second internet connection or alternative (BLOXX?)

[ranj]

Hi, i was wondering if someone can help me with a dilema we have at our school.

 

At the moment we have our internet connected which is provided to us by the Bham LEA. The filtering is for all, so if I block a site such as youtube.com everyone will be blocked unless we bypass the proxy to another address. ( I dont give this to staff btw, only admin know this)

 

I just learned that the LEA are taking away bypassing the proxy that away from us. THis is Birmigham LEA. Have a look here http://services.bgfl.org/services/itconnect/upstream.htm

 

So I need to find a solution to this, it something which I have talked about for ages but not done anything about it yet.

 

the ideal solution i am looking for is a box or some software which would sit somewhere ( I hear BLOXX or Microsoft ISA server can do this), which talks to AD and if there are 2 groups setup (students and staff which we currently have) students could have a different set of restrictions and staff could also be different, So I could block youtube.com if a user belonged to a student group and allow it for a user in the staff group.

 

Can this be done? is there alternative or better way for me to do this or is there a way with BLOXX or ISA server (solutions which I am currently looking at) which will allow me to do this?

 

Another option would be to get another proxy and high speed business internet connection, but that sounds really messy, especially with all the SPAM out there!!!

 

ANy advice on this would be greatly appreciated

 

Thanks

[beast_gts]

Ask your LEA what they recommend.

[Geoff]

I think ISA server can do this. However personally I have a Linux box running Squid and Dansguardian.

[Guest Guest]

I also recommend dansguardian but in this case i dont think it will make a differance as the LEA are going to block any traffic regardless of whether its already been filtered.

 

Make a stink!!! Thats all i can think that you can do. And tell them that you will be looking into alternative ISPs if they follow through with the proposale.

 

We have filtering done at a local level. We (the techies) just bypass the proxy as apart from the fact that it makes life hell adding every site you want to look at, the proxies also unbearably slow as it is never mind when we start downloading 16gb linux distros through it!

 

There was a proposal to have our router only accept requests from the proxy therefore stopping us from bypassing it. We made our views known and (hopefully) we've heard the last of it.

[GrumbleDook]

I would recommend Corporate Guardian ... and I am looking forward to playing with the new version over the summer (if Stephen lets me)

[openhgs]

We use Bloxx to ensure that our internet access is double filtered for extra purity. The LEA allow youtube.com but we don't and Bloxx allows us to filter it off. The main advantage of using Bloxx rather than Dans Guardian is you plug it in and it works - there is no setup effort on your part. Also, the Bloxx people support the box for you; sometime ago ours suffered a hardware failure and they just shipped us a new box and fitted for it us. On the downside it is an extra cost to the school.

[ICTNUT]

We use BLOXX as well as ISA 2004 and DansG but I agree with j17sparky it does not matter what you do if your LEA are going to control access centrally (especially where you can bypass a proxy) you have no hope.

 

We are lucky in that our LEA do filter but at a very low level for high schools as most filter at school level and not LEA.

 

Kick up a stink, you need to be in control of your internet connection especially where staff need to access legit sites that are blocked and these are needed for teaching as part of the curriculum.

 

Alot of the time the people making the choices at LEA level rarely work in schools and therefore if no-one makes a fuss theyjust carryone regardless.

[tom_newton]

@ranj: if your lea are going to be stubborn about it, you may need to source yur own internet connectivity. A fair few SmoothWall users are doing that, and using our built-in firewall/filter. It depends what mileage you can get out of the LEA really.

 

@openhgs: If you want the advantages of DG in a "plug in & work" solution, that's where we come in

 

@grumbledook: hope you like CG6 - its something of a radical departure interface wise, but I think that it's a good deal better.

[plexer]

I've got the iso and my install key for CG6 so it's coming my students way probably before then end of term if I can.

 

Ben

[unixman]

Kick up a stink, you need to be in control of your internet connection especially where staff need to access legit sites that are blocked and these are needed for teaching as part of the curriculum.

 

The Birmingham LEA web filtering policy is bizarre. If you google "beer" or "vodka" a message tells you "Inappropriate content blocked alcohol", yet "cider" and "brandy" are OK. Google groups is banned because the discussion is unmoderated yet there are hundreds of other unmoderated forums that you can access. They will tell you schools internet link is provided for educational purposes, yet they allow access to http://www.avfc.co.uk, http://www.manutd.com, etc - sites with no educational value at all. The educational site http://www.faqs.org is banned yet the anarchists cookbook is allowed. You can try pointing out the many inconsistencies to no avail.

[ranj]

Thanks for the advice folks

 

Its more about splitting the access between staff and pupils. Using the example teachers complain that there is some really good content for history and science on youtube, so I dont want to block for staff but staff and myself agree that it should still be blocked for pupils.

 

If there is a system that can use active directory and knows if someones a student block this site and if its a staff members it allows the site that would be a great start.

 

I know lea will block what they think is a right and most of time I am fine with their filtering, its just I need that flexibility in school to partially allow some sites to some users.

 

Thanks

[ranj]

Thanks for the advice folks

 

Its more about splitting the access between staff and pupils. Using the example teachers complain that there is some really good content for history and science on youtube, so I dont want to block for staff but staff and myself agree that it should still be blocked for pupils.

 

If there is a system that can use active directory and knows if someones a student block this site and if its a staff members it allows the site that would be a great start.

 

I know lea will block what they think is a right and most of time I am fine with their filtering, its just I need that flexibility in school to partially allow some sites to some users.

 

Thanks

[openhgs]

If there is a system that can use active directory and knows if someones a student block this site and if its a staff members it allows the site that would be a great start.

 

Bloxx can certainly do this. You can control what an individual user or a group of users can access. You can target groups of machines too, which is what we do. Staff machines have less strict filtering than student machines.

[plexer]

How do teachers who have access use youtube footage in the class? just show it on the IWB?

[mortstar]

Bloxx can certainly do this. You can control what an individual user or a group of users can access. You can target groups of machines too, which is what we do. Staff machines have less strict filtering than student machines.

 

Which version of Bloxx are you running? I have 3.2.1.6 (snappy version number) and it definitely doesn't have per machine settings it's per user - or more specifically per OU as it picks up groups from an Active Directory bind.

 

I had heard that future versions of Bloxx will have per machine settings which would be cool 8)

 

How do teachers who have access use youtube footage in the class? just show it on the IWB?

 

Our staff use their projectors to show videos from youtube. I've seen youtube used in Science, R.E., P.E., English, Geography and History.

 

On a previous discussion on youtube.com Geoff put a great link http://www.teachertube.com , quite US-centric, but the teachers really like it.

[tom_newton]

Both Bloxx and SmoothWall Guardian take settings from AD group - neither does per-machine auth yet, but we are certainly stroking our collective chins and thinking about it. It's a very "schooly" thing to want to do, but then we are pretty education focused here.

[limbo]

Ask your LEA what they recommend.

 

I have already done this dance with the LEA - we used to have an ip address that was allowed to bypass the filtering altogether because of a few projects we were running, and I know a few other schools had this too.

 

I was told that schools have to have a Becta approved service which means filtering must be in place.

 

I had a meeting with them earlier in the year and they said there was somthing coming and we could be on the pilot for it, got a phone call to say the person involved was going to be out of the office for a week and head nothing since. That was quite a few months ago.

 

At the moment we are having to bypass our local imimic box because it made a lot of sites unusable - mainly those that need to maintain a session.

 

I also discussed the option of a second internet connection from a different supplier for this purpose, but the LEA said that a) the provider would have to be Becta approved and therefore insist on filtering and b) it would give them concerns about security impacts on the BGfL network because the connection between us and them is open. This is obvisouly not unfounded, the connection between a school and the BGfL is open so they can offer remote support, ftp transfers etc.

 

So if you find a solution then let me know.

[tom_newton]

Just FYI, CorporateGuardian 6 (our standalone filter) will be Becta certified (once they have finished testing it - it is very new), as will the next version of SchoolGuardian (January). This is largely in order to overcome objections from LEAs on behalf of our School customers.

[limbo]

@tom - what I understand from the LEA it is the ISP that has to be Becta approved, not the filtering service and that the ISP have to offer filtering to be Becta approved.

 

Because of the way the LEA WAN is structured, they are not happy with giving up all filtering because of the threat to the LAN. For example they will not let us control our own profanity, spam or virus filtering for email, only put in a layer above their filtering - and as their filtering is very vigilant most of the problems we have are with things being filtered when we do not want them to be rather than the other way around.

[plexer]

Jesus I thought Norfolk was bad enough but they will let us opt out of their filtering and do it ourselves.

 

All that stuff abuot being Becta approved is just crap.

 

Ben

[limbo]

They do offer some flexibility with the filtering - but only if you buy in to their systems such as bgfl+ and pmm - but these products are not suited to the way the school works and we have actually had to add a layer of filtering on our exchange server just to filter out all the pmm messages that get generated and sent to staff.

[openhgs]

Bloxx can certainly do this. You can control what an individual user or a group of users can access. You can target groups of machines too, which is what we do. Staff machines have less strict filtering than student machines.

 

Which version of Bloxx are you running? I have 3.2.1.6 (snappy version number) and it definitely doesn't have per machine settings it's per user - or more specifically per OU as it picks up groups from an Active Directory bind.

 

We have the same version as you. We have static i/ps on all of our machines, which enables us to track by machine. We don't use active directory either.

[greenfieldsupport]

@openhgs

 

Dear god, static IP's!?

 

What an administration that would be.

 

what would happen if your default gateway IP address changed, or you needed to change the IP of your dns server, or add another one in? :\

 

Have you not concidered using DHCP?

[tom_newton]

@openhgs - do you use any directory service? OpenLDAP etc?

[mortstar]

I was intrigued openhgs' non-AD and static IPs so I googled.

 

The middle paragraph of http://en.wikipedia.org/wiki/Handsworth_Grammar_School may be the reason why.

 

Though it still doesn't explain static IPs?!