordon know the score. Tom
tom_newton Posted June 13, 2011 Posted June 13, 2011 If you run into any troubles in terms of getting stuff done, drop me a mail, i'm liable to check stuff out-of-uk-hours 1
KK20 Posted June 13, 2011 Posted June 13, 2011 (edited) Dr Cheese: http://www.edugeek.net/forums/nix/7797-can-squid-pass-ldap-info-user-group-name-dansguardian.html#post401992 I still use the same script on working day hourly cron. Obviously it will need adapting to your needs. Sorry for thread stealing Edited June 13, 2011 by KK20 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now