Network traffic logging (http + https)

Question

I am working in vocational school as IT engineer.

I have task to implement solution to effectively block certain or illegal websites, log unblocked traffic, store logs for 6 months.

I am thinking about proxy with authentication for BYOD via AD users and SSO for PC's connected to Windows Domain, so logs would include not only local IP and remote IP's, but also username to identify user.

Requirements:

• No fiddling around with client side devices (school PC's and students devices)
• No SSL errors or something like that.
• Free - opensource.

Now we are using pfsense and Windows Server 2008 R2, and CentOS for intranet/apache reverse proxy.

We are legally authorized and required to collect logs about users browsing history, block illegal websites (betting, movies, porn, etc.)

We don't need to tamper with SSL certificates, purely log remote/local IP's and users browsing history.

Answer 1

This would at least implement logging and blocking

If you have pfsense you should be able to rig something up with iptables and -J LOG or -J NFLOG and port 80,443 and some other things and you got logging. ulog2 can even log to a database, I use it all the time.

install ipset if not there.

ipset create banned hash:net family inet hashsize 131072 maxelem 200000 counters comment
iptables -I INPUT 1 -m set -j LOG  --match-set banned src
iptables -I INPUT 2 -m set -j DROP --match-set banned src
iptables -I INPUT 3 -m set -j NFLOG  --nflog-group 1 --nflog-prefix not_banned ! --match-set banned src

probably better substitute NFLOG for LOG so you can send to DB

-j NFLOG  --nflog-group 1 --nflog-prefix banned

You may have to duplicate or substitute FORWARD for INPUT.