PaddyNewman

25 won't connect, we don't allow port 25. 465 is old school relay, only one of theirs allows that port. 587 looks to work as expected. You'd need to check their requirements, but presumably you need to provide credentials as per this doc - https://apps.google.com/supportwidget/articlehome?hl=en&article_url=https%3A%2F%2Fsupport.google.com%2Fa%2Fanswer%2F176600%3Fhl%3Den&assistant_id=generic-unu&product_context=176600&product_name=UnuFlow&trigger_context=a They state "Only accept mail from the specified IP addresses—System accepts only messages sent from IP addresses that you specify" which means you can yuse your public NAT address, that won't change... I have never done so and I can't test as my workspace is not at that subsciption level!

Yep, if you cannot get there on the port specified, thats the error. Can you telnet to the address you are using (smtp.gmail.com or whatever they tell you to use these days) on port 587 (again might be different depending on the choice of relay..) If you can't telnet, its the firewall. If you can, the SMTP commands your object is sending are not supported. Some stuff expects the first SMTP command to state that STARTTLS needs to be on, then it continues as there is auth, sometimes it wants AUTH... all depends again on the server host if you are the school I think you are, you do have those rules open HOWEVER, not via FQDN, so feel free to ask for the FQDN to be opened

Just to hopefully 'help' - the LGfL relay will accept from [email protected] - it only cares that your domain is genuine. You could send from [email protected] if you wanted, as long as paddysschool.kent.sch.uk is legitimate and has DNS records to help with bounced messages, would need to be able to post the failure back via MX. The TXT record you have might be SPF, which denotes mailrelay.lgfl.org.uk as a valid sender. Always happy to help folk use the relay, but if you need to not authenticate at the user side, but at the Google SMTP side then... Microsofts own SMTP can be used, you can set zero authentication on the inside to all can post to that, then you set up the outbound via Googles own SMTP address with authentication. That does work fine, and means you can post all your stuff to your on prem server. Happy to take a PM if you need a hand same with @fiza

What are you currently connecting to it with? If its a L3 switch, use the Smoothwall behind that and route traffic through it... but no, I would expect Smoothwall to support that as its linux underneath and similarly would expect the ISP to support a /30 on the edge. Aren't expo-e just using a Juniper edge with your range routed to nexthop, nothing stopping the change to a /30...

As its cloud, sadly not. The relay is internal only, not exposed to the net and only accepts from the 10.x range with a verified domain/email address.

I'm curious about how you believe Netsweeper to be weak, as long as you are inspecting traffic you should be able to block pretty much anything. Same as most filtering solutions to be honest. You can add to that at the firewall by locking down most things and only allow absolute basic traffic to a specific DNS host to stop them going around that way.

From a purely logical sense, you should leave it on as the true test of your edge security and as such the pen test is almost zero value at that point? I have no idea on the setup sorry, but just removing security to test security makes as much sense as asking a burglar to get in but leaving the catch off to make it easier. Forgive me for being nosy!

I am currently on leave (with the worst signal ever) but if you can hold till Monday, drop me a PM with your number or email and I'll get in contact Monday morning.

VoIP and double NAT can be a fun one. It will work as long as you set it up correctly however it's probably just as quick to re-IP. If you really want to use those, just choose a small pool of lgfl 10.x IPs, use them as NAT for the individual 172 subnets (for firewall rule processing, its a 1 to 1 NAT on our side for things that need exposing) and put your staff/students outside of the pfsense, use the core to route them correctly, should be fine. Personally, I'd ditch that and just move the IP range because internal NAT is just another trip hazard in your day to day life. No side eye @psydii - you do you, as long as the service works and you are aware of the usual 'its your network and we can't see that far, you'll need to investigate' as Koldov said, might be good to call and see if they can do anything or advise?

I'm not aware of that, it isn't a default option and I expect it's not their StaffMail service, best to raise a case and ask though as AdEPT would be best places to tell you

Would ask for the KCSIE statement and if they have submitted compliance for that. Can't say I've ever used barracuda, and it's never even blipped on my radar...

Would be odd to do that... However, your provider should be able to provide something akin to 'heaviest users' or at least a capture from a firewall level at periods of high load. General web traffic, especially check ins to a website, will not swamp your connection. They are tiny requests. We have seen evidence of a single Windows 10 PC doing updates max out a 100Mb leased line, can't imagine anyone goes to MS directly these days for all their machines, but its easily swamped if you do.

Basic Linux DNS server running PiHole which is pretty good. Forward school/home DNS to PiHole and then PiHole to root servers, has been working really well for me. Means less garbage on my machine/browser personally.

ichef.bbci.co.uk and iplayer-web.files.bbci.co.uk are the biggest hitters on my local proxy when streaming. Its doing a fair bit on Akamai too, vod-thumb-uk-live.akamaized.net but the subdomain seems to randomise. if you HTTPS inspect, bbc.co.uk/iplayer is the path.

I know the answer I have responded to your PM however for other users in LGfL, the VPN is one-way. Outside(VPN address) to Inside(School range) = perfectly fine. (School range)Inside to Outside(VPN address) = denied by ACL on the school firewall. VPN addresses are provided via DHCP from a large range allocated on the VPN firewall. We just handle the routes and ACL on the inbound side, so you get access to your chosen routes from the support site config. You cannot talk from school to VPN address as it would mean you could talk to anyone on that VPN range, which is a security risk.

Are you decrypting? If you don't then you get the domain and that is it.

Packet capture instantly for me, with video its usually STUN/TURN and UDP traffic, but I haven't got the software to test here personally.

on my very insecure Pi which handles logs, I use mount from "cifs-utils" and just mount the share in a script with my password in plaintext, if someones got to my Pi, they are in my room.. Can't get on my Pi as away from home but its something like this according to an old backup; sudo mount -t cifs //172.16.18.100/filtlog /mnt/localfiltlogs -o user=username,password=password The script then does something like cp -r /etc/e2g/logs/. /localfiltlogs I know I remove the mount afterwards because the Pi and server are rebooted often as test bits. I will try to remember to look at my script but I won't be at that device for some time and this is from some old google doc I have from trying things before! I do however have SMBv1 enabled because I am mildly unstable, and these machines have very restricted access so I am less worried.

My address is public on the net somewhere, but I am near Boston, just north of it. What are you planning? Might be able to advise?

How does that work, we don't use it (I use other filtering platforms entirely) but how is it passing on prem creds to a transparent filter? Is it on an agent setup?

Wow, so there is no agent authentication, purely RADIUS. I presume most schools have that in place, but I've rarely seen RADIUS in a primary!

Always welcome to take a look/test it if you are anywhere near Lincolnshire, its a pretty simple concept though Right now I am showing 245Mbps down, I can definitely hit that constantly when testing through Steam. My current IP is 145.224.67.x and according to my monitor, that changed about 3am, no reboots, but I do have an outage listed for about 2 seconds around that time both on monitor and the Starlink app, 1 delayed ping, 2201ms so presumably thats when it flipped. I imagine given the size of the Starlink range, and the amount of UK subscribers, theres a fair few of us using that IP currently, the breakout is in Heathrow, this map is pretty cool too, starlink.sx, very resource intensive though.

Does it not support user authentication!?

Adapter is for Ethernet, they don't offer as part of the router. It is yet another add-on at £40 or something. All CGNAT, terrible if you want to use TeamViewer, I get a 'this is business use' warning, but switch to ADSL and I am perfectly fine to connect. I don't host anything internally, so its not a problem for me. Obviously if you aim to game, CGNAT and ModerateNAT status go hand in hand.

They probably are offering it as an add on if you don't want to go via their own connection. At that point, without magic routing, there is no way for it to be transparent, so you must explicitly state the endpoint. We do something similar, but we bring the traffic to us via VPN, which is then transparent rather than explicit proxy. RM probably don't want to have VPNs all over the place.