Transparent Content Filtering (SOHO)

[bergie008]

Hello all,

I am not much of a Forum guy but I am starting to fray at the ends trying to get a solution that fits my situation well. I apologize if this should have been in Router's and Gateways instead or somewhere else in the Forum, please feel free to move it or tell me where to put it and I will be more than willing to oblige.

I will now briefly describe what I am looking for. I want a transparent, low cost, effective, content filter to use in 3 different SOHO environments. 2 are personal homes and one is a Church.

I have already looked into DansGuardian but it has no more support and the newest stuff I can find online documenting how to use it is from 2009, regardless I tried it myself on several different Linux based servers including CentOS, Ubuntu, and the Smoothwall* firewall "os", I was unable to get a working solution in place on any of these systems. If I could get DansGuardian to work it is the best solution I have found so far since it is free but I have a few issues with it.

It is difficult to install.
It is complicated to configure.
Would be hard to manage for anyone not intensely familiar with the solution.

My two favorite aspects are that it is open source and instead of just relying on a "Whitelist/Blacklist" setup it scans each individual website for unwanted content and blocks it accordingly without blocking common mistakes, for instance, someone searching sites that contain the word "Breast" are likely to get blocked, but when found with words like "medical" it is less likely to be blocked based on a user set threshold.

I have also very briefly looked into nTop (this looked like an excellent solution but I could not ascertain what they offered on the free side compared to their enterprise solution) but quickly found it would be too difficult for me as I was unable to find any good documentation on it and although I may be mistaken the technical aspect of it looked to be beyond me.

SafeSquid is another one I tried and found lacking. It is very simple to install although adding transparency can be a small chore with only one network card, assuming you really want this solution to work you bought another and from there it was a lot easier but still time consuming to get the transparency working. Anyways this solution also mainly relies on lists and it does not block https at all out of the box and I never got that working right, or the caching for that matter, all in all this solution was very difficult to manage and did not do the job in the end.

Untangled was another place I looked but it uses a Whitelist/Blacklist for its filtering and it only offers a small portion of its database to the free user and it is not actively updated. (you can pay for their solution but its over 1400 for just the web filtering aspect alone and slightly more for their hardware solution and a yearly rate of 300+ dollars which is out of my price range.)

Speaking of Whitelist/Blacklist you cant use Google to find a solution like what I am looking for without coming across OpenDNS. The only way this would fail to be my favorite solution was if Dansguardian were still supported. The only problems with this solution are that it is too easy to get around (I did a simple Google search and found no less than 4 ways to get around the service of which 2 did not occur to me at first, with today's generation knowing more and more about technology its not something I'm willing to risk)



So I'll stop rambling and get to my point. I want a solution that I can install on my own hardware, Linux based is preferred, to provide transparent, intelligent, content filtering for anything on the network. Such a solution could easily also use services such as clamAV to provide anti-virus on the network level as well as caching to help improve internet speeds somewhat and a firewall solution, NAS, plex, and so much more. (The more you use the more $$$ you are going to need for hardware) but most of these are not very demanding process wise and would be very easy to integrate onto an old system.

Also its not required but it goes without much thought that it would be very helpful to have "monitoring" for such a solution. Perhaps something can take all the logs that could or would be setup/created by each service on the server and analyze them for viewing. I would like this to be capable of bandwidth monitoring and report on the device name, MAC, current IP, and time of any such logged traffic (so that I can pinpoint users that are trying to abuse the system and react accordingly as well as perhaps improve the solution if they do manage to find a way around it)



I know that I have said a lot here and most of it is what some would consider an enterprise solution, and perhaps it is, but this is at the heart of what I need to protect my users from the internet at large. If their are any ready to go solutions such as "Shade" (just found this today have not had much time to look into it) I would be willing to try them but only if they work in a way as described above.


Please lend me a hand as I am struggling to find a good way to make this happen and I'm sure I'm not the only one.

Thanks,

Bergie


*Smoothwall replaced Dansguardian and they do offer a free firewall solution which is easy to setup and install that I liked a lot but sadly it did not offer any filtering out of the box you have to add Dansguardian and there are a lot of compability issues.

 

[john-b691]

The problem is someone must maintain the lists of sites. Either you spend YOUR time for FREE ? or you pay someone else to maintain the lists. Even with the lists from various sources you get what you pay for. There are so called "free" lists you can get but some have not been updated for years, you need a list that is updated daily.

The best free solution I have seen is from bluecoat called K9. Their free option is software designed for home use it is a client that is installed on the end devices themselves. This product uses exactly the same filter list as their commercial systems. Some people theorize that the reason its free is that they get the benefit of all these free users helping to categorize sites without paying for the labor.

Once you start talking about a inserting some appliance in the stream to do this filtering you have defeated your goal of being easy to maintain. In particular the home built ones based on linux require a high skill to maintain. Of course the commercial ones like bluecoats are very simple to use but cost a lot and have large yearly support contract.

You likely will never stop users who have any ability to search the internet to find a way to bypass you. The simple way is to use SSLVPN. You will never block all the VPN sites and you can't block HTTPS. You also tend to make the systems unusable if you try too hard. Are you actually going to tell users they cannot use language translation web sites just because you can translate porn also.

 

[bergie008]

John,

Thanks for the insight, I have not looked into what K9 offers yet but I have heard about it and now I will def give it a shot.

*Edit*

John, just got back from looking into K9 and although it looks like it would be a workable manageable solution it does not work for me because I cannot find a way to make it transparent, I see now that you did say end user client device that I missed in my first reading. Users come and go and so do their devices, but more so than this, end user solutions like this (and there are many and prob a few I would use over K9) do not help in today's world because of smartphones, tablets, e-readers, and basically any other device on the network aside from a traditional laptop/desktop. Even PS3's can browse the web and as such would not be affected by this type of solution. It's also why a Proxy solution (Dansguardian filtering everything that runs through Squid) is very much imperfect because iPads are basically the only tablets on the market that can use proxies and they are limited at that (from what research I have done).

*Edit*


As for list based, I would prefer to stay away from using a whitelist/blacklist by itself, I do not mind combining Opendns with whatever content filtering solution I encounter, in fact I think it would be best to do so and its a great community which is always getting updated and their service fee is something I would pay in a heartbeat if it was simply not so easy to bypass.

Also on a side note I'm not trying to be an internet Nazi, I simply want to protect my users from many harmful sites on the web, especially if they are trying to get there themselves, its impossible to obtain a 100% foolproof system but there is something to be said for having a castle wall with a moat around it vs a picket fence.

I also submit to the idea that there is not going to be anything on the market today that is simple to maintain when its your own "appliance" you installed yourself on a Linux based system. But at least it could have a web-interface instead of a config file you have to vi or nano into on the box itself (which will have no display so an admin would have to SSH into it).

Your typical user is going to use "tricks" (s)he has learned from their peers, stuff they have seen online, or from another source but chances are good that it will have little to nothing to do about VPN's, the most complicated I expect my users to get would be to use a proxy IP to fetch their traffic for them and "disguise" it on the network or if its a DNS based solution just change their DNS settings to a Google DNS ip or something like that. (I at least know how to prevent users from choosing an alternate DNS but finding a fix for the proxy problem is taxing).

Thanks again for your time and I look forward to more imput.

Bergie

 

[choucove]

It's not going to be a free option, but I have used the content filtering services included with the Sonicwall TZ series firewalls as an add-on subscription with great results. The Sonicwall content filtering service is based off of category blocking, but you can also add your own custom blacklist/whitelist if you wish for specific sites and needs. You can fine tune the level of content filtering as well to block out just certain key categories of web content (like porn) but allow others (like weaponry)

Content Filtering through Sonicwall can be purchased as a single add-on subscription to any of their TZ series of firewalls (which are quite reasonably priced) or come included with the TotalSecure subscription package which is an annual fee which also includes gateway antivirus security, intrusion prevention, and dynamic 24x7 support.

We use the Sonicwall content filtering at the local public library I help to manage, and have had absolutely no problems with it for the last two years of usage. With firewalls starting at as low as $300, and the content filtering subscription running as low as $200 a year, it's probably the most cost effective business-class firewall content services I've come across.

 

[bergie008]

Choucove,

I have not looked into this paid solution yet, I have looked into others such as Barracuda and Endian (which also offers a "community edition which I am going to try and test out today) to name a few, what I have found is that they are well out of my price range. Sonicwall would be a good solution for me, even paying $200 a year so long as the lower end pricing on the product was sufficient (in my experience it can be but normally is not) but I don't have the need for a paid firewall. I really am not sure if I even want a firewall at all yet, and if I do, there are plenty of open source ones that would work with any such solution I will end up with because the application would be simple.

What would really be nice is if they would offer their content filtering on a stand alone basis, but here I am dreaming.

Thanks for the imput, I look forward to more discussion on this.

Thanks,

Bergie

 

[Guest]

It's not a free solution but Trend Micro Interscan Web Security Suite will do what your looking for, as well as having the ability to set explicit white/black list it uses what Trend call Web Reputation, these are filters that are set to particular types, such as webmail, social, adult etc, the reputation lists are managed by Trend and are updated regularly.

There is a linux version so you won't have to pay for the underlying OS at least.

 

[bergie008]

DA,

Thanks! I don't see right away what the pricing is or even the transparent end of their solution but I will dig in a bit and see if this is something that will fit my needs, sounds good!

*Edit*

I still don't see where there is a transparent solution for this product, everything I see is end user based, I don't have time to call their support as I am at work but I will follow up with this as soon as I am able and keep you guys posted.

*Edit*

Thanks for the imput,

Bergie

 

[bergie008]

Update!

Hello again everyone and thanks for your input. I have momentarily stopped my search for a SOHO content filter to favor the Shade internet filter solution. Seems to be Christian based, which the Church I am helping to support will be very happy to hear, but more so than that it means that they are motivated in their solution.

From everything I know about them so far, they will provide a service that would be similar to openDNS, if they offered a hardware solution. It also offers caching and a few other "goodies" with plenty of reporting and unlimited users and devices all for around 5 bucks a month. They are a new company is why I had never heard of them and it took multiple Google searches to find them even after I knew the name but if everything works as advertised I advise anyone looking for a SOHO content filter to look into this solution. I will re-post after my 30 day "trial" and see if it was effective.

Also just as a side note they do filtering on the packet level, where is it going, what does it contain, so anyone trying to use a Proxy or Web Translator page can be filtered if the user chooses to in the options on the device itself. If I didn't know any better I would say its just a Mikrotik router so perhaps they will sell the configuration and users can buy one of Mikrotik's many available router solutions and create their own device.

Thanks,

Bergie

 

[Guest]

Does that mean it filters out any searches about Darwin .... lulz.

 

[bergie008]

DA,

I have not confirmed that they are Christian based but no, I did not mean that they would simply filter out anything they did not believe in, and it is a public company that sells to the public at large. Like Chick-Fil-A without as much controversy.

Thanks,

Bergie