PaddyNewman

Smoothwall as your gateway, or Smoothwall as the IPsec gateway? I'll have to nose over how mines set up, not on a SW but it'll be the same. My layer3 points that range towards my VPN gateway address from what I remember. If you are getting to the VPN gateway, I'd say it the return end personally, or just one of the devices taking full ownership of the subnet and not sending return traffic back.

You need routes to point the remote subnets towards your smoothwalls IPsec interface IP/VPN IP? If the VPN is up, traffic just needs to be sent to that gateway, I would expect that to be part of the IPsec setup though... This might be within your local network though. Traceroute to an endpoint at the other site, where does it stop/die. I've had multiple smoothwalls installs absorb 10.x ranges. I'm sure it's been down to dodgy customer config but we've had traffic enter but not return as it's been routed badly at the remote end.

How do they deal with ECH? I personally wouldn't trust DNS based filters with anything.

SchoolProtect

I've reached out and if we can do a teams call that would be awesome. If it was 1:1 its so much easier but 1:many means you can't truly know pupilA is using it, devices get passed around. I'm not sure you can identify users clearly with a 1:many... I have a mild dislike to apple for these things as there's very little in the way of school based authentication at the start of the session and it's rather hard to filter them when they are just IPs. However let me tag in @DavidYoung also...

Sorry I work for LGfL, I can probably fix the issue OP is having. Just need the support case that's requested this relay and I can sort it

If you have a case send me a message and I'll look into it and check the logs. Got thousands set up so should work fine.

You could in theory do this anywhere, we are specific (but not the only ones) in that we run the network and we allocate you IPs as we control the routing and everything from on prem to breakout. If you are using NAT in our network the filter cannot be granular to a user level but if you aren't using NAT, typically you'd have a GPO per OU if you wanted real granularity, then each intake year/however your AD structure is set up, would be able to get a different policy. In the case of InTune/Entra, you can have a load of filtering policies and tie one of those to a user as they log in, most people group these as staff/student but you can go as granular as your skills allow.

Happens if you block items with some MDMs or Chrome policies, however it's definitely worth keeping blocked unless you really enjoy kids searching 'the hub' from 6 years ago...

Exactly that. Open all ports to this /20. 'Trust me bro' vibes. You should segment the phones off anyway, but the point remains, why should you open everything.

Yeah, that is possible, I've never used adsm so it's always been smashed into the CLI but the control-plane part is key and if I'm being honest, no idea where that would be within the GUI management.

Presumably you mean don't apply as they've already made it through the WAN. The access-list entries apply in the ASA level, but control-plane rules are pre WAN so should be stopped before hand. Are you cli managing. I don't know any other method but having a nose I've got this... access-list block-test extended deny tcp host 5.1.77.3 10.255.0.1 eq 443 access-group block-test in interface outside control-plane My ASA is 10.255.0.1. It's been a while since I tried or monitored a VPN on this device as ASA is ... Well I don't have software or hardware support or patches, it's a personal device. Thankfully it still runs!

Do you just have an access list entry. Last time I tried this, I had to add control-plane to the rule, stops it being passed to the ASA. If you can't find out the syntax, I'll see if I can get onto my ASA.

I'll be up front, we won't get on as my attitude to things is very different and I'm sure I may be reading you wrong, but you are fairly aggressive in postings and I tend to not argue with people. 8080 is absolutely diabolical. Most filters are 80/443 for HTTP/HTTPS. Not going to see 8080 bound traffic to a remote proxy. Not everyone proxies everything. Firewall is your last line of defence, any holes a goal when it comes to exploits. There are obviously many ways to skin this beast, but the perimeter is where everything is hard locked, by default we allow HTTPS/HTTPS via in lines, DNS to specific endpoints only and basic education endpoints, the rest is hard closed without requests. It's rare we have problems opening stuff, but allowing anything to anywhere to me, and well against your viewpoint, is utterly disgusting behaviour and shows a distinct lack of care for the network you are protecting. Again, not aimed at you in particular, but to that specific viewpoint. Apologies if it sounds like it's towards yourself as a person, not intended, just having to deal with the carnage and seeing things implode through lack of care and thought really sticks with you. However we are straying off topic, encrypt everything, never use the internet, safer.

Yes, pretty much. SIP goes to an endpoint on a specific port, then RTSP is through a variety of UDP ports. For me, personally, I don't mind opening to a /20 on a load of ports. There's no need, but I would if asked. Security wise though, I do want to keep things tight but you can't always win. Never in a million years would I want to allow anything free reign outbound, I'd want a destination, or at least a few and finite port list. This would be for horrible IoT though. For VoIP, a set range going to a set endpoint of a /20 and specific ports, sure. Host may move, host may get compromised, that's a risk. Do a risk assessment on every rule. You can lookup the owner of said IPs on whois tools, RIPE, anything. I imagine some schools here use fortigates and use the ISDB on them and allow random garbage like 8080, which I feel is far more risky than a source range to a /20 on a stack of UDP. I'd never do all ports though, never.

It's a hard no from me, most providers will have specifics. If they don't, at most I'd open UDP 5060 and 10000-65535. Gamma use 6000-40000 for voice, but others use 10k+ so... Worth a try. Also would assume you can lock down a source VLAN too, so limit your spread. Gamma ask you to allow a /18 or something so the size doesn't bother me but I'm always cautious about companies that say 'all ports mate'...

You absolutely can fqdn in iptables, can do a hacky bit of scripting for ufw also but I'm janky. I wouldn't say it's ideal though, and I imagine it won't work as expected for the majority. I've never found it great in iptables. Ufw however and a quick script to resolve and update the fw is easy.

Use latest version 4.50 and make sure you set wagent service to automatic start as a service GPO. It's installed but I bet it's set to manual in services. No idea why, it does it often enough though.

What would be your main worry? Don't even need to sync users these days, you can control it all via the agent, but that's a bit non standard. Is it VPN based filtering so all tunneled to cloud, or client filter based which is just locally installed proxy on a machine

What DNS do you give them? I'd be very careful with how you manage the DNS provision and ideally you block the DoH/DoT options as it can be an easy bypass. I'd hope you/your ISP are doing some form of DNS scrubbing, but I believe your fortigate can, can't log in to one currently to check though.

What filtering do you have on there. Filter DNS query type 65, your fortigate can do it by itself, otherwise filtering can be bypassed. Wouldnt be pointing any BYOD to lan, except for DHCP relaying if you do that. Firewall should handle that in some ways though. Quic should be blocked on your Lan either way, student needs to turn off private relay, you also need to block those URLs on your firewall or run your own DNS and blackhole the requests to the iCloud relay...again, bypasses filter, anyone allowing iCloud.com is going to suffer with that.

I use this https://www.voidtools.com/everything-1.5a/ Used it to find files of same creation date and size as my clone process didn't exactly go to plan and I ended up with hundreds of files across the disk duplicated within many folders!

Obligation vs my general view is very different. I'd be making sure guests were unique, each person who turns up uses a 1 time user that expires in 6 hours, but you record what guest got that name and it's logged in the filter with student filtering. If they get blocked they'll just use 4G. Wireless is a privilege not a right and you accept the terms when you join. I'm not a fan of guest networks though, I'm not a fan of people in general, but a user on 'my' internet is being known from start to finish, if they don't want that, mobile data it is. Same happens at my house, no exceptions. I've seen guests doing some obscure stuff and some downright scary. I want names when the police potentially come knocking.

Ah yes, understandable when its a business expense!

Any reason you don't want to just "DIY" - I can barely hold a screwdriver the right way and mines been fine for 2.5 years