0

Sorry if this is not related here, please tell me where should I ask this. :)

I work in school and have the task to optimize network.

I need to make:

  • Captive portal with MS Active Directory authentication,
  • Content filtering for gambling, pornography, and other custom websites
  • Filtered content logs analysis to identify most popular websites, malware and what users are browsing
  • DHCP server with static leases
  • Egress firewall
  • DNS server to define internal addresses
  • Malware protection
  • Simple port forwarding (NAT LAN compatible)
  • Optional: advertisements blocking
  • Optional: LAMP (apache, php, mysql)
  • Optional: Email server
  • Optional but very requested - High Availability (HA) (secondary almost identical machine for taking over all functions in case of main router failure or maintenance)
  • Optional: VPN server with MS AD authentication
  • Everything has to be manageable from GUI (web) because other people with very little network and UNIX knowledge will be using it to block content, add static leases, open ports, create email accounts

What I have:

  • IBM server x3400, Intel Xeon CPU E5310 @ 1.60GHz, 4 cores, 8GB RAM, 6 SAS HDD (73,4GB) with RAID controller, 4 NIC (100mbit)
  • Funds: none to very little single time investment for hardware - max 100-120€
  • Whole school is connected linearly via switches. Router>switch>classroom>switch>another class>and so on
  • Lots of old computers
  • Windows server with FTP, Web server, Active directory

What I have tried:

Ubuntu server with DHCP, LAMP, squid, sarg, iptables, Webmin. Working quite nicely but not very easy to configure even for me. For people without none to very little networking knowledge, it is nearly impossible to manage it.

Webmin helps a lot for me to manage static leases, firewall, to look into squid reports.

Previously I have tried zeroshell with quite bearable performance. It lacks flexibility and easiness to manage all required functions and HA.

I have tried to install coovachilli with no success.

What knowledge do I have

  • I know how to install Ubuntu from command line
  • I have some knowledge in IPs
  • I have little to no knowledge in iptables. Most of my success is from trying in webmin based on examples from Google searches.
  • I looked up ClearOS, but my school can't afford that
  • I know how to use vi
  • I know how to setup Wordpress or other CMS

How I expect it to work:

Student connects to open WiFi network>Connects to captive portal with Active Directory credentials>browses internet. Optional: Each student can connect one computer and one smart device (shared sessions: 2)

Administrator can:

  • block, specific or based on phrases, websites;
  • open and forward ports,
  • watch, which websites are popular, or gets past content filter and block it
  • block devices which have malware which is connecting to internet based on logs provided by governmental IT dept as emails
  • assign DHCP leases
  • change hotspot login page, to include news or hotspot login page should contain news box
  • define websites which are accessible without hotspot authentication
  • control hotspot login page appearance
  • view content filter logs to identify which users are browsing certain websites
  • manage internal lan domains (ie. server/, ftpserver/, intranet/)

As I mentioned earlier I need GUI for Administrator, as he doesn't have proper knowledge in iptables, or, let's say, UNIX at all.

Webmin is quite easy to use for me as I know where to search for what, but it lack some modules for requested features for easy management.

1

Take a look at Untangle. It should do most of what you need.

Note that there is both a paid and a free version of the content filter, and the free version sucks pretty hard. It works, but it's lists aren't very complete. Content filtering is a service that needs a lot of power behind it in order to keep up with the ever-growing internet, and so you won't find a worthwhile service that doesn't charge. If needed, you could combine Untangle with OpenDNS filtering to get you the rest of the way there at lower costs, but now you're starting to get complicated for non-technical folk.

Also, you asked about https content filtering. I need to make sure you understand what you're asking here. In order to filter https traffic, you have to make one of several (bad) choices:

  1. Filter based on the SNI field only, which is often not present or provides bad info.
  2. You have to push a certificate into the trusted store for every browser that will use your network. And good luck with smartphones and the like. Even this may not be enough in a year or two, as there is talk that certificate validation will soon include white-listing issuers via DNS, as well.
  3. Users will see lots and lots of invalid certificate messages.

Again, any system that filters HTTPS traffic has to settle for some combinations of those limitations. Corporate networks may be able to handle #2 (at least for now), but at a school with lots of student devices, you'll find it incredibly difficult to get the certificate installations done.

  • I don't care what users are doing on https websites, I just want to block domain. Is this still a case? – Žygimantas Markevičius Mar 11 '16 at 20:54
  • Yes, it's still the case. You might be able to block a site via the SNI, but there's no guarantee. – Joel Coehoorn Mar 12 '16 at 1:18
0

Packetfence did not fully suited our needs regarding DHCP management, but I found PFsense, which is easy to manage, provides HA Out of the box with few clicks, easy to setup AD authentication, has really great captive portal solution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.